attacksimulator.com Open in urlscan Pro
94.130.135.206 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://attacksimulator.com/blog/new-android-malware-tanglebot/
Submission: On October 01 via api (October 1st 2021, 5:27:20 am UTC) from GB — Scanned from DE

Summary HTTP 102 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 24 IPs in 4 countries across 19 domains to perform 102 HTTP transactions. The main IP is 94.130.135.206, located in Germany and belongs to HETZNER-AS, DE. The main domain is attacksimulator.com.
TLS certificate: Issued by R3 on August 12th 2021. Valid for: 3 months.

This is the only time attacksimulator.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
48	94.130.135.206 94.130.135.206	24940 (HETZNER-AS) (HETZNER-AS)
12	192.0.77.37 192.0.77.37	2635 (AUTOMATTIC) (AUTOMATTIC)
1	104.18.10.207 104.18.10.207	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	142.250.184.200 142.250.184.200	15169 (GOOGLE) (GOOGLE)
4	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
1	104.17.210.204 104.17.210.204	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	142.250.185.132 142.250.185.132	15169 (GOOGLE) (GOOGLE)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
2	104.212.67.157 104.212.67.157	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	104.17.145.91 104.17.145.91	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	172.217.23.99 172.217.23.99	15169 (GOOGLE) (GOOGLE)
1	104.17.128.171 104.17.128.171	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.21.191 104.18.21.191	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.71.176 104.17.71.176	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.231.204 104.17.231.204	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	52.142.114.2 52.142.114.2	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	13.107.21.200 13.107.21.200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	142.250.184.238 142.250.184.238	15169 (GOOGLE) (GOOGLE)
4	104.19.154.83 104.19.154.83	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	54.162.17.5 54.162.17.5	14618 (AMAZON-AES) (AMAZON-AES)
2	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
2	40.76.174.66 40.76.174.66	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	104.16.88.5 104.16.88.5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.244.204 104.17.244.204	13335 (CLOUDFLAR...) (CLOUDFLARENET)
102	24

48 94.130.135.206 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: catalogo-online.com

attacksimulator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 192.0.77.37 (United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

c0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.10.207 (None, )

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.200 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.0.77.2 (United States)

ASN2635 (AUTOMATTIC, US)
PTR: i2.wp.com

i1.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i2.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.210.204 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.185.132 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.212.67.157 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
PTR: muc30r3.msedge.net

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.145.91 (None, )

ASN13335 (CLOUDFLARENET, US)

diffuser-cdn.app-us1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
prism.app-us1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.23.99 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f99.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.128.171 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.21.191 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.71.176 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.231.204 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.142.114.2 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.21.200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.184.238 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.19.154.83 (None, )

ASN13335 (CLOUDFLARENET, US)

forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.162.17.5 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-162-17-5.compute-1.amazonaws.com

trackcmp.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 40.76.174.66 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

d.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.88.5 (None, )

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.244.204 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn2.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
48	attacksimulator.com attacksimulator.com	655 KB
18	wp.com c0.wp.com i1.wp.com stats.wp.com i2.wp.com pixel.wp.com	672 KB
6	gstatic.com www.gstatic.com fonts.gstatic.com	329 KB
6	clarity.ms 1 redirects www.clarity.ms c.clarity.ms d.clarity.ms	25 KB
4	hubspot.com forms.hubspot.com track.hubspot.com	5 KB
4	google-analytics.com www.google-analytics.com	20 KB
4	google.com www.google.com	37 KB
2	app-us1.com diffuser-cdn.app-us1.com prism.app-us1.com	6 KB
2	googletagmanager.com www.googletagmanager.com	88 KB
1	hubspot.net cdn2.hubspot.net	6 KB
1	hsforms.com forms.hsforms.com	519 B
1	trackcmp.net trackcmp.net	271 B
1	bing.com 1 redirects c.bing.com	439 B
1	hsleadflows.net js.hsleadflows.net	87 KB
1	hs-analytics.net js.hs-analytics.net	20 KB
1	hs-banner.com js.hs-banner.com	16 KB
1	hscollectedforms.net js.hscollectedforms.net	26 KB
1	hs-scripts.com js.hs-scripts.com	975 B
1	bootstrapcdn.com stackpath.bootstrapcdn.com	7 KB
102	19

