logrhythm.com Open in urlscan Pro
141.193.213.20 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
Submission: On April 04 via api (April 4th 2024, 3:02:35 pm UTC) from FR — Scanned from FR

Summary HTTP 168 Redirects Links 24 Behaviour Indicators

Summary

This website contacted 33 IPs in 4 countries across 23 domains to perform 168 HTTP transactions. The main IP is 141.193.213.20, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is logrhythm.com. The Cisco Umbrella rank of the primary domain is 217004.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 15th 2023. Valid for: a year.

This is the only time logrhythm.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 66	141.193.213.20 141.193.213.20	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
7	2a02:26f0:350... 2a02:26f0:3500:16::215:1495	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
10	2606:4700:440... 2606:4700:4400::ac40:93bc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.65.181 151.101.65.181	54113 (FASTLY) (FASTLY)
1	104.17.71.206 104.17.71.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	13.225.78.57 13.225.78.57	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:81d::2008	15169 (GOOGLE) (GOOGLE)
1	199.232.196.134 199.232.196.134	54113 (FASTLY) (FASTLY)
15	13.32.99.82 13.32.99.82	16509 (AMAZON-02) (AMAZON-02)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c00::9c	15169 (GOOGLE) (GOOGLE)
1	172.217.23.99 172.217.23.99	15169 (GOOGLE) (GOOGLE)
10	52.55.132.161 52.55.132.161	14618 (AMAZON-AES) (AMAZON-AES)
11	2.17.100.184 2.17.100.184	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	18.66.102.11 18.66.102.11	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:148b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	88.221.60.75 88.221.60.75	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	172.64.150.44 172.64.150.44	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.32.27.19 13.32.27.19	16509 (AMAZON-02) (AMAZON-02)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
1	2a03:2880:f17... 2a03:2880:f177:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
9	54.152.183.68 54.152.183.68	14618 (AMAZON-AES) (AMAZON-AES)
1	2a02:26f0:ab0... 2a02:26f0:ab00::214:8e70	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	76.223.9.105 76.223.9.105	16509 (AMAZON-02) (AMAZON-02)
4	104.16.137.15 104.16.137.15	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.16.136.15 104.16.136.15	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:225... 2600:9000:225e:7400:f:7ae2:7780:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:225... 2600:9000:225e:4000:f:7ae2:7780:93a1	16509 (AMAZON-02) (AMAZON-02)
2	13.35.58.60 13.35.58.60	16509 (AMAZON-02) (AMAZON-02)
168	33

66 141.193.213.20 (United States) 1 redirects

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

logrhythm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:26f0:3500:16::215:1495 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2606:4700:4400::ac40:93bc (United States)

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ka-p.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.181 (United States)

ASN54113 (FASTLY, US)

play.vidyard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.71.206 (None, )

ASN13335 (CLOUDFLARENET, US)

ecrm.logrhythm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.225.78.57 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-57.fra2.r.cloudfront.net

consent.trustarc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.196.134 (United States)

ASN54113 (FASTLY, US)

logrhythm-com.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 13.32.99.82 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-82.fra60.r.cloudfront.net

cdn-app.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.99 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s45-in-f3.1e100.net

www.google.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 52.55.132.161 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-55-132-161.compute-1.amazonaws.com

jukebox.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2.17.100.184 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-100-184.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.102.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-11.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:148b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.221.60.75 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a88-221-60-75.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.64.150.44 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 2 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.19 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-19.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

050-uwt-888.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f177:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 54.152.183.68 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-152-183-68.compute-1.amazonaws.com

spcollector.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:ab00::214:8e70 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 76.223.9.105 (United States)

ASN16509 (AMAZON-02, US)
PTR: ac3ff6aafb2cddae2.awsglobalaccelerator.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.16.137.15 (None, )

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.136.15 (None, )

ASN13335 (CLOUDFLARENET, US)

ws-assets.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:225e:7400:f:7ae2:7780:93a1 (United States)

ASN16509 (AMAZON-02, US)

logrhythm.widget.insent.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:225e:4000:f:7ae2:7780:93a1 (United States)

ASN16509 (AMAZON-02, US)

logrhythm.widget.insent.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.35.58.60 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-58-60.fra60.r.cloudfront.net

cdn.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
67	logrhythm.com 1 redirects logrhythm.com — Cisco Umbrella Rank: 217004 ecrm.logrhythm.com	2 MB
36	pathfactory.com cdn-app.pathfactory.com — Cisco Umbrella Rank: 41369 jukebox.pathfactory.com — Cisco Umbrella Rank: 35792 spcollector.pathfactory.com — Cisco Umbrella Rank: 43886 cdn.pathfactory.com — Cisco Umbrella Rank: 156340	340 KB
12	6sc.co j.6sc.co — Cisco Umbrella Rank: 5872 c.6sc.co — Cisco Umbrella Rank: 9222 ipv6.6sc.co — Cisco Umbrella Rank: 5999 b.6sc.co — Cisco Umbrella Rank: 3952	27 KB
10	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 1784 ka-p.fontawesome.com — Cisco Umbrella Rank: 3182	221 KB
7	typekit.net use.typekit.net — Cisco Umbrella Rank: 474 p.typekit.net — Cisco Umbrella Rank: 567	61 KB
5	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 4737 ws-assets.zoominfo.com — Cisco Umbrella Rank: 11915	29 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 43	435 KB
4	linkedin.com 2 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 320 px4.ads.linkedin.com — Cisco Umbrella Rank: 6476	2 KB
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 7030	3 KB
3	trustarc.com consent.trustarc.com — Cisco Umbrella Rank: 3150	24 KB
2	insent.ai logrhythm.widget.insent.ai	23 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 9066	1 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 176	73 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3780	6 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 780 script.hotjar.com — Cisco Umbrella Rank: 1035	59 KB
2	google.com region1.analytics.google.com — Cisco Umbrella Rank: 3274	298 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 99	274 B
1	mktoresp.com 050-uwt-888.mktoresp.com	318 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 811	17 KB
1	google.fr www.google.fr — Cisco Umbrella Rank: 20719	63 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 96	253 B
1	disqus.com logrhythm-com.disqus.com	2 KB
1	vidyard.com play.vidyard.com — Cisco Umbrella Rank: 7393	23 KB
168	23

	Domain	Requested by
66	logrhythm.com	1 redirects logrhythm.com
15	cdn-app.pathfactory.com	logrhythm.com cdn-app.pathfactory.com
10	jukebox.pathfactory.com	cdn-app.pathfactory.com
9	spcollector.pathfactory.com	cdn-app.pathfactory.com
8	b.6sc.co
8	ka-p.fontawesome.com	kit.fontawesome.com logrhythm.com
6	use.typekit.net	logrhythm.com use.typekit.net
5	www.googletagmanager.com	logrhythm.com www.googletagmanager.com
4	ws.zoominfo.com	js.zi-scripts.com ws-assets.zoominfo.com
3	px.ads.linkedin.com	2 redirects snap.licdn.com
3	js.zi-scripts.com	logrhythm.com js.zi-scripts.com
3	consent.trustarc.com	logrhythm.com
2	cdn.pathfactory.com
2	logrhythm.widget.insent.ai	js.zi-scripts.com logrhythm.widget.insent.ai
2	epsilon.6sense.com	j.6sc.co
2	connect.facebook.net	logrhythm.com connect.facebook.net
2	munchkin.marketo.net	logrhythm.com munchkin.marketo.net
2	j.6sc.co	www.googletagmanager.com j.6sc.co
2	region1.analytics.google.com	www.googletagmanager.com
2	kit.fontawesome.com	logrhythm.com kit.fontawesome.com
1	ws-assets.zoominfo.com	js.zi-scripts.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	www.facebook.com
1	050-uwt-888.mktoresp.com	munchkin.marketo.net
1	script.hotjar.com	static.hotjar.com
1	px4.ads.linkedin.com
1	snap.licdn.com	www.googletagmanager.com
1	static.hotjar.com	www.googletagmanager.com
1	www.google.fr	logrhythm.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	logrhythm-com.disqus.com	logrhythm.com
1	p.typekit.net	use.typekit.net
1	ecrm.logrhythm.com	logrhythm.com
1	play.vidyard.com	logrhythm.com
168	35

This site contains links to these domains. Also see Links.

Domain
portal.logrhythm.com
community.logrhythm.com
explore.logrhythm.com
support.logrhythm.com
docs.logrhythm.com
www.g2.com
www.linkedin.com
twitter.com
www.facebook.com
www.youtube.com

Subject Issuer	Validity	Valid
logrhythm.com Cloudflare Inc ECC CA-3	`2023-06-15` - `2024-06-13`	a year	crt.sh
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-01` - `2025-03-03`	a year	crt.sh
*.fontawesome.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-04` - `2025-01-03`	a year	crt.sh
*.vidyard.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-04-03` - `2025-05-05`	a year	crt.sh
ecrm.logrhythm.com Cloudflare Inc ECC CA-3	`2023-05-31` - `2024-05-29`	a year	crt.sh
*.trustarc.com Amazon RSA 2048 M02	`2024-03-16` - `2025-04-14`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.disqus.com Sectigo RSA Domain Validation Secure Server CA	`2023-04-13` - `2024-04-20`	a year	crt.sh
*.pathfactory.com Amazon RSA 2048 M02	`2023-06-11` - `2024-07-09`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.google.fr GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
6sc.co R3	`2024-01-29` - `2024-04-28`	3 months	crt.sh
*.hotjar.com Amazon ECDSA 256 M03	`2024-02-07` - `2025-03-08`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-08` - `2024-12-11`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-01-12` - `2024-04-11`	3 months	crt.sh
zi-scripts.com GTS CA 1P5	`2024-03-29` - `2024-06-27`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-07` - `2024-10-07`	a year	crt.sh
*.6sense.com Amazon RSA 2048 M03	`2024-03-31` - `2025-04-29`	a year	crt.sh
zoominfo.com E1	`2024-03-22` - `2024-06-20`	3 months	crt.sh
*.widget.insent.ai Amazon RSA 2048 M03	`2024-01-30` - `2025-02-27`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
Frame ID: C998BB56A09BBE16F97B0C90969402EB
Requests: 169 HTTP requests in this frame

Frame: https://logrhythm.widget.insent.ai/?project_key=eCHZJAVbbvK7Q39sF6oo&blog_url=logrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&event_listener=BgQE8UTpKViJruK&marketo_cookies=[%22_mch-logrhythm.com-1712242949744-46899%22]&parent_innerwidth=1600&parent_innerheight=1113&widgetVisibility=true&locale=undefined&user_id=5325e63a5c5f9d241f3a1712242950&_zitok=5325e63a5c5f9d241f3a1712242950
Frame ID: 8130CF2B14FF5092F7498B3793249A15
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Page not found | LogRhythm

Page URL History Show full URLs

https://logrhythm.com/blog/deep-dive-into-plugx-malware/' HTTP 301
https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Elementor (Landing Page Builders) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*href=(?:"|')[^"']*elementor/assets
<link [^>]*href=(?:"|')[^"']*uploads/elementor/css

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

TrustArc (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

consent\.trustarc\.com

Typekit (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*href="[^"]+use\.typekit\.(?:net|com)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

168
Requests

99 %
HTTPS

38 %
IPv6

23
Domains

35
Subdomains

33
IPs

4
Countries

3516 kB
Transfer

8609 kB
Size

22
Cookies

24 Outgoing links

These are links going to different origins than the main page.

URL: https://portal.logrhythm.com/
Title: Customer Portal

Search URL Search Domain Scan URL

URL: https://community.logrhythm.com/
Title: LogRhythm Community

Search URL Search Domain Scan URL

URL: https://explore.logrhythm.com/l/resources-analyst-reports?utm_source=logrhythm-website&utm_content=nav-menu&utm_medium=pathfactory
Title: Analyst Reports

Search URL Search Domain Scan URL

URL: https://explore.logrhythm.com/l/resources-demos?utm_source=logrhythm-website&utm_content=nav-menu&utm_medium=pathfactory
Title: Product Demos

Search URL Search Domain Scan URL

URL: https://explore.logrhythm.com/l/resources-ebooks-whitepapers?utm_source=logrhythm-website&utm_content=nav-menu&utm_medium=pathfactory
Title: White Papers & e-Books

Search URL Search Domain Scan URL

URL: https://explore.logrhythm.com/l/resources-threat-research?utm_source=logrhythm-website&utm_content=nav-menu&utm_medium=pathfactory
Title: Threat Research

Search URL Search Domain Scan URL

URL: https://explore.logrhythm.com/featured-content?utm_source=logrhythm-website&utm_content=mainNav
Title: Featured Content

Search URL Search Domain Scan URL

URL: https://explore.logrhythm.com/l/resources
Title: LogRhythm Resource Library

Search URL Search Domain Scan URL

URL: https://explore.logrhythm.com/l/resources-demos?utm_source=logrhythm-website&utm_content=footer
Title: Product Demos

Search URL Search Domain Scan URL

URL: https://explore.logrhythm.com/l/resources-ebooks-whitepapers?utm_source=logrhythm-website&utm_content=footer
Title: White Papers & e-Books

Search URL Search Domain Scan URL

URL: https://explore.logrhythm.com/l/resources-data-sheets?utm_source=logrhythm-website&utm_content=footer
Title: Product Data Sheets

Search URL Search Domain Scan URL

URL: https://explore.logrhythm.com/l/resources-analyst-reports?utm_source=logrhythm-website&utm_content=footer
Title: Analyst Reports

Search URL Search Domain Scan URL

URL: https://explore.logrhythm.com/l/resources-threat-research?utm_source=logrhythm-website&utm_content=footer
Title: Threat Research

Search URL Search Domain Scan URL

URL: https://explore.logrhythm.com/l/resources-infographics?utm_source=logrhythm-website&utm_content=footer
Title: Infographics

Search URL Search Domain Scan URL

URL: https://explore.logrhythm.com/l/resources-brochures?utm_source=logrhythm-website&utm_content=footer
Title: Brochures

Search URL Search Domain Scan URL

URL: https://support.logrhythm.com/
Title: Support

Search URL Search Domain Scan URL

URL: https://docs.logrhythm.com/kbmodules/docs/
Title: Knowledge Base

Search URL Search Domain Scan URL

URL: https://docs.logrhythm.com/
Title: Documentation

Search URL Search Domain Scan URL

URL: https://explore.logrhythm.com/l/resources-joint-solution-briefs?utm_source=logrhythm-website&utm_content=footer
Title: Joint Solution Briefs

Search URL Search Domain Scan URL

URL: https://www.g2.com/products/logrhythm-logrhythm-siem/reviews?utm_source=rewards-badge

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/logrhythm/

Search URL Search Domain Scan URL

URL: https://twitter.com/LogRhythm

Search URL Search Domain Scan URL

URL: https://www.facebook.com/LogRhythmInc/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/LogRhythmInc

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://logrhythm.com/blog/deep-dive-into-plugx-malware/' HTTP 301
https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 114

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4380604&time=1712242949719&li_adsId=e8b7d9b3-984f-4e56-ae7e-553d74f9a805&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&tm=gtmv2 HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4380604&time=1712242949719&li_adsId=e8b7d9b3-984f-4e56-ae7e-553d74f9a805&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&tm=gtmv2&cookiesTest=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4380604&time=1712242949719&li_adsId=e8b7d9b3-984f-4e56-ae7e-553d74f9a805&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&tm=gtmv2&cookiesTest=true&e_ipv6=AQI66VcMl7WFtAAAAY6pogBKkU72cOE3qAGfBwpSfRwGv8_ZE-T7EaLDeO1OEq1VopPTjmU

168 HTTP transactions
15 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

404

Primary Request / Show response
logrhythm.com/blog/deep-dive-into-plugx-malware/'/
Redirect Chain

https://logrhythm.com/blog/deep-dive-into-plugx-malware/'
https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

140 KB
27 KB

595ms
595ms

Document
text/html

141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc33235e59e1fc8b5ae9061ed6b90bf02b917023f552e5638ad0b3f6d2ecece1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: fr-FR,fr;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=600, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 86f22df4f8d1153f-CDG
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 04 Apr 2024 15:02:27 GMT
expires: Wed, 11 Jan 1984 05:00:00 GMT
link: <https://logrhythm.com/wp-json/>; rel="https://api.w.org/"
server: cloudflare
vary: Accept-Encoding Accept-Encoding Accept-Encoding
x-cache: MISS
x-cache-group: normal
x-cacheable: non200
x-tec-api-origin: https://logrhythm.com
x-tec-api-root: https://logrhythm.com/wp-json/tribe/events/v1/
x-tec-api-version: v1

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 86f22df34e8f153f-CDG
content-type: text/html
date: Thu, 04 Apr 2024 15:02:27 GMT
location: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
server: cloudflare

GET
H2 200 kan0mns.css
use.typekit.net/ 10 KB
1 KB 598ms
499ms Stylesheet
text/css 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/kan0mns.css

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

b4316fef0d97341a9bc4b4d20acb7be949930cbfb0d83fe4803b613c7362deac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
date: Thu, 04 Apr 2024 15:02:28 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 1192

GET
H3 200 frontend.css
logrhythm.com/wp-content/plugins/th-widget-pack/header-footer/inc/widgets-css/ 79 KB
13 KB 53ms
52ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/th-widget-pack/header-footer/inc/widgets-css/frontend.css?ver=2.2.6

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0b47c6f613bff41662a4af43e11dd7a291ad7a1fbb2346cbcf6260fc2895c911

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33376
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 13 Sep 2023 17:55:37 GMT
server: cloudflare
etag: W/"6501f799-13c18"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b897f154-CDG

GET
H3 200 icons.css
logrhythm.com/wp-content/plugins/th-widget-pack/assets/icons/ 52 KB
11 KB 61ms
59ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/th-widget-pack/assets/icons/icons.css?ver=2.2.6

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a48d01207db36011a52ba50f8fdbef2c589fc97692a7f5c93d182f846dc77164

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33376
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 13 Sep 2023 17:55:37 GMT
server: cloudflare
etag: W/"6501f799-d147"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b898f154-CDG

GET
H3 200 global.css
logrhythm.com/wp-content/plugins/th-widget-pack/css/ 3 KB
4 KB 36ms
33ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/th-widget-pack/css/global.css?ver=1694627737

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

70f3cc852c9c3849b93ab403bff853542df94d4421891b4f50aeacb24f9aeeef

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33376
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 13 Sep 2023 17:55:37 GMT
server: cloudflare
etag: W/"6501f799-a3f"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b89df154-CDG

GET
H3 200 header-footer-elementor.css
logrhythm.com/wp-content/plugins/th-widget-pack/header-footer/assets/css/ 1 KB
4 KB 74ms
71ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/th-widget-pack/header-footer/assets/css/header-footer-elementor.css?ver=2.2.6

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b37ebd2524191bf943476446276026a92083fe5bc43571eec11855c3872bd1af

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33376
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 13 Sep 2023 17:55:37 GMT
server: cloudflare
etag: W/"6501f799-4c6"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b89ff154-CDG

GET
H3 200 elementor-icons.min.css
logrhythm.com/wp-content/plugins/elementor/assets/lib/eicons/css/ 19 KB
8 KB 75ms
73ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=5.29.0

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

67ac597bed179b5842d996fad80472c6b9514edde408ade8b892161bcf9e9c88

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33376
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 26 Mar 2024 19:31:14 GMT
server: cloudflare
etag: W/"66032282-4d42"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b8a2f154-CDG

GET
H3 200 frontend.min.css
logrhythm.com/wp-content/plugins/elementor/assets/css/ 169 KB
24 KB 79ms
76ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.20.3

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c7a9c0438ba5908e5c3186077746f896f7a8c294d2dbee9bf8f3273c6073289

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 43867
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 26 Mar 2024 19:31:14 GMT
server: cloudflare
etag: W/"66032282-2a432"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b8a3f154-CDG

GET
H3 200 swiper.min.css
logrhythm.com/wp-content/plugins/elementor/assets/lib/swiper/v8/css/ 16 KB
8 KB 96ms
93ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/elementor/assets/lib/swiper/v8/css/swiper.min.css?ver=8.4.5

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c57e64fcb72bddafa9c38de574441c3e69ac6c961df96b0cad34da83658bd196

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33376
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 26 Mar 2024 19:31:14 GMT
server: cloudflare
etag: W/"66032282-4057"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b8a5f154-CDG

GET
H3 200 post-6608.css
logrhythm.com/wp-content/uploads/elementor/css/ 3 KB
5 KB 110ms
107ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/uploads/elementor/css/post-6608.css?ver=1711655367

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0511e3b9b89c685aa01a48d5fbed7a2090fee19eff9a2f9dd6e83346c2a942a0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 43867
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Thu, 28 Mar 2024 19:49:27 GMT
server: cloudflare
etag: W/"6605c9c7-da9"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b8a6f154-CDG

GET
H3 200 frontend.min.css
logrhythm.com/wp-content/plugins/elementor-pro/assets/css/ 445 KB
48 KB 111ms
109ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=3.20.2

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8f3778819f0379ff33a687f9ae7dab7cbdf28739873126bfb981d4d682a09a92

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 43867
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 26 Mar 2024 19:31:16 GMT
server: cloudflare
etag: W/"66032284-6f470"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b8a8f154-CDG

GET
H3 200 app.css
logrhythm.com/wp-content/themes/stratusx/assets/css/ 286 KB
51 KB 39ms
36ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/themes/stratusx/assets/css/app.css?ver=1

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae77448c16c7a363aa7d7d319222a31c749733042e39c0f5176b1cce3ac03e0f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33375
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Mon, 19 Feb 2024 23:33:24 GMT
server: cloudflare
etag: W/"65d3e544-47849"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b8a9f154-CDG

GET
H3 200 style.css
logrhythm.com/wp-content/themes/logrhythm-child/ 347 B
4 KB 179ms
176ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/themes/logrhythm-child/style.css?ver=6.5

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b1b33627d7bddf9d93dcf1e913bb6e53d97a99c5a7fc30f9aab824bf74707b35

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 43867
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Sun, 29 Mar 2020 18:29:03 GMT
server: cloudflare
etag: W/"5e80e8ef-15b"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b8abf154-CDG

GET
H3 200 app.min.css
logrhythm.com/wp-content/themes/logrhythm-child/dist/css/ 163 KB
25 KB 328ms
326ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/themes/logrhythm-child/dist/css/app.min.css?v=042023

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9a0efa3ca63814f5db50b2c51b71425660a062236f53af3c2f5c6eb820fffdd3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33375
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 02 Apr 2024 21:59:38 GMT
server: cloudflare
etag: W/"660c7fca-28d5f"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b8acf154-CDG

GET
H3 200 post-86515.css
logrhythm.com/wp-content/uploads/elementor/css/ 9 KB
5 KB 522ms
520ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/uploads/elementor/css/post-86515.css?ver=1711656283

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

092178659031117c2562f8ada3b553117505d2023a586c2a4ccda173e79ce2fe

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Thu, 28 Mar 2024 20:04:43 GMT
server: cloudflare
etag: W/"6605cd5b-2404"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b8adf154-CDG

GET
H3 200 jquery.min.js Show response
logrhythm.com/wp-includes/js/jquery/ 86 KB
34 KB 347ms
344ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33375
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Mon, 28 Aug 2023 17:14:23 GMT
server: cloudflare
etag: W/"64ecd5ef-15601"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b8aef154-CDG

GET
H3 200 jquery-migrate.min.js Show response
logrhythm.com/wp-includes/js/jquery/ 13 KB
9 KB 369ms
366ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33375
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Fri, 09 Jun 2023 05:49:24 GMT
server: cloudflare
etag: W/"6482bd64-3509"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b8aff154-CDG

GET
H2 200 2f1bae2942.js Show response
kit.fontawesome.com/ 12 KB
5 KB 575ms
469ms Script
text/javascript 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kit.fontawesome.com/2f1bae2942.js
Requested by: Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 32aff668ae2ddb3f574c99a4226616fc300ba48b3242c6caf150c897a1067c9b

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
content-encoding: gzip
cf-cache-status: EXPIRED
server: cloudflare
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-max-age: 3000
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
content-type: text/javascript
cache-control: max-age=60, public, stale-while-revalidate=30
cf-ray: 86f22dfdbd92f188-CDG
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id: F8Mb4_BsBHUKk-1Qw40B

GET
H2 200 v4.js Show response
play.vidyard.com/embed/ 70 KB
23 KB 123ms
17ms Script
application/javascript 151.101.65.181
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://play.vidyard.com/embed/v4.js

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.181 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e492e5bd630a86a679a9ead911fc5e1e155d75098344c375131c40470e97396d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1
date: Thu, 04 Apr 2024 15:02:28 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31557600
age: 5
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 23031
x-served-by: cache-lcy-eglc8600047-LCY
x-china: 0
last-modified: Mon, 28 Aug 2023 17:07:01 GMT
etag: "d22850d6ed493dad3ff1a51479d730cc"
vary: X-China, accept-language, Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 forms2.min.js Show response
ecrm.logrhythm.com/js/forms2/js/ 199 KB
67 KB 159ms
41ms Script
application/x-javascript 104.17.71.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ecrm.logrhythm.com/js/forms2/js/forms2.min.js

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b9649e0e9e5790f8d6b5e69aa4ff9969e8f7d72a84f8501ff9379078005124d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 05 Mar 2024 19:24:48 GMT
server: cloudflare
age: 6897
etag: "301782-31af8-612eecb9f6000"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 86f22df97f053d10-CDG
expires: Thu, 04 Apr 2024 19:02:28 GMT

GET
H3 200 modernizr-custom.min.js Show response
logrhythm.com/wp-content/themes/logrhythm-child/dist/js/ 5 KB
6 KB 369ms
367ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/themes/logrhythm-child/dist/js/modernizr-custom.min.js

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c99f726f2a86c98e77f5f081280ff5e78252dbc6d6576828e5fde6c62a3051ed

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33375
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 01 Dec 2020 20:51:16 GMT
server: cloudflare
etag: W/"5fc6acc4-12ac"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b8b0f154-CDG

GET
H2 200 notice Show response
consent.trustarc.com/ 63 KB
16 KB 216ms
111ms Script
text/javascript 13.225.78.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/notice?domain=logrhythm.com&c=teconsent&js=nj&noticeType=bb&text=true&gtm=1

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.57 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-57.fra2.r.cloudfront.net

Software

Resource Hash

24f49003f27bd9468f359e8a1c42d9583f5444aa6695589d055ace9fe2898290

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-encoding: gzip
via: 1.1 56fad5a50ef67bd961b9722ed0931838.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA2-C2
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: max-age=3600
x-amz-cf-id: Wpu1_9fIHL1ZMk2yhrVx7BbSBamPovkoT5BG-nnaRK-sR7MVdh0WdA==

GET
H2 200 core.min.js Show response
consent.trustarc.com/autoblockasset/ 18 KB
6 KB 145ms
85ms Script
text/javascript 13.225.78.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/autoblockasset/core.min.js?domain=logrhythm.com

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.57 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-57.fra2.r.cloudfront.net

Software

Resource Hash

3669e4e19966fceb84125c59bf2307cb0aeb70322eff9d99b60221f9f2061366

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: public
date: Thu, 04 Apr 2024 15:02:28 GMT
content-encoding: gzip
via: 1.1 edfd22ec6695cdc9d7ac634220af1314.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Wed, 29 Nov 2023 03:02:54 GMT
x-amz-cf-pop: FRA2-C2
vary: Accept-Encoding, Origin
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: max-age=3600
x-amz-cf-id: l_uUSriOE9Xym4hJqm95S5DKXYhBaCDzUcWTrOKQpw3I09JwKPBNxg==

GET
H2 200 autoblockoptout Show response
consent.trustarc.com/ 4 KB
2 KB 129ms
69ms Script
text/javascript 13.225.78.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/autoblockoptout?domain=logrhythm.com

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.57 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-57.fra2.r.cloudfront.net

Software

Resource Hash

f149ef6a160ed59e62813d87501de1afdc95f2b545bce8ba5431eeca219190e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-encoding: gzip
via: 1.1 edfd22ec6695cdc9d7ac634220af1314.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA2-C2
vary: Accept-Encoding, Origin
x-cache: Miss from cloudfront
content-type: text/javascript; charset=UTF-8
cache-control: max-age=3600
x-amz-cf-id: C_c-RXREPFlXn_KfJKoKbxYelKs-YWKsD-1XfJhYmncemFsO4bXD8Q==

GET
H3 200 logrhythm-logo-white.svg
logrhythm.com/wp-content/themes/logrhythm-child/dist/img/ 4 KB
6 KB 143ms
133ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/themes/logrhythm-child/dist/img/logrhythm-logo-white.svg

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

81acd87c922461dd8b07a53c907dc098d67358f212a52de422d7ee74680fd36a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33375
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Fri, 14 Apr 2023 22:38:47 GMT
server: cloudflare
etag: W/"6439d5f7-f98"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd1d95f154-CDG

GET
H3 200 nasa.svg
logrhythm.com/wp-content/uploads/2020/02/ 14 KB
7 KB 149ms
139ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2020/02/nasa.svg

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

10599ffc37dd3ff57db5d5a984854c3beecfdbd271e8fa1d7321127e84d93edb

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 31523
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Sun, 29 Mar 2020 18:29:00 GMT
server: cloudflare
etag: W/"5e80e8ec-390d"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd1d99f154-CDG

GET
H3 200 sirius-xm.svg
logrhythm.com/wp-content/uploads/2020/02/ 7 KB
7 KB 370ms
368ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2020/02/sirius-xm.svg

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec7839f109ee0d8025aa46fc9165cfc9ac1e52674c0fc00a675210481c6e90db

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 31523
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Sun, 29 Mar 2020 18:30:01 GMT
server: cloudflare
etag: W/"5e80e929-1c17"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b8b1f154-CDG

GET
H3 200 ucla.svg
logrhythm.com/wp-content/uploads/2020/02/ 6 KB
5 KB 142ms
140ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2020/02/ucla.svg

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ac8941daec8b1c75b6345ab83858bfc13d9c485d4aacdea52ecf759c34c92f6a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 31522
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Sun, 29 Mar 2020 18:29:01 GMT
server: cloudflare
etag: W/"5e80e8ed-18cc"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd1d9bf154-CDG

GET
H3 200 g2-spring23-medal.svg
logrhythm.com/wp-content/uploads/2023/09/ 7 KB
6 KB 385ms
383ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2023/09/g2-spring23-medal.svg

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4dc642fc85c8ca2023e485d6bc9b6e9a74f9e169080830db40c37e87eff8d3a3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:27 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33375
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 13 Sep 2023 17:45:59 GMT
server: cloudflare
etag: W/"6501f557-1cfc"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22df8b8b3f154-CDG

GET
H3 200 g2-users-love-us.svg
logrhythm.com/wp-content/uploads/2023/09/ 4 KB
5 KB 51ms
51ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2023/09/g2-users-love-us.svg

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6971d61d8115453aec57ea622ef3a2b023b53996e7399b0cd899cd830191e3a5

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33376
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 13 Sep 2023 17:43:49 GMT
server: cloudflare
etag: W/"6501f4d5-115e"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfb1af7f154-CDG

GET
H3 200 email-decode.min.js Show response
logrhythm.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
835 B 21ms
20ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 03 Apr 2024 10:34:35 GMT
server: cloudflare
etag: W/"660d30bb-4d7"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 86f22dfb2b11f154-CDG
expires: Sat, 06 Apr 2024 15:02:28 GMT

GET
H3 200 waypoints.min.js Show response
logrhythm.com/wp-content/plugins/elementor/assets/lib/waypoints/ 12 KB
7 KB 44ms
43ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

214674cc77aba35ab3567b88e2739fd08e8e96c61d279559ad61874069683ea0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33375
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 26 Mar 2024 19:31:14 GMT
server: cloudflare
etag: W/"66032282-2fa6"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfb5b34f154-CDG

GET
H3 200 frontend.js Show response
logrhythm.com/wp-content/plugins/th-widget-pack/header-footer/inc/js/ 25 KB
7 KB 42ms
42ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/th-widget-pack/header-footer/inc/js/frontend.js?ver=2.2.6

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e92fb6dc00e3c04e1f9af5a1554a33e2b3f2b1d7f9a9266066863a932437f0b9

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33375
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 13 Sep 2023 17:55:37 GMT
server: cloudflare
etag: W/"6501f799-6384"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfb6b54f154-CDG

GET
H3 200 comment_count.js Show response
logrhythm.com/wp-content/plugins/disqus-comment-system/public/js/ 889 B
4 KB 47ms
46ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.1.1

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 43868
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 03 Apr 2024 15:24:56 GMT
server: cloudflare
etag: W/"660d74c8-379"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfb9b94f154-CDG

GET
H3 200 main.js Show response
logrhythm.com/wp-content/themes/stratusx/assets/js/ 10 KB
7 KB 52ms
52ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/themes/stratusx/assets/js/main.js?ver=1.3

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

1120606d70171f70f1c92b702798a10dedacf4e5a3efd3b7cb7a649f524b50d2

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33375
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Mon, 19 Feb 2024 23:33:24 GMT
server: cloudflare
etag: W/"65d3e544-2798"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfbbbeff154-CDG

GET
H3 200 app.min.js Show response
logrhythm.com/wp-content/themes/logrhythm-child/dist/js/ 96 KB
38 KB 147ms
144ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/themes/logrhythm-child/dist/js/app.min.js?ver=1

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

11c7cade4c0b009392f70528471d8df3f30fa91e779bee8560e0bdf444e85f11

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33373
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 13 Feb 2024 23:57:38 GMT
server: cloudflare
etag: W/"65cc01f2-181a0"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd1d9cf154-CDG

GET
H3 200 marketo-prefill.min.js Show response
logrhythm.com/wp-content/themes/logrhythm-child/dist/js/ 3 KB
4 KB 43ms
43ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/themes/logrhythm-child/dist/js/marketo-prefill.min.js?ver=6.5

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9234cd0a490631fdad33bc295edc8b3c0ed8860173eb84f6264c826a4d8c7a70

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 43868
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Fri, 13 Jan 2023 01:47:20 GMT
server: cloudflare
etag: W/"63c0b828-b32"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfbec2bf154-CDG

GET
H3 200 themo-foot.js Show response
logrhythm.com/wp-content/plugins/th-widget-pack/js/ 11 KB
7 KB 34ms
33ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/th-widget-pack/js/themo-foot.js?ver=2.2.6

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

be557052880037a1c160050458fc687e95a193799d58686f0e2eefc8b39f4f42

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33375
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 13 Sep 2023 17:55:37 GMT
server: cloudflare
etag: W/"6501f799-2b02"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfc0c5af154-CDG

GET
H3 200 vendor_footer.js Show response
logrhythm.com/wp-content/themes/stratusx/assets/js/vendor/ 117 KB
36 KB 39ms
39ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/themes/stratusx/assets/js/vendor/vendor_footer.js?ver=1.2

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

eaff775ad40803675c3df967fd79d70cfe3cca7b691c0c7a5e03bfdc0b2850ff

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33375
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Mon, 19 Feb 2024 23:33:24 GMT
server: cloudflare
etag: W/"65d3e544-1d211"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfc3c8bf154-CDG

GET
H3 200 lottie.min.js Show response
logrhythm.com/wp-content/plugins/elementor-pro/assets/lib/lottie/ 247 KB
67 KB 591ms
591ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/elementor-pro/assets/lib/lottie/lottie.min.js?ver=5.6.6

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0eceb9be92f0ec6a1b69ebafa0bdb6bd72506565259ca6c4574185e7336d0f04

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 26 Mar 2024 19:31:16 GMT
server: cloudflare
etag: W/"66032284-3daac"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfc4c9ff154-CDG

GET
H3 200 webpack-pro.runtime.min.js Show response
logrhythm.com/wp-content/plugins/elementor-pro/assets/js/ 6 KB
6 KB 36ms
35ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.20.2

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

316a940e4c553c8e577e39b1407f182c4357ffd2302d417205830eb8771c1ea5

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33374
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 26 Mar 2024 19:31:16 GMT
server: cloudflare
etag: W/"66032284-16c1"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfc9d07f154-CDG

GET
H3 200 webpack.runtime.min.js Show response
logrhythm.com/wp-content/plugins/elementor/assets/js/ 5 KB
6 KB 55ms
54ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.20.3

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

54332f1e6cf0aa349c504422f066ea1c1ee5d3152ebc96944cdafe72961dcd0d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33375
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 26 Mar 2024 19:31:14 GMT
server: cloudflare
etag: W/"66032282-1385"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd0d6ef154-CDG