	Domain	Requested by
48	attacksimulator.com	attacksimulator.com
12	c0.wp.com	attacksimulator.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
4	www.gstatic.com	www.google.com www.gstatic.com
4	www.google.com	attacksimulator.com www.gstatic.com www.google.com
3	i2.wp.com	attacksimulator.com
2	track.hubspot.com
2	d.clarity.ms	www.clarity.ms
2	fonts.gstatic.com	www.google.com
2	forms.hubspot.com	js.hscollectedforms.net js.hsleadflows.net
2	c.clarity.ms	1 redirects attacksimulator.com
2	www.clarity.ms	attacksimulator.com www.clarity.ms
2	www.googletagmanager.com	attacksimulator.com www.googletagmanager.com
1	cdn2.hubspot.net
1	forms.hsforms.com	attacksimulator.com
1	trackcmp.net	diffuser-cdn.app-us1.com
1	prism.app-us1.com	diffuser-cdn.app-us1.com
1	c.bing.com	1 redirects
1	js.hsleadflows.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hscollectedforms.net	js.hs-scripts.com
1	pixel.wp.com	attacksimulator.com
1	diffuser-cdn.app-us1.com	attacksimulator.com
1	stats.wp.com	attacksimulator.com
1	js.hs-scripts.com	attacksimulator.com
1	i1.wp.com	attacksimulator.com
1	stackpath.bootstrapcdn.com	attacksimulator.com
102	28

This site contains links to these domains. Also see Links.

Domain
www.linkedin.com
www.facebook.com
twitter.com
app.attacksimulator.com
edu.attacksimulator.com
threatpost.com
www.cloudmark.com
www.cbsnews.com
unsplash.com
ats-public.s3.amazonaws.com
support.attacksimulator.com
maps.google.com

Subject Issuer	Validity	Valid
www.attacksimulator.es R3	`2021-08-12` - `2021-11-10`	3 months	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-03-01` - `2022-02-28`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
www.google.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2021-06-01` - `2022-06-01`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
c.msn.com Microsoft Azure TLS Issuing CA 02	`2021-06-27` - `2022-06-22`	a year	crt.sh
*.google.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2021-06-26` - `2022-06-25`	a year	crt.sh
*.trackcmp.net Amazon	`2021-03-02` - `2022-03-31`	a year	crt.sh
a.clarity.ms Microsoft RSA TLS CA 01	`2021-07-27` - `2022-07-27`	a year	crt.sh
hubspot.net Cloudflare Inc ECC CA-3	`2021-06-04` - `2022-06-03`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Frame ID: 3E83AEBF52DE16EDF7961D1EE3B92541
Requests: 95 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcTY6YZAAAAAIaSBP-bbSkwzD8YJqtAs1ALgdaP&co=aHR0cHM6Ly9hdHRhY2tzaW11bGF0b3IuY29tOjQ0Mw..&hl=de&v=-TriQeni1Ls-Mdq_ssN2cUL5&size=invisible&cb=g80bkk97cj38
Frame ID: AEF2BD680B104470A1052317D3DF1A7D
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

New COVID-19 Themed Android Malware Reaches Deep Into Device Functions - ATTACK Simulator

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

102
Requests

100 %
HTTPS

0 %
IPv6

19
Domains

28
Subdomains

24
IPs

4
Countries

2000 kB
Transfer

4669 kB
Size

20
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.linkedin.com/company/attacksimulator
Title: Follow

Search URL Search Domain Scan URL

URL: https://www.facebook.com/attacksimulator
Title: Follow

Search URL Search Domain Scan URL

URL: https://twitter.com/ats_social
Title: Follow

Search URL Search Domain Scan URL

URL: https://app.attacksimulator.com/
Title: Admin Panel

Search URL Search Domain Scan URL

URL: https://edu.attacksimulator.com/
Title: Educational Portal

Search URL Search Domain Scan URL

URL: https://threatpost.com/flubot-spyware-android-devices/165607/
Title: FluBot SMS malware

Search URL Search Domain Scan URL

URL: https://www.cloudmark.com/en/blog/mobile/tanglebot-new-advanced-sms-malware-targets-mobile-users-across-us-and-canada-covid-19
Title: Thursday post

Search URL Search Domain Scan URL

URL: https://threatpost.com/tanglebot-malware-device-functions/174999/
Title: TangleBot Malware Reaches Deep into Android Device Functions

Search URL Search Domain Scan URL

URL: https://www.cbsnews.com/news/tanglebot-android-malware-covid-19/
Title: New malware seizes on COVID-19 to target Android users