GET
H3 200 frontend-modules.min.js Show response
logrhythm.com/wp-content/plugins/elementor/assets/js/ 59 KB
21 KB 90ms
88ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.20.3

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a87fcabee27652552d5eb2fc3cb61d2fa44408ea6ad7033598775f591236c290

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33374
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 26 Mar 2024 19:31:14 GMT
server: cloudflare
etag: W/"66032282-eb08"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd0d72f154-CDG

GET
H3 200 wp-polyfill-inert.min.js Show response
logrhythm.com/wp-includes/js/dist/vendor/ 8 KB
6 KB 100ms
89ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33374
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 18 Jan 2023 11:16:33 GMT
server: cloudflare
etag: W/"63c7d511-1feb"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd1d80f154-CDG

GET
H3 200 regenerator-runtime.min.js Show response
logrhythm.com/wp-includes/js/dist/vendor/ 6 KB
6 KB 101ms
89ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.14.0

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

1d52e1ac7d3bc25a8b0ffc257153f9dd50249f96fe9a4df5e0d771241a69062c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33374
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 19 Sep 2023 19:30:24 GMT
server: cloudflare
etag: W/"6509f6d0-19e1"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd1d85f154-CDG

GET
H3 200 wp-polyfill.min.js Show response
logrhythm.com/wp-includes/js/dist/vendor/ 38 KB
18 KB 103ms
91ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

17b79ece7ef9d1454a90156690d33d64387b67a7a7548fc826012512e287a937

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33374
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 31 Jan 2024 12:59:56 GMT
server: cloudflare
etag: W/"65ba444c-96be"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd1d87f154-CDG

GET
H3 200 hooks.min.js Show response
logrhythm.com/wp-includes/js/dist/ 4 KB
5 KB 72ms
61ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-includes/js/dist/hooks.min.js?ver=2810c76e705dd1a53b18

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2cb546fbdda7995d374fffa4b2f6530bbcf57d014639ddf76de45df43d593045

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 35221
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 31 Jan 2024 12:59:56 GMT
server: cloudflare
etag: W/"65ba444c-10d3"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd1d8bf154-CDG

GET
H3 200 i18n.min.js Show response
logrhythm.com/wp-includes/js/dist/ 9 KB
7 KB 97ms
86ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f313d12ea6124bd28fc4a6b7163d253bb83d5aeab5edce594880c5c3df475cbc

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 35221
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Thu, 15 Feb 2024 16:53:15 GMT
server: cloudflare
etag: W/"65ce417b-23b5"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd1d8df154-CDG

GET
H3 200 frontend.min.js Show response
logrhythm.com/wp-content/plugins/elementor-pro/assets/js/ 24 KB
11 KB 116ms
105ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.20.2

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0127ebe9681ce89b2ce6de5293e1f064c0e6447b803a1cff70e3d447242e68b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33374
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 26 Mar 2024 19:31:16 GMT
server: cloudflare
etag: W/"66032284-61ea"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd1d8ff154-CDG

GET
H3 200 core.min.js Show response
logrhythm.com/wp-includes/js/jquery/ui/ 21 KB
11 KB 95ms
84ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.2

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ca7dce2391845e8aec7da135f33fabd10f74eed28a532ac66fd01f761fcfb42f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33374
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Thu, 02 Feb 2023 16:36:32 GMT
server: cloudflare
etag: W/"63dbe690-53be"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd1d92f154-CDG

GET
H3 200 frontend.min.js Show response
logrhythm.com/wp-content/plugins/elementor/assets/js/ 39 KB
16 KB 118ms
107ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.20.3

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

28abab0e81dceebab466c855e82b8cfc06f9e138ff78fb45ae102a6a36be0e5d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33374
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 26 Mar 2024 19:31:14 GMT
server: cloudflare
etag: W/"66032282-9d72"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd1d93f154-CDG

GET
H3 200 elements-handlers.min.js Show response
logrhythm.com/wp-content/plugins/elementor-pro/assets/js/ 37 KB
13 KB 133ms
123ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.20.2

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

66c5073bb5b13ec03106e31457b230eef5fc1698d24536a61ff5a5f4313269de

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 33374
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 26 Mar 2024 19:31:16 GMT
server: cloudflare
etag: W/"66032284-9567"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd1d94f154-CDG

GET
H2 200 p.css
p.typekit.net/ 5 B
172 B 37ms
29ms Stylesheet
text/css 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p.typekit.net/p.css?s=1&k=kan0mns&ht=tk&f=32226.32227.32228.32230.32231.40407.40408.40409.40410.40411.40412.40413.40415.40416&a=86739004&app=typekit&e=css
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/kan0mns.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://use.typekit.net/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
last-modified: Fri, 23 Jun 2023 17:09:47 GMT
server: nginx
etag: "6495d1db-5"
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 5

GET
H2 200 l
use.typekit.net/af/74b049/00000000000000007735b97f/30/ 12 KB
12 KB 147ms
29ms Font
application/font-woff2 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/74b049/00000000000000007735b97f/30/l?primer=7fa3915bdafdf03041871920a205bef951d72bf64dd4c4460fb992e3ecc3a862&fvd=n4&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/kan0mns.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 3728afa1bf40c8ef2f820860a415da47f6bf118c1ccd856fd96926bc932a612a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://use.typekit.net/kan0mns.css
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
server: nginx
etag: "0725935a0405a101e1f63fb0d88e754d06e3e316"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11992

GET
DATA 200
OK truncated
/ 90 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 345a7f619e726c9ed21fa1e83646623f3491056eb1c9e0f3af797c42d38255c1

Request headers

accept-language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/webp

GET
DATA 200
OK truncated
/ 44 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6

Request headers

accept-language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/webp

GET
DATA 200
OK truncated
/ 38 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 52dc24c0429ea6ccc5b579a6da8bb79bf41e471fe5108a62009f3c2e195551c0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/webp

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 302 KB
97 KB 146ms
49ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-N3MMPPN

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1620e9d6662aef6d6a1ab50e5da925e90496f35bf7ad2d677d9d69024412cab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 99066
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 04 Apr 2024 15:02:28 GMT

GET
DATA 200
OK truncated
/ 82 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7ce23bb169d56e3dc218181172c5d318dc16526e035b539e038f605a893ea551

Request headers

accept-language: fr-FR,fr;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/webp

GET
H/1.1 200
OK count.js Show response
logrhythm-com.disqus.com/ 1 KB
2 KB 113ms
18ms Script
application/javascript 199.232.196.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm-com.disqus.com/count.js

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.1.1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.196.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 04 Apr 2024 15:02:28 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=300; includeSubdomains
X-Amz-Cf-Pop: DFW3-C1
Age: 125
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Wed, 03 Apr 2024 17:27:31 GMT
Server: nginx
ETag: "660d9183-367"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
X-Amz-Cf-Id: XLBTrnsaLiD30cT5x6uNxDc1-rtTP7P-Hwiu3NBdyxPg1w374fP5ow==

GET
H3 200 space-stars-background-1920.jpg
logrhythm.com/wp-content/uploads/2021/07/ 237 KB
241 KB 238ms
238ms Image
image/jpeg 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2021/07/space-stars-background-1920.jpg

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/wp-content/uploads/elementor/css/post-86515.css?ver=1711656283

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e292f4b6d81003d9d2ac3ceb89881936a670f8f595f7dd65d2517e01864c108

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/wp-content/uploads/elementor/css/post-86515.css?ver=1711656283
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 242696
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 28 Jul 2021 21:59:04 GMT
server: cloudflare
etag: "6101d328-3b408"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
accept-ranges: bytes
cf-ray: 86f22dfd2d9df154-CDG

GET
H3 200 background-flatirons-violet-01-1.png
logrhythm.com/wp-content/uploads/2022/02/ 1 KB
5 KB 167ms
167ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2022/02/background-flatirons-violet-01-1.png

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/wp-content/uploads/elementor/css/post-86515.css?ver=1711656283

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

67614828cf3f7a0f61ee5dc0f9a6212d44c8f98e8a9da03327d13beaf3a61fc1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/wp-content/uploads/elementor/css/post-86515.css?ver=1711656283
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
cf-cache-status: HIT
age: 22348
cf-polished: origFmt=png, origSize=2837
content-disposition: inline; filename="background-flatirons-violet-01-1.webp"
alt-svc: h3=":443"; ma=86400
content-length: 1444
x-xss-protection: 1; mode=block
referrer-policy: same-origin
cf-bgj: imgq:100,h2pri
last-modified: Thu, 10 Feb 2022 23:33:51 GMT
server: cloudflare
etag: "6205a0df-b15"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
accept-ranges: bytes
cf-ray: 86f22dfd2da9f154-CDG

GET
H2 200 l
use.typekit.net/af/dde969/00000000000000007735b995/30/ 12 KB
12 KB 121ms
37ms Font
application/font-woff2 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/dde969/00000000000000007735b995/30/l?primer=7fa3915bdafdf03041871920a205bef951d72bf64dd4c4460fb992e3ecc3a862&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/kan0mns.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: b060b43ee8aa1a1a7d17f98215f3d920d4b8b48f1af0fdc392119b11de47b36e

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://use.typekit.net/kan0mns.css
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
server: nginx
etag: "4499a6228bad8b85e09d5232a2e94be820faa664"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11864

GET
H2 200 l
use.typekit.net/af/1fe1ce/00000000000000007735aff6/30/ 12 KB
12 KB 125ms
41ms Font
application/font-woff2 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/1fe1ce/00000000000000007735aff6/30/l?primer=c279b7655ef133eefcdc8a0e82ce6967fcf4be86c88c3d3423b05eb1816318b7&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/kan0mns.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 3cc3108c864da12cea8db6a598d888e8073e1add0c16d6bf6208813ca4487344

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://use.typekit.net/kan0mns.css
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
server: nginx
etag: "60544d9a92264c5bbf8c0bfe6da06aa456428460"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11892

GET
H2 200 l
use.typekit.net/af/e5635b/00000000000000007735b98f/30/ 12 KB
12 KB 116ms
33ms Font
application/font-woff2 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/e5635b/00000000000000007735b98f/30/l?primer=7fa3915bdafdf03041871920a205bef951d72bf64dd4c4460fb992e3ecc3a862&fvd=n6&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/kan0mns.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 371ac7364bb3c4027bb2b61fce7cfb60811d7828ca37a6b2edb4690a6e29db6e

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://use.typekit.net/kan0mns.css
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
server: nginx
etag: "6116b968f12f9c800b8376a9abc20cd932577e0a"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11992

GET
H2 200 l
use.typekit.net/af/34c58e/00000000000000007735b983/30/ 12 KB
12 KB 106ms
35ms Font
application/font-woff2 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/34c58e/00000000000000007735b983/30/l?primer=7fa3915bdafdf03041871920a205bef951d72bf64dd4c4460fb992e3ecc3a862&fvd=i4&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/kan0mns.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: e0688ce88275ad7c4f3035ceae4033f11020cae4c218d0396ccd1be3d503a2bc

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://use.typekit.net/kan0mns.css
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
server: nginx
etag: "83f6a95b08faa058c1be7387d942a37f52c267cc"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 12392

GET
H3 200 temple-university-logo-compressed.svg
logrhythm.com/wp-content/uploads/2021/05/ 4 KB
5 KB 121ms
116ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2021/05/temple-university-logo-compressed.svg

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe04371e99bc3a1cd9669a16fc95bdff81ded468cd7e14dad38669817130c27b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 31522
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Fri, 28 May 2021 20:15:28 GMT
server: cloudflare
etag: W/"60b14f60-f7e"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd8e11f154-CDG

GET
H3 200 bakertilly-logo.svg
logrhythm.com/wp-content/uploads/2021/08/ 5 KB
6 KB 122ms
117ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2021/08/bakertilly-logo.svg

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

726cdb991294913fa2541fe5fa763a8725c3cb3f5c878b56da38559fbfb9bc92

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 31522
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 11 Aug 2021 18:22:06 GMT
server: cloudflare
etag: W/"6114154e-1331"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd8e13f154-CDG

GET
H3 200 chart-industries-logo.svg
logrhythm.com/wp-content/uploads/2021/08/ 7 KB
6 KB 123ms
118ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2021/08/chart-industries-logo.svg

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e51490bf098d4ab164444efab69b0019350238365b18ce3328701837d258f1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 31522
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 11 Aug 2021 18:49:50 GMT
server: cloudflare
etag: W/"61141bce-1a0a"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd8e16f154-CDG

GET
H3 200 us-air-force.svg
logrhythm.com/wp-content/uploads/2022/02/ 5 KB
5 KB 149ms
145ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2022/02/us-air-force.svg

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

842b5d6ed9e5e4ac166eb55615b55da7366a235b19af87375f70c74afabd769a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 31522
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 09 Feb 2022 19:58:44 GMT
server: cloudflare
etag: W/"62041cf4-14f0"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd8e17f154-CDG

GET
H3 200 cdon-logo.svg
logrhythm.com/wp-content/uploads/2022/02/ 2 KB
4 KB 150ms
147ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2022/02/cdon-logo.svg

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2df44dc69064c7fa71246e486d2a28877def46caa33ada1a981a8abd7686d072

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 31522
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Fri, 11 Feb 2022 03:59:54 GMT
server: cloudflare
etag: W/"6205df3a-6b3"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd8e19f154-CDG

GET
H3 200 Bilstein-logo.svg
logrhythm.com/wp-content/uploads/2022/10/ 3 KB
5 KB 151ms
148ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2022/10/Bilstein-logo.svg

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a7951d76e2e255a3c209df151a549124e93fa2a0119c458cb3ff478bf8c77c8d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 31522
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Fri, 21 Oct 2022 18:19:02 GMT
server: cloudflare
etag: W/"6352e296-b3c"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd8e1af154-CDG

GET
H3 200 KIA-customer-logo.svg
logrhythm.com/wp-content/uploads/2023/02/ 1 KB
4 KB 152ms
150ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2023/02/KIA-customer-logo.svg

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

df55df709530226ae937083e9a5d37721597e1486ba032da9c8a769bdd277f31

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 31522
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Thu, 16 Feb 2023 21:05:01 GMT
server: cloudflare
etag: W/"63ee9a7d-51b"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd8e1bf154-CDG

GET
H3 200 bloomin-brands-customer-logo.svg
logrhythm.com/wp-content/uploads/2023/02/ 14 KB
8 KB 156ms
154ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2023/02/bloomin-brands-customer-logo.svg

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9c8535a1c5d37f5645aa956bd6a8ca9114c57fdfcdbc60dbebf6c969430aaffc

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 31521
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Thu, 16 Feb 2023 21:08:56 GMT
server: cloudflare
etag: W/"63ee9b68-39ff"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfd8e1cf154-CDG

GET
H3 200 ADCS-customer-logo.svg
logrhythm.com/wp-content/uploads/2023/02/ 22 KB
20 KB 183ms
159ms Image
image/svg+xml 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2023/02/ADCS-customer-logo.svg

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c3c7a8ded7af0a5f0a5d96af811f343396391197f6986269715c5dd0360974b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 31521
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Thu, 16 Feb 2023 21:17:41 GMT
server: cloudflare
etag: W/"63ee9d75-58ca"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22dfdae2bf154-CDG

GET
H3 200 LR_ui_dashboard_monitor1-1-1-768x768.png
logrhythm.com/wp-content/uploads/2022/02/ 62 KB
66 KB 415ms
391ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2022/02/LR_ui_dashboard_monitor1-1-1-768x768.png

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5da9e14a57fbd8266e373008d5a9362c47a19eb62a85a01a37458d81a94146c1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
cf-cache-status: HIT
age: 29943
cf-polished: origFmt=png, origSize=70258
content-disposition: inline; filename="LR_ui_dashboard_monitor1-1-1-768x768.webp"
alt-svc: h3=":443"; ma=86400
content-length: 63836
x-xss-protection: 1; mode=block
referrer-policy: same-origin
cf-bgj: imgq:100,h2pri
last-modified: Thu, 10 Feb 2022 23:34:16 GMT
server: cloudflare
etag: "6205a0f8-11272"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
accept-ranges: bytes
cf-ray: 86f22dfdae2cf154-CDG

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 290 KB
97 KB 60ms
60ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-1FE13FG8WE&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N3MMPPN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

20a8c186d91ae6cd8884f222715a646e9036cb5d5d9f8dffaad46b9ab8bb2357

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 99000
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 04 Apr 2024 15:02:28 GMT

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 219 KB
79 KB 51ms
51ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-1070386004&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N3MMPPN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

642143132bbcd9265bb1ac9e9d5279a6d8d5d9bba51a6cd6b597be5f9dfc1272

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 80349
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 04 Apr 2024 15:02:28 GMT

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 247 KB
85 KB 42ms
41ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-11056677273&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N3MMPPN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9d48642a7d382750c6727fe5bbe28824820be9cf4e578c3aa77a1a12f62a0db5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 87227
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 04 Apr 2024 15:02:28 GMT

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 215 KB
78 KB 170ms
170ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-903108792&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N3MMPPN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3d205f7b2d00ed61623313b550488d6828cd20d7d02b5fcd212c462f649e1ba7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 79289
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 04 Apr 2024 15:02:28 GMT

GET
H2 200 jukebox.js Show response
cdn-app.pathfactory.com/production/jukebox-lite/current/ 57 KB
18 KB 166ms
95ms Script
application/javascript 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/jukebox.js
Requested by: Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3958bbc7553eabc186e70362b1811202089f82ef0745060e41eeb654baaea865

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront)
date: Thu, 04 Apr 2024 04:24:27 GMT
last-modified: Wed, 13 Mar 2024 00:54:34 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 38287
x-amz-server-side-encryption: AES256
etag: W/"f04d754d23ce5ee29861200b4b9300b7"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: Dx6MbSzlRXA3EIhT-RSJmxEfqQfWyJbwr404IO9Aww1yVLf6pK9ODg==

GET
H2 200 677.js Show response
cdn-app.pathfactory.com/production/jukebox-lite/current/ 7 KB
3 KB 22ms
22ms Script
application/javascript 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/677.js
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/jukebox.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ddb559b74d08fe2efe619713d282a87961d05fc64e12a477935a480c2382a90c

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront)
date: Thu, 04 Apr 2024 03:04:30 GMT
last-modified: Wed, 13 Mar 2024 00:54:34 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 43080
x-amz-server-side-encryption: AES256
etag: W/"b0bb7be0faf92fdc14000d1af326176a"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: Egc0AilFwoZZKQoOTyEXpJlCwNykZuosjWQZ9f90pa9jD8rQD3XjIg==

POST
H2 204 collect
region1.analytics.google.com/g/ 0
253 B 73ms
29ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-1FE13FG8WE&gtm=45je4410v867738930z8830930082za200&_p=1712242948635&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1949584526.1712242949&ul=en-us&sr=800x600&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.105%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.105&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1712242949&sct=1&seg=0&dl=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&dt=Page%20not%20found%20%7C%20LogRhythm&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=2176
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-1FE13FG8WE&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 04 Apr 2024 15:02:29 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://logrhythm.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
253 B 81ms
27ms Ping
text/plain 2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-1FE13FG8WE&cid=1949584526.1712242949&gtm=45je4410v867738930z8830930082za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-1FE13FG8WE&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 04 Apr 2024 15:02:29 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://logrhythm.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.fr/ads/ 42 B
63 B 108ms
53ms Image
image/gif 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.fr/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-1FE13FG8WE&cid=1949584526.1712242949&gtm=45je4410v867738930z8830930082za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&z=1967309480

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 04 Apr 2024 15:02:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 447.js Show response
cdn-app.pathfactory.com/production/jukebox-lite/current/ 476 B
867 B 22ms
22ms Script
application/javascript 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/447.js
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/jukebox.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4efd6ac6efe7860c8db3d414ff2302db7c424675da9d6664631a307ce3d171a7

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: null
date: Thu, 04 Apr 2024 01:30:33 GMT
via: 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront)
last-modified: Wed, 13 Mar 2024 00:54:34 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 48717
x-amz-server-side-encryption: AES256
etag: "99bc8d7aff9625869f9ac3f6fd84c8a7"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 476
x-amz-cf-id: d3XyJ3QVrDuO7l4NDKvd_wTxMigH1qNlVyKlBogkw_5vxMQDeGKdiw==

GET
H2 200 init Show response
jukebox.pathfactory.com/api/public/v1/ 5 KB
3 KB 359ms
172ms XHR
application/json 52.55.132.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/init?clientId=LB-72E778C0-10607&image=&title=&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/jukebox.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.55.132.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-55-132-161.compute-1.amazonaws.com

Software

Resource Hash

cf3b5824bacaaa2d01631580b0efc58f587fa1c4deb5dd9024f85752038e23d6

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://logrhythm.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy
content-encoding: gzip
x-request-id: eb72a411-4400-4f8f-93a8-4a4a23a7dcfb
x-runtime: 0.074263
referrer-policy: no-referrer-when-downgrade
etag: W/"cf3b5824bacaaa2d01631580b0efc58f"
access-control-max-age: 7200
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://logrhythm.com
access-control-expose-headers
vary: Accept, Origin, Accept-Encoding
access-control-allow-credentials: true
cache-control: max-age=0, private, must-revalidate

OPTIONS
H2 200 init
jukebox.pathfactory.com/api/public/v1/ Frame 0
0 302ms
99ms Preflight 52.55.132.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/init?clientId=LB-72E778C0-10607&image=&title=&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.55.132.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-132-161.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://logrhythm.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://logrhythm.com
access-control-expose-headers
access-control-max-age: 7200
date: Thu, 04 Apr 2024 15:02:29 GMT

GET
H2 200 pro.min.css Show response
ka-p.fontawesome.com/releases/v6.5.2/css/ 672 KB
118 KB 52ms
46ms Fetch
text/css 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/css/pro.min.css?token=2f1bae2942
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/2f1bae2942.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01a3066991f4af85d35aaa0068aa00054f9762f39c263853f49518d5f9784c4b

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:26 GMT
server: cloudflare
age: 160439
etag: "660c23a2-1d791"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 86f22e00b92af188-CDG
content-length: 120721

GET
H2 200 pro-v4-shims.min.css Show response
ka-p.fontawesome.com/releases/v6.5.2/css/ 27 KB
4 KB 41ms
36ms Fetch
text/css 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/css/pro-v4-shims.min.css?token=2f1bae2942
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/2f1bae2942.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f3387f11826be4923a2d3a8c1542780abd6d4c66ce13f2de770f2e386989593

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:24 GMT
server: cloudflare
age: 160439
etag: "660c23a0-10e7"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 86f22e00b927f188-CDG
content-length: 4327

GET
H2 200 pro-v5-font-face.min.css Show response
ka-p.fontawesome.com/releases/v6.5.2/css/ 50 KB
7 KB 43ms
38ms Fetch
text/css 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/css/pro-v5-font-face.min.css?token=2f1bae2942
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/2f1bae2942.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1580a6a19cb081a84215f13b42f765469beb87d7401f16349760cd067fc4da71

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:24 GMT
server: cloudflare
age: 160439
etag: "660c23a0-1c3b"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 86f22e00b926f188-CDG
content-length: 7227

GET
H2 200 pro-v4-font-face.min.css Show response
ka-p.fontawesome.com/releases/v6.5.2/css/ 7 KB
2 KB 59ms
53ms Fetch
text/css 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/css/pro-v4-font-face.min.css?token=2f1bae2942
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/2f1bae2942.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 516640faeb856df6599d165f26ee51ce8cbaaf34f7c09d818509e75f6a48ae13

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:26:24 GMT
server: cloudflare
age: 160439
etag: "660c23a0-6ca"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 86f22e00b929f188-CDG
content-length: 1738

GET
H2 200 kit-upload.css Show response
kit.fontawesome.com/2f1bae2942/120279590/ 439 B
406 B 33ms
33ms Fetch
text/css 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kit.fontawesome.com/2f1bae2942/120279590/kit-upload.css
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/2f1bae2942.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 476a0ab42c2fa7b55dfa263b611184887029a66019109d4fc95e04e5a01de9d3

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
content-encoding: gzip
cf-cache-status: HIT
server: cloudflare
age: 506597
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-max-age: 3000
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
content-type: text/css
cache-control: max-age=31556926, public, must-revalidate
cf-ray: 86f22e00b91cf188-CDG
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id: F8FPJM3fvhNyooFNlgYh

GET
H2 200 font-awesome.min.css
cdn-app.pathfactory.com/web-fonts/font-awesome/ 28 KB
7 KB 23ms
22ms Stylesheet
text/css 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/web-fonts/font-awesome/font-awesome.min.css
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/447.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 14b6cfd9b2a41bf5ee498086b1fbe2e8a31b1f99d5e040d55bdbe2d95702b6ac

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront)
date: Thu, 04 Apr 2024 01:36:27 GMT
last-modified: Mon, 27 Mar 2023 14:54:50 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 48402
x-amz-server-side-encryption: AES256
etag: W/"d96f1330ac4b04ce0b20d2206236e62c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
x-amz-cf-id: o1Mjfs9zGIoRCPSav9IYWV5xmPwMGbI1aT-YSTQRrFwS_SKgrCNuzw==

GET
H2 200 roboto_lato.css
cdn-app.pathfactory.com/web-fonts/roboto_lato/ 5 KB
1 KB 24ms
24ms Stylesheet
text/css 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/web-fonts/roboto_lato/roboto_lato.css
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/447.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a3e647bd139028a8b14cd0c42545d61fe316a4a42436a5602b44df99d8d416f3

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront)
date: Thu, 04 Apr 2024 01:30:28 GMT
last-modified: Mon, 27 Mar 2023 14:55:14 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 48725
x-amz-server-side-encryption: AES256
etag: W/"6339b6205ef670ae453a1fa9e8740fd8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
x-amz-cf-id: JY1pevPMjh9upGAojzm4SDMk2UPEsoHicCfcwPEfWMdi2GiiUWUb7w==

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
cdn-app.pathfactory.com/web-fonts/roboto_lato/ 14 KB
14 KB 82ms
32ms Font
binary/octet-stream 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/web-fonts/roboto_lato/S6uyw4BMUTPHjx4wXiWtFCc.woff2
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/web-fonts/roboto_lato/roboto_lato.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 07c94892c3e0ac93d2bcb3a9cb88aa67ea47b3d1aa89bc39dfcc2b025dcd8988

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://cdn-app.pathfactory.com/web-fonts/roboto_lato/roboto_lato.css
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: null
date: Thu, 04 Apr 2024 15:02:29 GMT
via: 1.1 3296b04068551f925d5fafd1b785ff30.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
age: 23536
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 13976
last-modified: Mon, 27 Mar 2023 14:55:27 GMT
server: AmazonS3
etag: "e7e52c955aa33e618baf437a16539524"
access-control-max-age: 3000
access-control-allow-methods: GET, PUT, HEAD
content-type: binary/octet-stream
access-control-allow-origin: *
vary: Accept-Encoding,Origin
accept-ranges: bytes
x-amz-cf-id: aryWfun5uHs36Xt1VH1oVxFEuGIhPaa33MluFqjoxe73jwBRFfk9sA==

GET
H2 200 pro-fa-brands-400-0.woff2
ka-p.fontawesome.com/releases/v6.5.2/webfonts/ 37 KB
37 KB 31ms
30ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/webfonts/pro-fa-brands-400-0.woff2
Requested by: Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: faf47e501cdae61064aed4b03b1129d37c6e004ebde6f6452f1632f835c9f318

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:51:13 GMT
server: cloudflare
age: 45077
etag: "660c2971-946c"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 86f22e019a48f188-CDG
content-length: 37996

GET
H2 200 pro-fa-duotone-900-2.woff2
ka-p.fontawesome.com/releases/v6.5.2/webfonts/ 16 KB
16 KB 42ms
42ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/webfonts/pro-fa-duotone-900-2.woff2
Requested by: Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bcb5f560d1e3cad97d06c8de11436a61281805d88484efea79b4c809a58ae49a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:51:15 GMT
server: cloudflare
age: 160437
etag: "660c2973-407c"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 86f22e019a4af188-CDG
content-length: 16508

GET
H2 200 pro-fa-solid-900-12.woff2
ka-p.fontawesome.com/releases/v6.5.2/webfonts/ 14 KB
14 KB 41ms
41ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/webfonts/pro-fa-solid-900-12.woff2
Requested by: Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7742bb16ac54dbccd2a9df6edc159ff921e1e738f08dc0d4b4b9f31424ede919

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:51:22 GMT
server: cloudflare
age: 159226
etag: "660c297a-3878"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 86f22e019a4cf188-CDG
content-length: 14456

GET
H2 200 pro-fa-regular-400-12.woff2
ka-p.fontawesome.com/releases/v6.5.2/webfonts/ 17 KB
17 KB 44ms
44ms Font
font/woff2 2606:4700:4400::ac40:93bc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.5.2/webfonts/pro-fa-regular-400-12.woff2
Requested by: Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:93bc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af04f015df3bbffd125ee30eaf78e7f1c9328f5b967d66f7b7f8958472464dda

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 15:51:17 GMT
server: cloudflare
age: 160437
etag: "660c2975-4244"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 86f22e019a4df188-CDG
content-length: 16964

GET
H3 200 lottie.565b778d23c04461c4ea.bundle.min.js Show response
logrhythm.com/wp-content/plugins/elementor-pro/assets/js/ 14 KB
7 KB 184ms
184ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/elementor-pro/assets/js/lottie.565b778d23c04461c4ea.bundle.min.js

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.20.2

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9fc308738978262c5dfffa90d2672638bb659a2dd20046e1be6db387d6dd3fe2

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 26 Mar 2024 19:31:16 GMT
server: cloudflare
etag: W/"66032284-3849"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22e01aaa6f154-CDG

GET
H3 200 search-form.a25a87283d08dad12f18.bundle.min.js Show response
logrhythm.com/wp-content/plugins/elementor-pro/assets/js/ 2 KB
4 KB 203ms
203ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/elementor-pro/assets/js/search-form.a25a87283d08dad12f18.bundle.min.js

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.20.2

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c8fc34d2947a230d4fe54344e4e873e9871f2cfe7eec5473e68568e3d79843f1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 26 Mar 2024 19:31:16 GMT
server: cloudflare
etag: W/"66032284-84c"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22e01baa7f154-CDG

GET
H3 200 text-editor.2c35aafbe5bf0e127950.bundle.min.js Show response
logrhythm.com/wp-content/plugins/elementor/assets/js/ 1 KB
4 KB 35ms
34ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/plugins/elementor/assets/js/text-editor.2c35aafbe5bf0e127950.bundle.min.js

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.20.3

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

00952715c953d7e8a330645295c52002b898c5d06c8f75e389c611f9b5d7968d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 32440
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 26 Mar 2024 19:31:14 GMT
server: cloudflare
etag: W/"66032282-550"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22e01baadf154-CDG

GET
H3 200 29522-space-tour.json Show response
logrhythm.com/wp-content/uploads/2021/07/ 842 KB
846 KB 203ms
203ms XHR
application/octet-stream 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/wp-content/uploads/2021/07/29522-space-tour.json

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/wp-content/plugins/elementor-pro/assets/lib/lottie/lottie.min.js?ver=5.6.6

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

5757a4c7172efe71ca15fab282fc65180c699d488593e87ac4ab7a14394f5492

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
x-cache-group: normal
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-cacheable: SHORT
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: DYNAMIC
x-cache: MISS
alt-svc: h3=":443"; ma=86400
content-length: 861701
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 28 Jul 2021 21:51:20 GMT
server: cloudflare
etag: "6101d158-d2605"
vary: Accept-Encoding,Cookie
x-frame-options: SAMEORIGIN
content-type: application/octet-stream
cache-control: max-age=600, must-revalidate
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
accept-ranges: bytes
cf-ray: 86f22e02dbfef154-CDG

GET
H2 200 8fa18974-bc57-4d14-96b9-689a8c29b32c.js Show response
j.6sc.co/j/ 4 KB
5 KB 587ms
503ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/8fa18974-bc57-4d14-96b9-689a8c29b32c.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N3MMPPN
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 609b117eff6ecd097423cf9ec63c011933d6de31679ae775253fa687022656dd

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: cDSr208sDWq2dKcE3yKxOsq2GvCx3OLN
date: Thu, 04 Apr 2024 15:02:30 GMT
x-amz-cf-pop: FRA60-P8
x-amz-server-side-encryption: AES256
x-amz-meta-content-type: application/json
content-length: 4576
pragma: no-cache
last-modified: Fri, 15 Mar 2024 20:37:35 GMT
server: AmazonS3
etag: "7a67d7d039ed9ffe605e9bbf0481dc7a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: p9eOdbf2Hi4m-SPFZSXZv1y1oeuNcSysX9yHxX5qExocGc7m1vyzEA==
expires: Thu, 04 Apr 2024 15:02:30 GMT

GET
H2 200 hotjar-1803640.js Show response
static.hotjar.com/c/ 9 KB
4 KB 136ms
53ms Script
application/javascript 18.66.102.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1803640.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N3MMPPN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.102.11 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-102-11.fra56.r.cloudfront.net

Software

Resource Hash

0813cfd37a8ebb9491332da173a746ebcb365a7bad3876e81d045067d602ad49

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 7ed0982309781d390a105a3ead66dbfa.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
etag: W/68e343ce081d29495c1a520b1c118635
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=60
x-cache-hit: 1
cross-origin-resource-policy: cross-origin
x-amz-cf-id: I9Gm5ahs7j4dWXcujOGlzf-0s2mppxhLC5Ghid-PsZWGpsMj834InQ==

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 48 KB
17 KB 112ms
30ms Script
application/javascript 2a02:26f0:3500:16::215:148b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N3MMPPN

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:148b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

85a881fba590ac097d83e7d5397c82c99d9538ac482af8f10a3e5886393cfc85

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 11 Mar 2024 16:03:53 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=71853
accept-ranges: bytes
content-length: 17224

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 104ms
24ms Script
application/x-javascript 88.221.60.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-60-75.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 04 Apr 2024 15:02:29 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 218 KB
59 KB 103ms
22ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

047e3259b6f0b42d781532fa122b2d8de9aed187d766fd45efcf119450eeb4c4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 04 Apr 2024 15:02:29 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 58040
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=20, rtx=0, c=12, mss=1294, tbw=2773, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma: public
x-fb-debug: aoPwFlz8jhuh4Ild+/aqll7GSrdFOJiI1700vYATPyQf1ewPnZ55xLke9k/AkBOAR6cmxkPpNc2Vylw3+4xaWA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 zi-tag.js Show response
js.zi-scripts.com/ 8 KB
3 KB 111ms
31ms Script
application/javascript 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fa8204005ed25e30f3ee56dbad3afa3c011e12636e75decf2b1aaf22a1c326dd

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
x-amz-version-id: jWuK40m0MUEUayB9sycJH0u7f85X3F2r
via: 1.1 2ee05fc08860e6c53e732a51ce89da7c.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
content-encoding: gzip
x-amz-cf-pop: CDG50-P1
age: 28792
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 19 Mar 2024 07:02:18 GMT
server: cloudflare
etag: W/"2cd903354c7c864dbd543d268219ef1d"
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 86f22e038c862173-CDG
x-amz-cf-id: jk4JMFBoAQkPoMd4FAgckR-8HTxbZ-eHIUO4rDyHoWB37lG6U0WJLg==

GET
H3 200 favicon.ico
logrhythm.com/ 15 KB
14 KB 45ms
44ms Other
image/x-icon 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://logrhythm.com/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a7a5aa60ddbd44255fd0d27f1d3addb496e8fedeaebbcc0ca5138ba1c0825e16

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: HIT
age: 31776
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 03 Apr 2024 20:28:57 GMT
server: cloudflare
etag: W/"660dbc09-3c2e"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/x-icon
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
cf-ray: 86f22e038cb0f154-CDG

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 37ms
37ms Script
application/x-javascript 88.221.60.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-60-75.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 04 Apr 2024 15:02:29 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4741
Expires: Sat, 13 Jul 2024 15:02:29 GMT

GET
H3 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 270 B
601 B 457ms
457ms Fetch
application/json 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: e96db31cc7e95572d164dbe651b6742f14f010f71dd813c6600c086e5a618952

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
Authorization: Bearer b2780a2ecf1673545167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://logrhythm.com/
visited_url: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/

Response headers

date: Thu, 04 Apr 2024 15:02:30 GMT
via: 1.1 9c8fea304cc4dc64f018a09a43cea24a.cloudfront.net (CloudFront)
content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-cf-pop: CDG50-P1
x-powered-by: Express
x-cache: Miss from cloudfront
alt-svc: h3=":443"; ma=86400
apigw-requestid: VtMZEiHJPHcEMSQ=
server: cloudflare
etag: W/"10e-qlDSkp9fFF68BjiTCFHnreFk+UA"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cf-ray: 86f22e06eaa62149-CDG
x-amz-cf-id: nV5eEXl0V5leqYJ7q5aIgPEqGb7YX35J3fakC4s7peTczEzEmcpYuA==

OPTIONS
H3 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame 0
0 509ms
469ms Preflight 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://logrhythm.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 0
alt-svc: h3=":443"; ma=86400
apigw-requestid: VtMZAiGXvHcEMSQ=
cf-cache-status: DYNAMIC
cf-ray: 86f22e03ff8d2149-CDG
date: Thu, 04 Apr 2024 15:02:30 GMT
server: cloudflare
vary: Access-Control-Request-Headers
via: 1.1 9c8fea304cc4dc64f018a09a43cea24a.cloudfront.net (CloudFront)
x-amz-cf-id: 12B7EptKyAsbDXvscgG22H6uwNCkN8_nyRwThnE7qZU38OKUSyXA0A==
x-amz-cf-pop: CDG50-P1
x-cache: Miss from cloudfront
x-powered-by: Express

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
700 B 368ms
159ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: *
Referer: https://logrhythm.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:29 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: A9A8216C5D2B48D991B31A71A7C1C7ED Ref B: PAR02EDGE0816 Ref C: 2024-04-04T15:02:29Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
access-control-allow-origin: https://logrhythm.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYVRqDNzdSX93ZoXYlTjg==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4380604&time=1712242949719&li_adsId=e8b7d9b3-984f-4e56-ae7e-553d74f9a805&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4380604&time=1712242949719&li_adsId=e8b7d9b3-984f-4e56-ae7e-553d74f9a805&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4380604&time=1712242949719&li_adsId=e8b7d9b3-984f-4e56-ae7e-553d74f9a805&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F...