Search URL Search Domain Scan URL

URL: https://unsplash.com/@redaquamedia?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText
Title: Denny Müller

Search URL Search Domain Scan URL

URL: https://unsplash.com/s/photos/android?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText
Title: Unsplash

Search URL Search Domain Scan URL

URL: https://ats-public.s3.amazonaws.com/ad-integration-docs/v0/en/Attack%20Simulator%20Active%20Directory%20Integration.pdf
Title: Active Directory Integration

Search URL Search Domain Scan URL

URL: https://support.attacksimulator.com/
Title: Support

Search URL Search Domain Scan URL

URL: http://maps.google.com/?q=Gheorghe%20Doja%20Street,%20no.%2031-33,%20ap.%202,%20Cluj,%20Romania,%20400068
Title: Gheorghe Doja Street, no. 31-33, Cluj, Romania

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 79

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?CtsSyncId=90BAA9B5F63F40DC82E70A8F52D7B1F0&RedC=c.clarity.ms&MXFR=30ED3A638E786BF7210E2AA08A78650C HTTP 302
https://c.clarity.ms/c.gif?CtsSyncId=90BAA9B5F63F40DC82E70A8F52D7B1F0&MUID=285F1645CEA66A4920D50686CFE36BFC

102 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
attacksimulator.com/blog/new-android-malware-tanglebot/ 251 KB
39 KB 1323ms
1286ms Document
text/html 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: c60209be192e782443d96c9e00850e782a136bb89b4d48a72b5d64e0da5496a2

Request headers

Host: attacksimulator.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Fri, 01 Oct 2021 05:27:13 GMT
Server: Apache
Access-Control-Allow-Origin: *
X-Pingback: https://attacksimulator.com/xmlrpc.php
Link: <https://attacksimulator.com/wp-json/>; rel="https://api.w.org/", <https://attacksimulator.com/wp-json/wp/v2/posts/14322>; rel="alternate"; type="application/json", <https://attacksimulator.com/?p=14322>; rel=shortlink
Vary: Accept-Encoding
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Content-Length: 39746
Keep-Alive: timeout=5, max=150
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H2 200 style.min.css
c0.wp.com/c/5.8.1/wp-includes/css/dist/block-library/ 79 KB
10 KB 22ms
6ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.1/wp-includes/css/dist/block-library/style.min.css

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Fri, 01 Oct 2021 05:27:14 GMT
content-encoding: br
last-modified: Wed, 01 Sep 2021 04:05:58 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK style-index.css
attacksimulator.com/wp-content/plugins/activecampaign-subscription-forms/activecampaign-form-block/build/ 70 B
504 B 15ms
15ms Stylesheet
text/css 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/plugins/activecampaign-subscription-forms/activecampaign-form-block/build/style-index.css?ver=1632359907
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 55bd442d45ef481e3f0eb795894dd94f1a5e38f2a4847c2f49371010e1e013c2

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 23 Sep 2021 01:18:27 GMT
Server: Apache
ETag: "46-5cc9f68715557-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=149
Content-Length: 68
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H2 200 mediaelementplayer-legacy.min.css
c0.wp.com/c/5.8.1/wp-includes/js/mediaelement/ 11 KB
2 KB 22ms
7ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.1/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Fri, 01 Oct 2021 05:27:14 GMT
content-encoding: br
last-modified: Tue, 29 Sep 2020 15:53:06 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H2 200 wp-mediaelement.min.css
c0.wp.com/c/5.8.1/wp-includes/js/mediaelement/ 4 KB
1 KB 22ms
7ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.1/wp-includes/js/mediaelement/wp-mediaelement.min.css

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Fri, 01 Oct 2021 05:27:14 GMT
content-encoding: br
last-modified: Fri, 07 Jun 2019 20:45:02 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK style.min.css
attacksimulator.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-list-horizontal/ 869 B
771 B 28ms
12ms Stylesheet
text/css 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-list-horizontal/style.min.css?ver=1
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 9af98e149ed5a7af3bbfe75257ddb5a7d4bc5f0be036822f89b2a1fa809fd21e