0
266 B

229ms
189ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4380604&time=1712242949719&li_adsId=e8b7d9b3-984f-4e56-ae7e-553d74f9a805&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&tm=gtmv2&cookiesTest=true&e_ipv6=AQI66VcMl7WFtAAAAY6pogBKkU72cOE3qAGfBwpSfRwGv8_ZE-T7EaLDeO1OEq1VopPTjmU
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://logrhythm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Thu, 04 Apr 2024 15:02:30 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: C68AB84CBF844F849C45903A8A933D06 Ref B: PAR02EDGE0914 Ref C: 2024-04-04T15:02:30Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYVRqDU/ygpecB1ZAW4/g==

Redirect headers

date: Thu, 04 Apr 2024 15:02:29 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 78A16EFDCC594EF7B1540BD2434C020C Ref B: PAR02EDGE0816 Ref C: 2024-04-04T15:02:30Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4380604&time=1712242949719&li_adsId=e8b7d9b3-984f-4e56-ae7e-553d74f9a805&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&tm=gtmv2&cookiesTest=true&e_ipv6=AQI66VcMl7WFtAAAAY6pogBKkU72cOE3qAGfBwpSfRwGv8_ZE-T7EaLDeO1OEq1VopPTjmU
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYVRqDRA3dTcmY9QKmqxw==

GET
H2 200 modules.4bbac2bdc7f1b66d3009.js Show response
script.hotjar.com/ 221 KB
55 KB 220ms
25ms Script
application/javascript 13.32.27.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.4bbac2bdc7f1b66d3009.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1803640.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.19 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-19.fra56.r.cloudfront.net

Software

Resource Hash

261e44bd5998183c1bde239149a4be112fd5afd76c1efb12da82f24cf20561d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 02 Apr 2024 12:55:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 2e4a0520ad8fe16707823b20e9441e08.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 180443
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 55706
last-modified: Tue, 02 Apr 2024 12:54:16 GMT
etag: "d8eecaf9ad4fc4bf64b1230f03df9166"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: FsS60OG7c0Xyz9nAt8JswQhMg1WmMZ79BtGMi0BoZsFbUo2REX60Pw==

POST
H/1.1 200
OK visitWebPage
050-uwt-888.mktoresp.com/webevents/ 2 B
318 B 581ms
96ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://050-uwt-888.mktoresp.com/webevents/visitWebPage?_mchNc=1712242949744&_mchCn=&_mchId=050-UWT-888&_mchTk=_mch-logrhythm.com-1712242949744-46899&_mchHo=logrhythm.com&_mchPo=&_mchRu=%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 04 Apr 2024 15:02:30 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 712e1b65-e77a-423b-be83-777329ada1c2

GET
H2 200 232919347190734 Show response
connect.facebook.net/signals/config/ 65 KB
14 KB 157ms
156ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/232919347190734?v=2.9.151&r=stable&domain=logrhythm.com&hme=8ce74e881727851b4427183947937854816d72704925561b9de6420cd43214ee&ex_m=66%2C111%2C98%2C102%2C57%2C3%2C92%2C65%2C15%2C90%2C83%2C48%2C50%2C157%2C160%2C171%2C167%2C168%2C170%2C28%2C93%2C49%2C72%2C169%2C152%2C155%2C164%2C165%2C172%2C120%2C14%2C47%2C176%2C175%2C122%2C17%2C32%2C36%2C1%2C40%2C61%2C62%2C63%2C67%2C87%2C16%2C13%2C89%2C86%2C85%2C99%2C101%2C35%2C100%2C29%2C25%2C153%2C156%2C129%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C53%2C58%2C60%2C70%2C94%2C26%2C71%2C8%2C7%2C75%2C45%2C20%2C96%2C95%2C9%2C19%2C18%2C77%2C82%2C44%2C43%2C81%2C37%2C39%2C80%2C52%2C78%2C31%2C41%2C34%2C69%2C0%2C88%2C4%2C84%2C76%2C79%2C2%2C33%2C59%2C38%2C97%2C42%2C74%2C64%2C103%2C56%2C55%2C30%2C91%2C54%2C51%2C46%2C73%2C68%2C23%2C104

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f0cfe5bb3632a93b092412b0fcfc4072ea3a7aec330b6140344c1c68d5f82575

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 04 Apr 2024 15:02:29 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=29, rtx=0, c=64, mss=1294, tbw=63234, tp=-1, tpl=-1, uplat=133, ullat=0
pragma: public
x-fb-debug: gmPwxDI1euZWVbahebtO3pVyboEaY+V1trQDHQ+yOtOuhFjdu2akgeO1mJss/AZv8Mc9jvPbgciSVEz3eJ4dUQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 242.js Show response
cdn-app.pathfactory.com/production/jukebox-lite/current/ 173 KB
59 KB 28ms
26ms Script
application/javascript 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/242.js
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/jukebox.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9928340ab66ea3b57ea2649c3ebb0d6f28fcc0ccc2adf47a623316bdedf12250

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront)
date: Thu, 04 Apr 2024 01:42:27 GMT
last-modified: Wed, 13 Mar 2024 00:54:34 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 48003
x-amz-server-side-encryption: AES256
etag: W/"d78cd4c537a84ec760ac1d3bbef22ffd"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: r9OrKQtNsz8e_hOgQd0cS5kQHad3ZKlRhd3SJZ3DAlp4ntQXTrlxnA==

GET
H2 200 689.js Show response
cdn-app.pathfactory.com/production/jukebox-lite/current/ 16 KB
6 KB 25ms
24ms Script
application/javascript 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/689.js
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/jukebox.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 05ff91703fa482062b851d83b00e7663ef9d2001e01eaa126430e417d8e28aaa

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront)
date: Thu, 04 Apr 2024 01:14:13 GMT
last-modified: Wed, 13 Mar 2024 00:54:34 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 49754
x-amz-server-side-encryption: AES256
etag: W/"c08943f25f0d30cb139fc315b9b5d615"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: M2donu--TnwVJsxjJ_btgNAqGCsOz5VAF0fp2GJuOGCRIbkTYJ93kA==

GET
H2 200 426.js Show response
cdn-app.pathfactory.com/production/jukebox-lite/current/ 144 KB
49 KB 32ms
31ms Script
application/javascript 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/426.js
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/jukebox.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e9a502929c5dd3ddd472b4124271a27e6342ee3f71099482a29d1da9b0c23d4b

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront)
date: Thu, 04 Apr 2024 07:22:12 GMT
last-modified: Wed, 13 Mar 2024 00:54:34 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 27767
x-amz-server-side-encryption: AES256
etag: W/"7937b5bb1bbb94f5d0b634d9b9cc8fc7"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: tOf4FMZvjUgpx7OTFq0caMuvIN-sDn7SuAzn7Vpn2BP_Vl96JHBaFQ==

GET
H2 200 421.js Show response
cdn-app.pathfactory.com/production/jukebox-lite/current/ 73 KB
18 KB 35ms
34ms Script
application/javascript 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/421.js
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/jukebox.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: be5e0ff30fa3977ca82d6c2815bca77d5ad7b4e991136fd8f9fe3920fa49451f

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront)
date: Thu, 04 Apr 2024 01:47:38 GMT
last-modified: Wed, 13 Mar 2024 00:54:34 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 47691
x-amz-server-side-encryption: AES256
etag: W/"b529a7b8fef16e2b0415176d229c41ef"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: h7N_jbZL0IYBlLlZItuYAgzM-O_l5FqTDjQ40BiDrz3LdxYYr9vznA==

GET
H2 200 796.js Show response
cdn-app.pathfactory.com/production/jukebox-lite/current/ 117 KB
27 KB 50ms
49ms Script
application/javascript 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/796.js
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/jukebox.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d6f195ea5d2876a07748b4cae489f6493b04ceda209bc3dc3163e51101c17a98

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront)
date: Thu, 04 Apr 2024 04:05:13 GMT
last-modified: Wed, 13 Mar 2024 00:54:34 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 39437
x-amz-server-side-encryption: AES256
etag: W/"c5ced3beee0a663e09cdb5a2ee9e6357"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: 4GXeFUg1oKsZboAKUFjC2eFu0mouGg1GzNenemGIiIheyygsEHAhYw==

GET
H2 200 98.js Show response
cdn-app.pathfactory.com/production/jukebox-lite/current/ 52 KB
13 KB 47ms
46ms Script
application/javascript 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/98.js
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/jukebox.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d4632d8a74284c2f9ae23b9ed84c8923c92a021a597a3cad10abe393d0c67f18

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront)
date: Thu, 04 Apr 2024 08:24:37 GMT
last-modified: Wed, 13 Mar 2024 00:54:34 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 24208
x-amz-server-side-encryption: AES256
etag: W/"81af86022645fe052cb0035e9408a7ef"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: HU0wohM1mOV7spuZZAYW1QfN2d_m4nIzqQckUWHpxHOdY2TciNFU2A==

GET
H2 204 website_forms Show response
jukebox.pathfactory.com/api/public/v1/ 0
408 B 146ms
146ms XHR
text/plain 52.55.132.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/website_forms?clientId=LB-72E778C0-10607&pfVisitorUuid=&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/jukebox.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.55.132.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-55-132-161.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://logrhythm.com/
sec-ch-ua-platform: "Win32"

Response headers

x-runtime: 0.048481
date: Thu, 04 Apr 2024 15:02:30 GMT
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
access-control-max-age: 7200
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://logrhythm.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
vary: Origin
x-request-id: 04d08ecb-f1e9-4110-9a27-6ff830045b4c

OPTIONS
H2 200 website_forms
jukebox.pathfactory.com/api/public/v1/ Frame 0
0 97ms
96ms Preflight 52.55.132.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v1/website_forms?clientId=LB-72E778C0-10607&pfVisitorUuid=&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.55.132.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-132-161.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://logrhythm.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://logrhythm.com
access-control-expose-headers
access-control-max-age: 7200
date: Thu, 04 Apr 2024 15:02:29 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
274 B 71ms
23ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=232919347190734&ev=PageView&dl=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&rl=&if=false&ts=1712242949934&sw=800&sh=600&v=2.9.151&r=stable&ec=0&o=4125&fbp=fb.1.1712242949932.334287589&cs_est=true&ler=empty&cdl=API_unavailable&it=1712242949758&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=20, rtx=0, c=10, mss=1294, tbw=2765, tp=-1, tpl=-1, uplat=1, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 04 Apr 2024 15:02:29 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

HEAD
H/1.1 200
OK tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ 0
0 393ms
94ms Fetch
image/gif 54.152.183.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/jukebox.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.183.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-183-68.compute-1.amazonaws.com
Software: akka-http/10.0.9 /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 04 Apr 2024 15:02:30 GMT
Server: akka-http/10.0.9
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 43

GET
H2 200 6si.min.js Show response
j.6sc.co/ 64 KB
18 KB 66ms
65ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/8fa18974-bc57-4d14-96b9-689a8c29b32c.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

8c1781ec4483c6fb3bd9ad005d312800eaf24e232c12976624bff84f8ab908b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 04 Apr 2024 15:02:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 22 Feb 2024 19:00:41 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "65d799d9-101dd"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17693
expires: Thu, 04 Apr 2024 15:02:30 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
192 B 55ms
42ms XHR
text/html 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:30 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://logrhythm.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 19 B
306 B 98ms
23ms XHR
text/html 2a02:26f0:ab00::214:8e70
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ab00::214:8e70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 6118483790500003534e0223288af8644706fa1eb0208e4600106d21378ee5d3

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 04 Apr 2024 15:02:30 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://logrhythm.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2001:41d0:8:d154::3
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1712242950303_34901612_537063320_21_821_21_44_219";dur=1
content-length: 19
expires: Thu, 04 Apr 2024 15:02:30 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 233ms
220ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05750b0314b98f84ad20a6fe422744a5&svisitor=null&visitor=34ba9420-3a1f-47d9-8194-c57863f96c5e&session=6f5d4029-3952-444e-83a5-dc3089da20e9&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2004%20Apr%202024%2015%3A02%3A30%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Page%20not%20found%20%7C%20LogRhythm%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&pageViewId=30056d17-787b-49e9-882c-03fd34b6d651&webTagId=8fa18974-bc57-4d14-96b9-689a8c29b32c&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:30 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 242ms
230ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05750b0314b98f84ad20a6fe422744a5&svisitor=null&visitor=34ba9420-3a1f-47d9-8194-c57863f96c5e&session=6f5d4029-3952-444e-83a5-dc3089da20e9&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%2205750b0314b98f84ad20a6fe422744a5%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Apr%202024%2015%3A02%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Apr%202024%2015%3A02%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%223ee786d75ca9f310bc0644a4c464da0447c3301e%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Apr%202024%2015%3A02%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Apr%202024%2015%3A02%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Apr%202024%2015%3A02%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Apr%202024%2015%3A02%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Apr%202024%2015%3A02%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Apr%202024%2015%3A02%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%228fa18974-bc57-4d14-96b9-689a8c29b32c%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Apr%202024%2015%3A02%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Apr%202024%2015%3A02%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Apr%202024%2015%3A02%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableMapCookieCapture%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Apr%202024%2015%3A02%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Apr%202024%2015%3A02%3A30%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Page%20not%20found%20%7C%20LogRhythm%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&pageViewId=30056d17-787b-49e9-882c-03fd34b6d651&webTagId=8fa18974-bc57-4d14-96b9-689a8c29b32c&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:30 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
DATA 200
OK truncated
/ 31 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b0098c9bbf5cd5db128fb4dec0725ffd0f855be5763733e1d4eae5884555455

Request headers

Referer
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 31 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2f7795d2dff17bfa96b1cfe74a14b41faf5771ac70280e2273e909619e6891ea

Request headers

Referer
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 170 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 027028ff278f79b04e37b1407454486b09f08686b56dab1874f3a712f176be4b

Request headers

Referer
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 22 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c9c6a140224ac9996dd7e0bf8f95c03e1f6f643a83f83150fa5dd6a79f3a600b

Request headers

Referer
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 21 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 92c47bb40457e52a10831e40bb00cd7d544dbbcbfc0b401328fbdabe45562d36

Request headers

Referer
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 21 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3996e887606cc7f8255105a17d18dfebd26a71cf2ab42a06b45be95f4344fa71

Request headers

Referer
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 22 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c2e434da01fbfefa93d8105f23bbf9896470169def9352753c2c838388db99e0

Request headers

Referer
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 33 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 210e7b0ef79bf720dbad0e173560f40cd213dc5ed5289a596c89ddf7f8953328

Request headers

Referer
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 57 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fe657f5d2a124b86736a3be9a517df190a31c2dd14620edc2cb56f0c263e7e86

Request headers

Referer
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 39 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 28f45baa7e4b94b425dbcc229217e259919bf12cfd487a52a27cec644f867a38

Request headers

Referer
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 176 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4484d34c365c7b511ab064293e5fa96f4c514ebcd5ab883f6dd3607745932cab

Request headers

Referer
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
483 B 215ms
215ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05750b0314b98f84ad20a6fe422744a5&svisitor=null&visitor=34ba9420-3a1f-47d9-8194-c57863f96c5e&session=6f5d4029-3952-444e-83a5-dc3089da20e9&event=ipv6&q=%7B%22address%22%3A%222001%3A41d0%3A8%3Ad154%3A%3A3%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Page%20not%20found%20%7C%20LogRhythm%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&pageViewId=30056d17-787b-49e9-882c-03fd34b6d651&webTagId=8fa18974-bc57-4d14-96b9-689a8c29b32c&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:30 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 sp.lite.js Show response
cdn-app.pathfactory.com/libraries/tracker/3.19.0/ 43 KB
15 KB 23ms
23ms Script
application/javascript 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/libraries/tracker/3.19.0/sp.lite.js
Requested by: Host: logrhythm.com
URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 25462e537585513efd706d55cf4cd890b30f382ab96c0f6df75c41c1095d58ed

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront)
date: Thu, 04 Apr 2024 03:06:47 GMT
last-modified: Wed, 03 Jan 2024 16:25:31 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 42944
x-amz-server-side-encryption: AES256
etag: W/"1aed05295e6c59943103b6fa7150f848"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: sgq5MrcL72Vpe3VZRjD5HjWUNlx6d0luJ5Cc7wzv1KKcHPOGOgz4DQ==

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 2 KB
1 KB 87ms
41ms XHR
application/json 76.223.9.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.9.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash: cf83b55e773ca3b13936e113b661b5a2bfed6db14527a259bbfccf3c08e85ff6

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
Authorization: Token 3ee786d75ca9f310bc0644a4c464da0447c3301e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
X-6s-CustomID: WebTag 8fa18974-bc57-4d14-96b9-689a8c29b32c
Referer: https://logrhythm.com/
sec-ch-ua-platform: "Win32"

Response headers

x-trace-id: 662806621767059094
date: Thu, 04 Apr 2024 15:02:30 GMT
content-encoding: gzip
server: nginx
vary: Origin, Accept-Encoding
content-type: application/json
x-6si-region: eu-central-1a
access-control-allow-origin: https://logrhythm.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 905

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 87ms
30ms Preflight 76.223.9.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.9.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://logrhythm.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://logrhythm.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Thu, 04 Apr 2024 15:02:30 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: eu-central-1a
x-trace-id: 6313422910792299310

OPTIONS
H2 200 recommendations
jukebox.pathfactory.com/api/public/v3/ Frame 0
0 97ms
96ms Preflight 52.55.132.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v3/recommendations?clientId=LB-72E778C0-10607&sourceType=2&pfVisitorUuid=6313f79a-6a47-4b47-ac09-51f90b337ec1&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&contentPoolId=e7ab94d5-a239-4c54-86d7-9dc5fd4f4276&contentDisplayedType=collection&collectionRuleId=&appearanceId=&recommendationType=trending&sessionId=557313a2-50e1-4e61-8566-8a0b1adff2e6&webcontextId=7b1bd4f3-891a-4264-98ee-a9baaa86b22f&noPosts=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.55.132.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-132-161.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://logrhythm.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://logrhythm.com
access-control-expose-headers
access-control-max-age: 7200
date: Thu, 04 Apr 2024 15:02:30 GMT

OPTIONS
H2 200 recommendations
jukebox.pathfactory.com/api/public/v3/ Frame 0
0 100ms
99ms Preflight 52.55.132.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/api/public/v3/recommendations?clientId=LB-72E778C0-10607&sourceType=2&pfVisitorUuid=6313f79a-6a47-4b47-ac09-51f90b337ec1&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&contentPoolId=e7ab94d5-a239-4c54-86d7-9dc5fd4f4276&contentDisplayedType=collection&collectionRuleId=&appearanceId=&recommendationType=yml&sessionId=557313a2-50e1-4e61-8566-8a0b1adff2e6&webcontextId=7b1bd4f3-891a-4264-98ee-a9baaa86b22f&noPosts=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.55.132.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-132-161.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://logrhythm.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://logrhythm.com
access-control-expose-headers
access-control-max-age: 7200
date: Thu, 04 Apr 2024 15:02:30 GMT

GET
H2 200 link-click.js Show response
cdn-app.pathfactory.com/libraries/tracker/3.19.0/plugin/ 6 KB
3 KB 22ms
22ms Script
application/javascript 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/libraries/tracker/3.19.0/plugin/link-click.js
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/libraries/tracker/3.19.0/sp.lite.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0927046a7f82a1f6e6e48d1115be04d8e053922775f03d0fdecef3b60e92f8cb

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront)
date: Thu, 04 Apr 2024 00:54:44 GMT
last-modified: Wed, 03 Jan 2024 16:25:40 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 50886
x-amz-server-side-encryption: AES256
etag: W/"312554e163da7d1fad8823ce4ad2d17c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: _pXBWpXYk46VkKwBOQQupVgXjEyyAtqzZPnKrUW5774HWm53X0xspw==

GET
H2 200 recommendations Show response
jukebox.pathfactory.com/api/public/v3/ 4 KB
2 KB 2728ms
2728ms XHR
application/json 52.55.132.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v3/recommendations?clientId=LB-72E778C0-10607&sourceType=2&pfVisitorUuid=6313f79a-6a47-4b47-ac09-51f90b337ec1&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&contentPoolId=e7ab94d5-a239-4c54-86d7-9dc5fd4f4276&contentDisplayedType=collection&collectionRuleId=&appearanceId=&recommendationType=trending&sessionId=557313a2-50e1-4e61-8566-8a0b1adff2e6&webcontextId=7b1bd4f3-891a-4264-98ee-a9baaa86b22f&noPosts=5

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/jukebox.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.55.132.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-55-132-161.compute-1.amazonaws.com

Software

Resource Hash

d4185c058b3d6dd6c7735a174389257dbf280747eefcc62551e95d0f3f255eef

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://logrhythm.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy
content-encoding: gzip
x-request-id: cd69ac6a-80de-43f0-ac6c-2790d4755b14
x-runtime: 2.630345
referrer-policy: no-referrer-when-downgrade
etag: W/"d4185c058b3d6dd6c7735a174389257d"
access-control-max-age: 7200
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://logrhythm.com
access-control-expose-headers
vary: Accept, Origin, Accept-Encoding
access-control-allow-credentials: true
cache-control: max-age=0, private, must-revalidate

GET
H2 200 recommendations Show response
jukebox.pathfactory.com/api/public/v3/ 5 KB
2 KB 494ms
493ms XHR
application/json 52.55.132.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v3/recommendations?clientId=LB-72E778C0-10607&sourceType=2&pfVisitorUuid=6313f79a-6a47-4b47-ac09-51f90b337ec1&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&contentPoolId=e7ab94d5-a239-4c54-86d7-9dc5fd4f4276&contentDisplayedType=collection&collectionRuleId=&appearanceId=&recommendationType=yml&sessionId=557313a2-50e1-4e61-8566-8a0b1adff2e6&webcontextId=7b1bd4f3-891a-4264-98ee-a9baaa86b22f&noPosts=5

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/production/jukebox-lite/current/jukebox.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.55.132.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-55-132-161.compute-1.amazonaws.com

Software

Resource Hash

3e98aa3a6f9d1ead471762bca99dd9b967fa820667d3d240da3a56df763b176c

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://logrhythm.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy
content-encoding: gzip
x-request-id: 7f86f63f-b223-458e-ab7b-69fc7326ee19
x-runtime: 0.395269
referrer-policy: no-referrer-when-downgrade
etag: W/"3e98aa3a6f9d1ead471762bca99dd9b9"
access-control-max-age: 7200
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://logrhythm.com
access-control-expose-headers
vary: Accept, Origin, Accept-Encoding
access-control-allow-credentials: true
cache-control: max-age=0, private, must-revalidate

OPTIONS
H/1.1 200
OK tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ Frame 0
0 95ms
95ms Preflight 54.152.183.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.183.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-183-68.compute-1.amazonaws.com
Software: akka-http/10.0.9 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://logrhythm.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Origin: https://logrhythm.com
Access-Control-Max-Age: 5
Connection: keep-alive
Content-Length: 0
Date: Thu, 04 Apr 2024 15:02:30 GMT
Server: akka-http/10.0.9

OPTIONS
H2 200 tp2
jukebox.pathfactory.com/com.snowplowanalytics.snowplow/ Frame 0
0 97ms
97ms Preflight 52.55.132.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jukebox.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.55.132.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-132-161.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://logrhythm.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://logrhythm.com
access-control-expose-headers
access-control-max-age: 7200
date: Thu, 04 Apr 2024 15:02:30 GMT

POST
H/1.1 200
OK tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ 2 B
458 B 399ms
101ms Ping
text/plain 54.152.183.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/libraries/tracker/3.19.0/sp.lite.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.183.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-183-68.compute-1.amazonaws.com
Software: akka-http/10.0.9 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

Date: Thu, 04 Apr 2024 15:02:30 GMT
Server: akka-http/10.0.9
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Access-Control-Allow-Origin: https://logrhythm.com
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 2

POST
H2 200 tp2
jukebox.pathfactory.com/com.snowplowanalytics.snowplow/ 0
439 B 113ms
112ms Ping
text/html 52.55.132.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/com.snowplowanalytics.snowplow/tp2

Requested by

Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/libraries/tracker/3.19.0/sp.lite.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.55.132.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-55-132-161.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.015728
date: Thu, 04 Apr 2024 15:02:30 GMT
content-security-policy
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
access-control-max-age: 7200
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: text/html
access-control-allow-origin: https://logrhythm.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
vary: Origin
content-length: 0
x-request-id: 66e65b72-a2eb-4a1d-8caf-942e237e9e3f

OPTIONS
H3 200 /
ws.zoominfo.com/pixel/63f526f5ff88320bcff96dc8/ Frame 0
0 203ms
164ms Preflight
text/html 104.16.137.15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/63f526f5ff88320bcff96dc8/?iszitag=true

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.137.15 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://logrhythm.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin: https://logrhythm.com
allow: GET,HEAD
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 86f22e0a1cbc9efa-CDG
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 04 Apr 2024 15:02:30 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

GET
H3 200 formcomplete.js Show response
ws-assets.zoominfo.com/ 86 KB
27 KB 101ms
55ms Script
application/javascript 104.16.136.15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ws-assets.zoominfo.com/formcomplete.js
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.136.15 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30e56b8ea8620ad4338d19c01c39c349bd2e614716adff78dec000cbab05158d

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:30 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
age: 49
x-guploader-uploadid: ABPtcPoHnqLhUY2wiMjC-LU2L2cqtAPzHF2dAyAT470UaeWRbcvfH7SjHwnFbaf6P-ucwl9kOrTJeSWcHg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 12 Mar 2024 09:53:49 GMT
server: cloudflare
etag: W/"b53466e5475228f081a9e4df4b319aae"
x-goog-hash: crc32c=T+Sa9g==, md5=tTRm5UdSKPCBqeTfSzGarg==
x-goog-generation: 1710237229773246
content-type: application/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 87941
cf-ray: 86f22e0a1ebf7017-CDG
expires: Thu, 04 Apr 2024 16:01:41 GMT

GET
H2 200 insent Show response
logrhythm.widget.insent.ai/ 80 KB
23 KB 132ms
29ms Script
binary/octet-stream 2600:9000:225e:7400:f:7ae2:7780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://logrhythm.widget.insent.ai/insent
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:7400:f:7ae2:7780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c0e96c0f51eb10934d2022f7d30dbeaf05f748f85d32dfe71711f2dbb21621d8

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: Do3I7W1ZAWXrXjTz8nc5rLMLlRnTeriu
content-encoding: gzip
via: 1.1 ba67e20db38657ee5cb05d05b3da9d70.cloudfront.net (CloudFront)
date: Thu, 04 Apr 2024 01:55:36 GMT
last-modified: Wed, 18 Oct 2023 08:56:44 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 47215
etag: "6c640d0008fb2a23a0ff942202f8657c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: binary/octet-stream
content-length: 23142
x-amz-cf-id: 5UAa253rgNyLFEZKxXU6WYJlAkGCMRq7qIRlGLIR2qxBAg7SuaUMrw==

GET
H3 200 / Show response
ws.zoominfo.com/pixel/63f526f5ff88320bcff96dc8/ 3 KB
2 KB 403ms
360ms Fetch
text/javascript 104.16.137.15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/63f526f5ff88320bcff96dc8/?iszitag=true

Requested by

Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.137.15 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

86a39f8f7c27fffe3741168347f048845ad03a5ee939e8711054214abf46c6c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/javascript
visited-url: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
_vtok: MzcuNTkuMTY0Ljk3
_zitok: 5325e63a5c5f9d241f3a1712242950
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: https://logrhythm.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
alt-svc: h3=":443"; ma=86400
cf-ray: 86f22e0b5ec69ece-CDG

OPTIONS
H3 200 forms
ws.zoominfo.com/formcomplete-v2/ Frame 0
0 162ms
161ms Preflight
text/html 104.16.137.15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.137.15 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://logrhythm.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok
access-control-allow-origin: https://logrhythm.com
allow: POST
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 86f22e0a9d519efa-CDG
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 04 Apr 2024 15:02:30 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

POST
H3 200 forms Show response
ws.zoominfo.com/formcomplete-v2/ 2 B
379 B 203ms
203ms Fetch
application/json 104.16.137.15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Requested by

Host: ws-assets.zoominfo.com
URL: https://ws-assets.zoominfo.com/formcomplete.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.137.15 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
Authorization: bearer b4521b4c252f8cd7e5430e30a76eee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://logrhythm.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:31 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
etag: W/"2-l9Fw4VUO7kr8CvBlt4zaMCqXZ0w"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://logrhythm.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok
content-length: 2
cf-ray: 86f22e0baf079ece-CDG
alt-svc: h3=":443"; ma=86400

GET
H2 200 /
logrhythm.widget.insent.ai/ Frame 8130 0
0 73ms
26ms Document
text/html 2600:9000:225e:4000:f:7ae2:7780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://logrhythm.widget.insent.ai/?project_key=eCHZJAVbbvK7Q39sF6oo&blog_url=logrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&event_listener=BgQE8UTpKViJruK&marketo_cookies=[%22_mch-logrhythm.com-1712242949744-46899%22]&parent_innerwidth=1600&parent_innerheight=1113&widgetVisibility=true&locale=undefined&user_id=5325e63a5c5f9d241f3a1712242950&_zitok=5325e63a5c5f9d241f3a1712242950
Requested by: Host: logrhythm.widget.insent.ai
URL: https://logrhythm.widget.insent.ai/insent
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:4000:f:7ae2:7780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://logrhythm.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: fr-FR,fr;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

age: 11386731
cache-control: max-age=31536000
content-encoding: gzip
content-type: text/html
date: Fri, 24 Nov 2023 20:03:40 GMT
etag: W/"cea936b357d0fefbe67f396ac27ecc71"
last-modified: Wed, 18 Oct 2023 08:56:50 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 24fc4e03b1de2a14f79be2422e46a318.cloudfront.net (CloudFront)
x-amz-cf-id: d2L94YLxznrWCxQfVaPiIwy023PLoWaimB9MOfEe7ZvzHsd9YPdkHQ==
x-amz-cf-pop: FRA60-P4
x-amz-version-id: wf2lJ.cKt7e1wlMSlpAOAV_K1ZPwVE5q
x-cache: Error from cloudfront

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
483 B 244ms
244ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05750b0314b98f84ad20a6fe422744a5&svisitor=null&visitor=34ba9420-3a1f-47d9-8194-c57863f96c5e&session=6f5d4029-3952-444e-83a5-dc3089da20e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2004%20Apr%202024%2015%3A02%3A31%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2004%20Apr%202024%2015%3A02%3A30%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%221005%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Page%20not%20found%20%7C%20LogRhythm%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&pageViewId=30056d17-787b-49e9-882c-03fd34b6d651&webTagId=8fa18974-bc57-4d14-96b9-689a8c29b32c&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:31 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
483 B 230ms
229ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05750b0314b98f84ad20a6fe422744a5&svisitor=null&visitor=34ba9420-3a1f-47d9-8194-c57863f96c5e&session=6f5d4029-3952-444e-83a5-dc3089da20e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2004%20Apr%202024%2015%3A02%3A32%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2004%20Apr%202024%2015%3A02%3A31%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222006%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Page%20not%20found%20%7C%20LogRhythm%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&pageViewId=30056d17-787b-49e9-882c-03fd34b6d651&webTagId=8fa18974-bc57-4d14-96b9-689a8c29b32c&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:32 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

OPTIONS
H/1.1 200
OK tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ Frame 0
0 94ms
94ms Preflight 54.152.183.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.183.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-183-68.compute-1.amazonaws.com
Software: akka-http/10.0.9 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://logrhythm.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Origin: https://logrhythm.com
Access-Control-Max-Age: 5
Connection: keep-alive
Content-Length: 0
Date: Thu, 04 Apr 2024 15:02:33 GMT
Server: akka-http/10.0.9

GET
H3 200 MicrosoftTeams-image-4.jpeg
logrhythm.com/wp-content/uploads/2021/08/ 69 KB
73 KB 634ms
633ms Image
image/jpeg 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2021/08/MicrosoftTeams-image-4.jpeg

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c9dad6cf1c9d851ad8ecc7e93ce7314b1af655d2eafa1d73f7840f08139c9fe

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:33 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 71000
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Tue, 03 Aug 2021 17:30:43 GMT
server: cloudflare
etag: "61097d43-11558"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
accept-ranges: bytes
cf-ray: 86f22e187ad2f154-CDG

GET
H3 200 iStock-1136976008.jpg
logrhythm.com/wp-content/uploads/2020/04/ 45 KB
49 KB 208ms
206ms Image
image/jpeg 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2020/04/iStock-1136976008.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

21d7111b0f0275b69b74a7232d180a34e2fcbadcea597461a7021d470f32d4b5

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:33 GMT
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
cf-cache-status: MISS
alt-svc: h3=":443"; ma=86400
content-length: 46076
x-xss-protection: 1; mode=block
referrer-policy: same-origin
last-modified: Wed, 07 Apr 2021 02:26:42 GMT
server: cloudflare
etag: "606d1862-b3fc"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
accept-ranges: bytes
cf-ray: 86f22e187ad3f154-CDG

GET
H3 200 Assisted-Search-e1707342409724.gif
logrhythm.com/wp-content/uploads/2024/01/ 103 KB
106 KB 33ms
32ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logrhythm.com/wp-content/uploads/2024/01/Assisted-Search-e1707342409724.gif

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e0e4786c83cc6a249c49fc95d74cb37736c9c2c625fdf901b7c155381ef62f2

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://logrhythm.com https://disqus.com https://.6sc.co https://.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://.privacymanager.io https://epsilon.6sense.com https://.6sc.co https://analytics.google.com https://.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://.logrhythm.com https://maps.googleapis.com https://.fontawesome.com https://.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://.ampproject.org https://.addthis.com https://.ampproject.net https://connect.facebook.net https://yoast.com https://.facebook.com https://.hotjar.io wss://.hotjar.com https://.hotjar.com https://stats.g.doubleclick.net https://.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://.logrhythm.com https://.hotjar.com https://.typekit.net https://.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://.twitter.com https://.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://.logrhythm.com https://cdn.jsdelivr.net https://.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://.twimg.com https://.typekit.net https://.disquscdn.com https://www.gartner.com https://.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://.trustarc.com https://.doubleclick.net https://shortpixel.com https://logrhythm.com https://.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://.twitter.com https://.addthis.com https://.ampproject.net https://www.slideshare.net https://.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:33 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://logrhythm.com https://disqus.com https://*.6sc.co https://*.6sense.com https://c.disquscdn.com; connect-src 'self' https://logrhythm.com https://play.vidyard.com https://google.com https://cdn.linkedin.oribi.io https://px.ads.linkedin.com https://js.zi-scripts.com https://*.privacymanager.io https://epsilon.6sense.com https://*.6sc.co https://analytics.google.com https://*.googlesyndication.com https://ws.zoominfo.com https://bat.bing.com https://spcollector.pathfactory.com https://adservice.google.com https://*.logrhythm.com https://maps.googleapis.com https://*.fontawesome.com https://*.clarity.ms https://use.typekit.net https://050-uwt-888.mktoutil.com https://*.addthisedge.com https://ampcid.google.com https://www.googletagmanager.com https://*.ampproject.org https://*.addthis.com https://*.ampproject.net https://connect.facebook.net https://yoast.com https://*.facebook.com https://*.hotjar.io wss://*.hotjar.com https://*.hotjar.com https://stats.g.doubleclick.net https://*.yoast.com https://d3hb14vkzrxvla.cloudfront.net https://www.g2.com https://jukebox.pathfactory.com https://www.google-analytics.com https://050-uwt-888.mktoresp.com; font-src 'self' data: https://*.logrhythm.com https://*.hotjar.com https://*.typekit.net https://*.sharepointonline.com https://spoprod-a.akamaihd.net https://fonts.gstatic.com https://cdn-app.pathfactory.com https://*.fontawesome.com https://www.gartner.com https://maxcdn.bootstrapcdn.com https://cdn.pathfactory.com https://app.cdn.lookbookhq.com; img-src https: data: blob: ; media-src 'self' blob: https://*.logrhythm.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.logrhythm.com https://logrhythm.widget.insent.ai https://js.zi-scripts.com https://ws-assets.zoominfo.com https://*.trustarc.com https://launchpad.privacymanager.io https://launchpad-wrapper.privacymanager.io https://jobs.jobvite.com https://play.vidyard.com https://yoast.com https://ws.zoominfo.com https://player.vimeo.com https://*.clarity.ms https://j.6sc.co https://cdn.jsdelivr.net https://cdn-app.pathfactory.com https://unpkg.com/web-vitals https://www.g2.com https://*.facebook.com https://cdn.syndication.twimg.com https://www.gartner.com https://www.google.com https://www.googleoptimize.com https://*.googleapis.com https://tpc.googlesyndication.com https://optimize.google.com https://www.youtube.com https://ssl.google-analytics.com https://www.googletagmanager.com https://www.google-analytics.com https://cdn.ampproject.org https://www.googleadservices.com https://www.gstatic.com https://*.typeform.com js-agent.newrelic.com https://bam.nr-data.net https://beacon-v2.helpscout.net https://kit.fontawesome.com https://bat.bing.com https://munchkin.marketo.net https://snap.licdn.com https://static.ads-twitter.com https://*.twitter.com https://*.hotjar.com https://app.leadsrx.com https://secure.leadforensics.com https://connect.facebook.net https://googleads.g.doubleclick.net https://logrhythm-com.disqus.com https://app.cdn.lookbookhq.com https://jukebox.pathfactory.com https://app-abc.marketo.com https://www.brighttalk.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://*.logrhythm.com https://cdn.jsdelivr.net https://*.fontawesome.com https://yoast.com https://cdn-app.pathfactory.com https://rgsharedweb.s3.amazonaws.com https://www.googletagmanager.com/debug/ https://ka-p.fontawesome.com https://platform.twitter.com https://*.twimg.com https://*.typekit.net https://*.disquscdn.com https://www.gartner.com https://*.googleapis.com https://optimize.google.com https://tagmanager.google.com https://maxcdn.bootstrapcdn.com https://app.cdn.lookbookhq.com; frame-src 'self' https://logrhythm.widget.insent.ai https://demostack.app https://*.trustarc.com https://*.doubleclick.net https://shortpixel.com https://logrhythm.com https://*.logrhythm.com https://forms.office.com https://jobs.jobvite.com https://play.vidyard.com https://www.facebook.com https://*.elementor.com https://www.itcentralstation.com https://www.google.com https://tpc.googlesyndication.com https://*.twitter.com https://*.addthis.com https://*.ampproject.net https://www.slideshare.net https://*.hotjar.com https://maps.google.com https://www.gartner.com https://tags.bluekai.com https://www.g2.com https://www.youtube-nocookie.com https://googleads.g.doubleclick.net https://disqus.com https://tempest.services.disqus.com https://www.youtube.com https://bid.g.doubleclick.net https://www.brighttalk.com https://*.fls.doubleclick.net; frame-ancestors 'self' explore.logrhythm.com https://www.g2.com https://*.logrhythm.com;
cf-cache-status: HIT
age: 19495
cf-polished: origFmt=gif, origSize=194118
content-disposition: inline; filename="Assisted-Search-e1707342409724.webp"
alt-svc: h3=":443"; ma=86400
content-length: 105116
x-xss-protection: 1; mode=block
referrer-policy: same-origin
cf-bgj: imgq:100,h2pri
last-modified: Wed, 07 Feb 2024 21:46:49 GMT
server: cloudflare
etag: "65c3fa49-2f646"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self "https://play.vidyard.com" "https://www.youtube.com"),payment=(),browsing-topics=()
accept-ranges: bytes
cf-ray: 86f22e187ad6f154-CDG

GET
H2 200 dfe98c76-3bed-47df-bc11-5d810c3eae6f.woff
cdn.pathfactory.com/assets/2/fonts/ 12 KB
12 KB 556ms
439ms Font
application/font-woff 13.35.58.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pathfactory.com/assets/2/fonts/dfe98c76-3bed-47df-bc11-5d810c3eae6f.woff
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-60.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f17b34967f2a8340b97c005e7cdf6d81cdee3452389fc414121a66a0d4da955d

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:34 GMT
via: 1.1 a097fc75e5eca387ecd3618341d82f1a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P10
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
content-length: 12232
last-modified: Wed, 23 Feb 2022 18:33:22 GMT
server: AmazonS3
etag: "2d285e5f96bf9bb740d13b435f8a88b7"
access-control-max-age: 3000
access-control-allow-methods: GET, PUT, HEAD
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=60, must-revalidate
vary: Accept-Encoding,Origin
accept-ranges: bytes
x-amz-cf-id: 0iaDcdXc0gtjgq-M90l6Vel2XtCwToMp7_limYRus0KV2E05pWCdbg==

GET
H2 200 ef617c92-5ed3-4437-a74e-6938ccdefd37.woff
cdn.pathfactory.com/assets/2/fonts/ 14 KB
14 KB 542ms
426ms Font
application/font-woff 13.35.58.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pathfactory.com/assets/2/fonts/ef617c92-5ed3-4437-a74e-6938ccdefd37.woff
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-60.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0a65fa0f698c66851e1ecb3d5e2616d70c9659da7fa794cfbf7a544a19785496

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:34 GMT
via: 1.1 a097fc75e5eca387ecd3618341d82f1a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P10
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
content-length: 14228
last-modified: Wed, 23 Feb 2022 18:41:41 GMT
server: AmazonS3
etag: "f3ee3565b3e2894bcc36097c95034fa2"
access-control-max-age: 3000
access-control-allow-methods: GET, PUT, HEAD
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=60, must-revalidate
vary: Accept-Encoding,Origin
accept-ranges: bytes
x-amz-cf-id: b4DSRcxZFrkMLVg3dtHsa19jvjGSxwW5jpYg1aRjQKCH3byCJWx4VQ==

GET
H2 200 fontawesome-webfont.woff2
cdn-app.pathfactory.com/web-fonts/font-awesome/ 69 KB
70 KB 26ms
26ms Font
binary/octet-stream 13.32.99.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-app.pathfactory.com/web-fonts/font-awesome/fontawesome-webfont.woff2?v=4.6.1
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/web-fonts/font-awesome/font-awesome.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.82 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-82.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://cdn-app.pathfactory.com/web-fonts/font-awesome/font-awesome.min.css
Origin: https://logrhythm.com
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: null
date: Thu, 04 Apr 2024 08:00:46 GMT
via: 1.1 3296b04068551f925d5fafd1b785ff30.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
age: 25308
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 70728
last-modified: Mon, 27 Mar 2023 14:54:50 GMT
server: AmazonS3
etag: "926c93d201fe51c8f351e858468980c3"
access-control-max-age: 3000
access-control-allow-methods: GET, PUT, HEAD
content-type: binary/octet-stream
access-control-allow-origin: *
vary: Accept-Encoding,Origin
accept-ranges: bytes
x-amz-cf-id: beo9_3ycl5WZtx8GZU8Rc1D3wMBrJDLch2OXmXWvv1nnrNb7fy3GVg==

POST
H/1.1 200
OK tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ 2 B
458 B 100ms
99ms Ping
text/plain 54.152.183.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/libraries/tracker/3.19.0/sp.lite.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.183.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-183-68.compute-1.amazonaws.com
Software: akka-http/10.0.9 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

Date: Thu, 04 Apr 2024 15:02:33 GMT
Server: akka-http/10.0.9
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Access-Control-Allow-Origin: https://logrhythm.com
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 2

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
483 B 215ms
214ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05750b0314b98f84ad20a6fe422744a5&svisitor=null&visitor=34ba9420-3a1f-47d9-8194-c57863f96c5e&session=6f5d4029-3952-444e-83a5-dc3089da20e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2004%20Apr%202024%2015%3A02%3A33%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2004%20Apr%202024%2015%3A02%3A32%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223006%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Page%20not%20found%20%7C%20LogRhythm%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&pageViewId=30056d17-787b-49e9-882c-03fd34b6d651&webTagId=8fa18974-bc57-4d14-96b9-689a8c29b32c&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:33 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

OPTIONS
H/1.1 200
OK tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ Frame 0
0 95ms
94ms Preflight 54.152.183.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.183.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-183-68.compute-1.amazonaws.com
Software: akka-http/10.0.9 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://logrhythm.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Origin: https://logrhythm.com
Access-Control-Max-Age: 5
Connection: keep-alive
Content-Length: 0
Date: Thu, 04 Apr 2024 15:02:34 GMT
Server: akka-http/10.0.9

OPTIONS
H/1.1 200
OK tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ Frame 0
0 189ms
94ms Preflight 54.152.183.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.183.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-183-68.compute-1.amazonaws.com
Software: akka-http/10.0.9 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://logrhythm.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Origin: https://logrhythm.com
Access-Control-Max-Age: 5
Connection: keep-alive
Content-Length: 0
Date: Thu, 04 Apr 2024 15:02:34 GMT
Server: akka-http/10.0.9

POST
H/1.1 200
OK tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ 2 B
458 B 100ms
100ms Ping
text/plain 54.152.183.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/libraries/tracker/3.19.0/sp.lite.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.183.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-183-68.compute-1.amazonaws.com
Software: akka-http/10.0.9 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

Date: Thu, 04 Apr 2024 15:02:34 GMT
Server: akka-http/10.0.9
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Access-Control-Allow-Origin: https://logrhythm.com
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 2

POST
H/1.1 200
OK tp2
spcollector.pathfactory.com/com.snowplowanalytics.snowplow/ 2 B
458 B 106ms
99ms Ping
text/plain 54.152.183.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://spcollector.pathfactory.com/com.snowplowanalytics.snowplow/tp2
Requested by: Host: cdn-app.pathfactory.com
URL: https://cdn-app.pathfactory.com/libraries/tracker/3.19.0/sp.lite.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.183.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-183-68.compute-1.amazonaws.com
Software: akka-http/10.0.9 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

Date: Thu, 04 Apr 2024 15:02:34 GMT
Server: akka-http/10.0.9
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Access-Control-Allow-Origin: https://logrhythm.com
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 2

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
483 B 213ms
213ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05750b0314b98f84ad20a6fe422744a5&svisitor=null&visitor=34ba9420-3a1f-47d9-8194-c57863f96c5e&session=6f5d4029-3952-444e-83a5-dc3089da20e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2004%20Apr%202024%2015%3A02%3A34%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2004%20Apr%202024%2015%3A02%3A33%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224007%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Page%20not%20found%20%7C%20LogRhythm%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&pageViewId=30056d17-787b-49e9-882c-03fd34b6d651&webTagId=8fa18974-bc57-4d14-96b9-689a8c29b32c&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:34 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
483 B 273ms
273ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=05750b0314b98f84ad20a6fe422744a5&svisitor=null&visitor=34ba9420-3a1f-47d9-8194-c57863f96c5e&session=6f5d4029-3952-444e-83a5-dc3089da20e9&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2004%20Apr%202024%2015%3A02%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2004%20Apr%202024%2015%3A02%3A34%20GMT%22%2C%22timeSpent%22%3A%221008%22%2C%22totalTimeSpent%22%3A%225015%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Page%20not%20found%20%7C%20LogRhythm%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&pageViewId=30056d17-787b-49e9-882c-03fd34b6d651&webTagId=8fa18974-bc57-4d14-96b9-689a8c29b32c&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Apr 2024 15:02:35 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
45 B 23ms
23ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-1FE13FG8WE&gtm=45je4410v867738930z8830930082za200&_p=1712242948635&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1949584526.1712242949&ul=en-us&sr=800x600&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.105%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.105&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=2&sid=1712242949&sct=1&seg=0&dl=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdeep-dive-into-plugx-malware%2F%27%2F&dt=Page%20not%20found%20%7C%20LogRhythm&tfd=8577
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-1FE13FG8WE&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://logrhythm.com/
accept-language: fr-FR,fr;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 04 Apr 2024 15:02:35 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://logrhythm.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

114 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

22 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.logrhythm.com/	1970-01-20 19:37:24	Name: __cf_bm Value: 88fDy9ZL7NuPJHsRtwHzwEHIOBiBJOrzZOJ4WXvhqSQ-1712242947-1.0.1.1-mV2rke7pS3zcu2OV48jBZhL_DaH4m8dEQC18fRUTfooOrQXtxG4fkDGoIp6AWTTi1jJ7EUO8hYsqSjxyabVUrA
.ecrm.logrhythm.com/	1970-01-20 19:37:24	Name: __cf_bm Value: MNd1gAwrDKN8nIZx6tvJN9yyHLI4MoqHU9RwACYbnDQ-1712242948-1.0.1.1-6cwOc7FVnc4ABHsnKh.ehqNmePJWiNnTkaha2tkdbbeulAkC3lb2lQGv4mm2gapH_6EQA6pczZYVOCmnUitfpA
.logrhythm.com/	1970-01-20 21:46:58	Name: _gcl_au Value: 1.1.324352499.1712242949
.logrhythm.com/	1970-01-21 05:13:22	Name: _ga Value: GA1.1.1949584526.1712242949
.logrhythm.com/	1970-01-21 05:13:22	Name: _mkto_trk Value: id:050-UWT-888&token:_mch-logrhythm.com-1712242949744-46899
.logrhythm.com/	1970-01-20 21:46:58	Name: _fbp Value: fb.1.1712242949932.334287589
.logrhythm.com/	1970-01-21 04:22:58	Name: _hjSessionUser_1803640 Value: eyJpZCI6IjI3NmIxYzFiLWU0M2YtNWYzYi04NDU4LWYxMzEwMDc5NWEwNSIsImNyZWF0ZWQiOjE3MTIyNDI5NTAwNjMsImV4aXN0aW5nIjpmYWxzZX0=
.logrhythm.com/	1970-01-20 19:37:24	Name: _hjSession_1803640 Value: eyJpZCI6Ijg4M2E1MDE0LWZjZWUtNDVkNy05NTZmLWZhOWZlMWY3MGNjYiIsImMiOjE3MTIyNDI5NTAwNjQsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
.linkedin.com/	1970-01-20 21:46:58	Name: li_sugr Value: 050387b5-8b23-452c-a3bd-5dc438c5bfae
.linkedin.com/	1970-01-21 04:22:58	Name: bcookie Value: "v=2&43562ce2-87ad-41e9-8aa0-0519fe9a1dca"
.linkedin.com/	1970-01-20 19:38:49	Name: lidc Value: "b=OGST05:s=O:r=O:a=O:p=O:g=3021:u=1:x=1:i=1712242950:t=1712329350:v=2:sig=AQEfZgkWz8fgeATcPj4R97pNl-w2jeeo"
logrhythm.com/	1970-01-21 05:13:22	Name: _gd_visitor Value: 34ba9420-3a1f-47d9-8194-c57863f96c5e
logrhythm.com/	1970-01-20 19:37:37	Name: _gd_session Value: 6f5d4029-3952-444e-83a5-dc3089da20e9
.linkedin.com/	1970-01-20 23:56:34	Name: li_gc Value: MTswOzE3MTIyNDI5NTA7MjswMjFuMAzgVSSzUxHu27qtvZwlRDgBSbc6bBrE2fN116SuBg==
.logrhythm.com/	1970-01-20 19:37:24	Name: vid Value: 6313f79a-6a47-4b47-ac09-51f90b337ec1
.logrhythm.com/	1970-01-20 19:37:24	Name: _pf_ses.8844 Value: *
.logrhythm.com/	1970-01-21 05:13:22	Name: _ga_1FE13FG8WE Value: GS1.1.1712242949.1.0.1712242950.59.0.0
.6sc.co/	1970-01-21 05:13:22	Name: 6suuid Value: b46411029ea9000006c10e666a0200006bb5a700
.logrhythm.com/	1970-01-21 04:22:58	Name: _zitok Value: 5325e63a5c5f9d241f3a1712242950
.zoominfo.com/	1970-01-20 19:37:24	Name: __cf_bm Value: iGnx6Rut2jIOXajaHLsMD3cJt8G3D6I6tNa8OjyLeqM-1712242950-1.0.1.1-iox_QpioJRcHDTQNH2E.jjcludXvxs6kTA5cv2wqVVgNRm3C9IelcJWc8JCuWWmyo1rCR_20lUXJMR756LMTkg
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: KfwqPrhwmCiNYvooofwTZYqKVar9aTCCHWB0J.DZOEM-1712242950771-0.0.1.1-604800000
.logrhythm.com/	1970-01-20 19:37:24	Name: _pf_id.8844 Value: 6313f79a-6a47-4b47-ac09-51f90b337ec1.1712242950.1.1712242954..557313a2-50e1-4e61-8566-8a0b1adff2e6..1e7ccf52-97a0-47be-875c-c66692abf381.1712242950487.5

42 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Failed to load resource: the server responded with a status of 404 ()
deprecation	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/(Line 1610) Message: Listener added for a synchronous 'DOMNodeInserted' DOM Mutation Event. This event type is deprecated (https://w3c.github.io/uievents/#legacy-event-types) and work is underway to remove it from this browser. Usage of this event listener will cause performance issues today, and represents a risk of future incompatibility. Consider using MutationObserver instead.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/232919347190734?v=2.9.151&r=stable&domain=logrhythm.com&hme=8ce74e881727851b4427183947937854816d72704925561b9de6420cd43214ee&ex_m=66%2C111%2C98%2C102%2C57%2C3%2C92%2C65%2C15%2C90%2C83%2C48%2C50%2C157%2C160%2C171%2C167%2C168%2C170%2C28%2C93%2C49%2C72%2C169%2C152%2C155%2C164%2C165%2C172%2C120%2C14%2C47%2C176%2C175%2C122%2C17%2C32%2C36%2C1%2C40%2C61%2C62%2C63%2C67%2C87%2C16%2C13%2C89%2C86%2C85%2C99%2C101%2C35%2C100%2C29%2C25%2C153%2C156%2C129%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C53%2C58%2C60%2C70%2C94%2C26%2C71%2C8%2C7%2C75%2C45%2C20%2C96%2C95%2C9%2C19%2C18%2C77%2C82%2C44%2C43%2C81%2C37%2C39%2C80%2C52%2C78%2C31%2C41%2C34%2C69%2C0%2C88%2C4%2C84%2C76%2C79%2C2%2C33%2C59%2C38%2C97%2C42%2C74%2C64%2C103%2C56%2C55%2C30%2C91%2C54%2C51%2C46%2C73%2C68%2C23%2C104(Line 107) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://logrhythm.com/blog/deep-dive-into-plugx-malware/'/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

050-uwt-888.mktoresp.com
b.6sc.co
c.6sc.co
cdn-app.pathfactory.com
cdn.pathfactory.com
connect.facebook.net
consent.trustarc.com
ecrm.logrhythm.com
epsilon.6sense.com
ipv6.6sc.co
j.6sc.co
js.zi-scripts.com
jukebox.pathfactory.com
ka-p.fontawesome.com
kit.fontawesome.com
logrhythm-com.disqus.com
logrhythm.com
logrhythm.widget.insent.ai
munchkin.marketo.net
p.typekit.net
play.vidyard.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
script.hotjar.com
snap.licdn.com
spcollector.pathfactory.com
static.hotjar.com
stats.g.doubleclick.net
use.typekit.net
ws-assets.zoominfo.com
ws.zoominfo.com
www.facebook.com
www.google.fr
www.googletagmanager.com
104.16.136.15
104.16.137.15
104.17.71.206
13.107.42.14
13.225.78.57
13.32.27.19
13.32.99.82
13.35.58.60
141.193.213.20
151.101.65.181
172.217.23.99
172.64.150.44
18.66.102.11
192.28.144.124
199.232.196.134
2.17.100.184
2001:4860:4802:32::36
2600:9000:225e:4000:f:7ae2:7780:93a1
2600:9000:225e:7400:f:7ae2:7780:93a1
2606:4700:4400::ac40:93bc
2620:1ec:21::14
2a00:1450:4001:81d::2008
2a00:1450:400c:c00::9c
2a02:26f0:3500:16::215:148b
2a02:26f0:3500:16::215:1495
2a02:26f0:ab00::214:8e70
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f177:83:face:b00c:0:25de
52.55.132.161
54.152.183.68
76.223.9.105
88.221.60.75
00952715c953d7e8a330645295c52002b898c5d06c8f75e389c611f9b5d7968d
01a3066991f4af85d35aaa0068aa00054f9762f39c263853f49518d5f9784c4b
027028ff278f79b04e37b1407454486b09f08686b56dab1874f3a712f176be4b
047e3259b6f0b42d781532fa122b2d8de9aed187d766fd45efcf119450eeb4c4
0511e3b9b89c685aa01a48d5fbed7a2090fee19eff9a2f9dd6e83346c2a942a0
05ff91703fa482062b851d83b00e7663ef9d2001e01eaa126430e417d8e28aaa
07c94892c3e0ac93d2bcb3a9cb88aa67ea47b3d1aa89bc39dfcc2b025dcd8988
0813cfd37a8ebb9491332da173a746ebcb365a7bad3876e81d045067d602ad49
092178659031117c2562f8ada3b553117505d2023a586c2a4ccda173e79ce2fe
0927046a7f82a1f6e6e48d1115be04d8e053922775f03d0fdecef3b60e92f8cb
0a65fa0f698c66851e1ecb3d5e2616d70c9659da7fa794cfbf7a544a19785496
0b47c6f613bff41662a4af43e11dd7a291ad7a1fbb2346cbcf6260fc2895c911
0c3c7a8ded7af0a5f0a5d96af811f343396391197f6986269715c5dd0360974b
0eceb9be92f0ec6a1b69ebafa0bdb6bd72506565259ca6c4574185e7336d0f04
10599ffc37dd3ff57db5d5a984854c3beecfdbd271e8fa1d7321127e84d93edb
1120606d70171f70f1c92b702798a10dedacf4e5a3efd3b7cb7a649f524b50d2
11c7cade4c0b009392f70528471d8df3f30fa91e779bee8560e0bdf444e85f11
14b6cfd9b2a41bf5ee498086b1fbe2e8a31b1f99d5e040d55bdbe2d95702b6ac
1580a6a19cb081a84215f13b42f765469beb87d7401f16349760cd067fc4da71
1620e9d6662aef6d6a1ab50e5da925e90496f35bf7ad2d677d9d69024412cab9
17b79ece7ef9d1454a90156690d33d64387b67a7a7548fc826012512e287a937
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
1d52e1ac7d3bc25a8b0ffc257153f9dd50249f96fe9a4df5e0d771241a69062c
1f3387f11826be4923a2d3a8c1542780abd6d4c66ce13f2de770f2e386989593
20a8c186d91ae6cd8884f222715a646e9036cb5d5d9f8dffaad46b9ab8bb2357
210e7b0ef79bf720dbad0e173560f40cd213dc5ed5289a596c89ddf7f8953328
214674cc77aba35ab3567b88e2739fd08e8e96c61d279559ad61874069683ea0
21d7111b0f0275b69b74a7232d180a34e2fcbadcea597461a7021d470f32d4b5
24f49003f27bd9468f359e8a1c42d9583f5444aa6695589d055ace9fe2898290
25462e537585513efd706d55cf4cd890b30f382ab96c0f6df75c41c1095d58ed
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
261e44bd5998183c1bde239149a4be112fd5afd76c1efb12da82f24cf20561d4
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
28abab0e81dceebab466c855e82b8cfc06f9e138ff78fb45ae102a6a36be0e5d
28f45baa7e4b94b425dbcc229217e259919bf12cfd487a52a27cec644f867a38
2cb546fbdda7995d374fffa4b2f6530bbcf57d014639ddf76de45df43d593045
2df44dc69064c7fa71246e486d2a28877def46caa33ada1a981a8abd7686d072
2f7795d2dff17bfa96b1cfe74a14b41faf5771ac70280e2273e909619e6891ea
30e56b8ea8620ad4338d19c01c39c349bd2e614716adff78dec000cbab05158d
316a940e4c553c8e577e39b1407f182c4357ffd2302d417205830eb8771c1ea5
32aff668ae2ddb3f574c99a4226616fc300ba48b3242c6caf150c897a1067c9b
345a7f619e726c9ed21fa1e83646623f3491056eb1c9e0f3af797c42d38255c1
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
3669e4e19966fceb84125c59bf2307cb0aeb70322eff9d99b60221f9f2061366
371ac7364bb3c4027bb2b61fce7cfb60811d7828ca37a6b2edb4690a6e29db6e
3728afa1bf40c8ef2f820860a415da47f6bf118c1ccd856fd96926bc932a612a
3958bbc7553eabc186e70362b1811202089f82ef0745060e41eeb654baaea865
3996e887606cc7f8255105a17d18dfebd26a71cf2ab42a06b45be95f4344fa71
3cc3108c864da12cea8db6a598d888e8073e1add0c16d6bf6208813ca4487344
3d205f7b2d00ed61623313b550488d6828cd20d7d02b5fcd212c462f649e1ba7
3e292f4b6d81003d9d2ac3ceb89881936a670f8f595f7dd65d2517e01864c108
3e98aa3a6f9d1ead471762bca99dd9b967fa820667d3d240da3a56df763b176c
4484d34c365c7b511ab064293e5fa96f4c514ebcd5ab883f6dd3607745932cab
476a0ab42c2fa7b55dfa263b611184887029a66019109d4fc95e04e5a01de9d3
4dc642fc85c8ca2023e485d6bc9b6e9a74f9e169080830db40c37e87eff8d3a3
4efd6ac6efe7860c8db3d414ff2302db7c424675da9d6664631a307ce3d171a7
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
516640faeb856df6599d165f26ee51ce8cbaaf34f7c09d818509e75f6a48ae13
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
52dc24c0429ea6ccc5b579a6da8bb79bf41e471fe5108a62009f3c2e195551c0
54332f1e6cf0aa349c504422f066ea1c1ee5d3152ebc96944cdafe72961dcd0d
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5757a4c7172efe71ca15fab282fc65180c699d488593e87ac4ab7a14394f5492
5b0098c9bbf5cd5db128fb4dec0725ffd0f855be5763733e1d4eae5884555455
5c7a9c0438ba5908e5c3186077746f896f7a8c294d2dbee9bf8f3273c6073289
5da9e14a57fbd8266e373008d5a9362c47a19eb62a85a01a37458d81a94146c1
609b117eff6ecd097423cf9ec63c011933d6de31679ae775253fa687022656dd
6118483790500003534e0223288af8644706fa1eb0208e4600106d21378ee5d3
642143132bbcd9265bb1ac9e9d5279a6d8d5d9bba51a6cd6b597be5f9dfc1272
66c5073bb5b13ec03106e31457b230eef5fc1698d24536a61ff5a5f4313269de
67614828cf3f7a0f61ee5dc0f9a6212d44c8f98e8a9da03327d13beaf3a61fc1
67ac597bed179b5842d996fad80472c6b9514edde408ade8b892161bcf9e9c88
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6971d61d8115453aec57ea622ef3a2b023b53996e7399b0cd899cd830191e3a5
70f3cc852c9c3849b93ab403bff853542df94d4421891b4f50aeacb24f9aeeef
726cdb991294913fa2541fe5fa763a8725c3cb3f5c878b56da38559fbfb9bc92
7742bb16ac54dbccd2a9df6edc159ff921e1e738f08dc0d4b4b9f31424ede919
7ce23bb169d56e3dc218181172c5d318dc16526e035b539e038f605a893ea551
7e0e4786c83cc6a249c49fc95d74cb37736c9c2c625fdf901b7c155381ef62f2
81acd87c922461dd8b07a53c907dc098d67358f212a52de422d7ee74680fd36a
842b5d6ed9e5e4ac166eb55615b55da7366a235b19af87375f70c74afabd769a
84e51490bf098d4ab164444efab69b0019350238365b18ce3328701837d258f1
85a881fba590ac097d83e7d5397c82c99d9538ac482af8f10a3e5886393cfc85
86a39f8f7c27fffe3741168347f048845ad03a5ee939e8711054214abf46c6c1
8c1781ec4483c6fb3bd9ad005d312800eaf24e232c12976624bff84f8ab908b3
8c9dad6cf1c9d851ad8ecc7e93ce7314b1af655d2eafa1d73f7840f08139c9fe
8f3778819f0379ff33a687f9ae7dab7cbdf28739873126bfb981d4d682a09a92
9234cd0a490631fdad33bc295edc8b3c0ed8860173eb84f6264c826a4d8c7a70
92c47bb40457e52a10831e40bb00cd7d544dbbcbfc0b401328fbdabe45562d36
9928340ab66ea3b57ea2649c3ebb0d6f28fcc0ccc2adf47a623316bdedf12250
9a0efa3ca63814f5db50b2c51b71425660a062236f53af3c2f5c6eb820fffdd3
9c8535a1c5d37f5645aa956bd6a8ca9114c57fdfcdbc60dbebf6c969430aaffc
9d48642a7d382750c6727fe5bbe28824820be9cf4e578c3aa77a1a12f62a0db5
9fc308738978262c5dfffa90d2672638bb659a2dd20046e1be6db387d6dd3fe2
a3e647bd139028a8b14cd0c42545d61fe316a4a42436a5602b44df99d8d416f3
a48d01207db36011a52ba50f8fdbef2c589fc97692a7f5c93d182f846dc77164
a7951d76e2e255a3c209df151a549124e93fa2a0119c458cb3ff478bf8c77c8d
a7a5aa60ddbd44255fd0d27f1d3addb496e8fedeaebbcc0ca5138ba1c0825e16
a87fcabee27652552d5eb2fc3cb61d2fa44408ea6ad7033598775f591236c290
ac8941daec8b1c75b6345ab83858bfc13d9c485d4aacdea52ecf759c34c92f6a
ae77448c16c7a363aa7d7d319222a31c749733042e39c0f5176b1cce3ac03e0f
af04f015df3bbffd125ee30eaf78e7f1c9328f5b967d66f7b7f8958472464dda
b060b43ee8aa1a1a7d17f98215f3d920d4b8b48f1af0fdc392119b11de47b36e
b1b33627d7bddf9d93dcf1e913bb6e53d97a99c5a7fc30f9aab824bf74707b35
b37ebd2524191bf943476446276026a92083fe5bc43571eec11855c3872bd1af
b4316fef0d97341a9bc4b4d20acb7be949930cbfb0d83fe4803b613c7362deac
b9649e0e9e5790f8d6b5e69aa4ff9969e8f7d72a84f8501ff9379078005124d8
bcb5f560d1e3cad97d06c8de11436a61281805d88484efea79b4c809a58ae49a
bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6
be557052880037a1c160050458fc687e95a193799d58686f0e2eefc8b39f4f42
be5e0ff30fa3977ca82d6c2815bca77d5ad7b4e991136fd8f9fe3920fa49451f
c0e96c0f51eb10934d2022f7d30dbeaf05f748f85d32dfe71711f2dbb21621d8
c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4
c2e434da01fbfefa93d8105f23bbf9896470169def9352753c2c838388db99e0
c57e64fcb72bddafa9c38de574441c3e69ac6c961df96b0cad34da83658bd196
c8fc34d2947a230d4fe54344e4e873e9871f2cfe7eec5473e68568e3d79843f1
c99f726f2a86c98e77f5f081280ff5e78252dbc6d6576828e5fde6c62a3051ed
c9c6a140224ac9996dd7e0bf8f95c03e1f6f643a83f83150fa5dd6a79f3a600b
ca7dce2391845e8aec7da135f33fabd10f74eed28a532ac66fd01f761fcfb42f
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e
cf3b5824bacaaa2d01631580b0efc58f587fa1c4deb5dd9024f85752038e23d6
cf83b55e773ca3b13936e113b661b5a2bfed6db14527a259bbfccf3c08e85ff6
d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d
d4185c058b3d6dd6c7735a174389257dbf280747eefcc62551e95d0f3f255eef
d4632d8a74284c2f9ae23b9ed84c8923c92a021a597a3cad10abe393d0c67f18
d6f195ea5d2876a07748b4cae489f6493b04ceda209bc3dc3163e51101c17a98
dc33235e59e1fc8b5ae9061ed6b90bf02b917023f552e5638ad0b3f6d2ecece1
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
ddb559b74d08fe2efe619713d282a87961d05fc64e12a477935a480c2382a90c
df55df709530226ae937083e9a5d37721597e1486ba032da9c8a769bdd277f31
e0127ebe9681ce89b2ce6de5293e1f064c0e6447b803a1cff70e3d447242e68b
e0688ce88275ad7c4f3035ceae4033f11020cae4c218d0396ccd1be3d503a2bc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e492e5bd630a86a679a9ead911fc5e1e155d75098344c375131c40470e97396d
e92fb6dc00e3c04e1f9af5a1554a33e2b3f2b1d7f9a9266066863a932437f0b9
e96db31cc7e95572d164dbe651b6742f14f010f71dd813c6600c086e5a618952
e9a502929c5dd3ddd472b4124271a27e6342ee3f71099482a29d1da9b0c23d4b
eaff775ad40803675c3df967fd79d70cfe3cca7b691c0c7a5e03bfdc0b2850ff
ec7839f109ee0d8025aa46fc9165cfc9ac1e52674c0fc00a675210481c6e90db
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0cfe5bb3632a93b092412b0fcfc4072ea3a7aec330b6140344c1c68d5f82575
f149ef6a160ed59e62813d87501de1afdc95f2b545bce8ba5431eeca219190e0
f17b34967f2a8340b97c005e7cdf6d81cdee3452389fc414121a66a0d4da955d
f313d12ea6124bd28fc4a6b7163d253bb83d5aeab5edce594880c5c3df475cbc
fa8204005ed25e30f3ee56dbad3afa3c011e12636e75decf2b1aaf22a1c326dd
faf47e501cdae61064aed4b03b1129d37c6e004ebde6f6452f1632f835c9f318
fe04371e99bc3a1cd9669a16fc95bdff81ded468cd7e14dad38669817130c27b
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe657f5d2a124b86736a3be9a517df190a31c2dd14620edc2cb56f0c263e7e86

logrhythm.com Open in urlscan Pro 141.193.213.20 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

168 Requests

99 %HTTPS

38 %IPv6

23 Domains

35 Subdomains

33 IPs

4 Countries

3516 kBTransfer

8609 kBSize

22 Cookies

24 Outgoing links

Page URL History

Redirected requests

168 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 15 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

logrhythm.com Open in urlscan Pro
141.193.213.20 Public Scan

Screenshot
Live screenshot

Full Image

168
Requests

99 %
HTTPS

38 %
IPv6

23
Domains

35
Subdomains

33
IPs

4
Countries

3516 kB
Transfer

8609 kB
Size

22
Cookies

168 HTTP transactions
15 data transactions