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sun, 12 Sep 2021 17:39:21 GMT
Server: Apache
ETag: "365-5cbcfd428a11f-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=148
Content-Length: 333
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK uag-css-14322-1633018485.css
attacksimulator.com/wp-content/uploads/uag-plugin/ 3 KB
1 KB 36ms
12ms Stylesheet
text/css 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/uploads/uag-plugin/uag-css-14322-1633018485.css?ver=1.24.2
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 40cb3fe6821556d72734200c197700f0e75f0ce6aec97e4a66c4f26790f18eda

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 30 Sep 2021 16:14:45 GMT
Server: Apache
ETag: "cf0-5cd38bec1599c-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=150
Content-Length: 756
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK et-divi-dynamic-tb-8191-tb-11231-tb-174-14322-late.css
attacksimulator.com/wp-content/et-cache/14322/ 6 KB
1 KB 35ms
13ms Stylesheet
text/css 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/et-cache/14322/et-divi-dynamic-tb-8191-tb-11231-tb-174-14322-late.css?ver=1632903069
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 7360247aa71631b7a1af89fbd2d2fed41a85faa26e0e825b242857716f8d9e82

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 29 Sep 2021 08:11:09 GMT
Server: Apache
ETag: "176f-5cd1ddf6fb870-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=150
Content-Length: 836
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK et-divi-dynamic-tb-8191-tb-11231-tb-174-14322.css
attacksimulator.com/wp-content/et-cache/14322/ 23 KB
3 KB 37ms
15ms Stylesheet
text/css 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/et-cache/14322/et-divi-dynamic-tb-8191-tb-11231-tb-174-14322.css?ver=1632903069
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 69bf8b1cdd4daea1e6a286efac67b5deeda0ca248327e14ff7cf889607c60665

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 29 Sep 2021 08:11:09 GMT
Server: Apache
ETag: "5afb-5cd1ddf6ad66e-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=150
Content-Length: 2517
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK style.min.css
attacksimulator.com/wp-content/plugins/3it/styles/ 9 KB
2 KB 37ms
14ms Stylesheet
text/css 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/plugins/3it/styles/style.min.css?ver=1.0.0
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 62a6e39931fdade454bf74dd1f40ed0a2ba8eef2f69e99513b44df1e5ba54bfa

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 19 Nov 2019 14:43:40 GMT
Server: Apache
ETag: "2206-597b41712f6ed-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=150
Content-Length: 1614
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK style.min.css
attacksimulator.com/wp-content/plugins/divi-toc/styles/ 0
382 B 36ms
12ms Stylesheet
text/css 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/plugins/divi-toc/styles/style.min.css?ver=1.0.0
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sun, 05 Jul 2020 13:26:32 GMT
Server: Apache
ETag: "0-5a9b1b4e8666c"
Content-Type: text/css
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=150
Content-Length: 0
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK style.css
attacksimulator.com/wp-content/themes/AttackSimulator/ 32 KB
6 KB 39ms
13ms Stylesheet
text/css 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 192a2063fbade1f2bc789cff35aa1ff6a25281750b4a961a549c285cfdc250dc

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sat, 03 Jul 2021 00:22:35 GMT
Server: Apache
ETag: "7ec2-5c62d11a51953-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=147
Content-Length: 5282
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H2 200 jetpack.css
c0.wp.com/p/jetpack/10.1/css/ 85 KB
16 KB 19ms
7ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/10.1/css/jetpack.css

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

4c71cab3e2b7defd9022059c922d2c91359df1ba71dd47e8543b108c70537f25

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Fri, 01 Oct 2021 05:27:14 GMT
content-encoding: br
last-modified: Tue, 07 Sep 2021 15:38:53 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H2 200 jquery.min.js Show response
c0.wp.com/c/5.8.1/wp-includes/js/jquery/ 87 KB
30 KB 19ms
8ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.1/wp-includes/js/jquery/jquery.min.js

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Fri, 01 Oct 2021 05:27:14 GMT
content-encoding: br
last-modified: Wed, 10 Mar 2021 15:07:24 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H2 200 jquery-migrate.min.js Show response
c0.wp.com/c/5.8.1/wp-includes/js/jquery/ 11 KB
4 KB 19ms
8ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.1/wp-includes/js/jquery/jquery-migrate.min.js

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Fri, 01 Oct 2021 05:27:14 GMT
content-encoding: br
last-modified: Wed, 18 Nov 2020 09:06:06 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK scroll.js Show response
attacksimulator.com/wp-content/themes/AttackSimulator/js/ 578 B
755 B 49ms
12ms Script
application/x-javascript 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/themes/AttackSimulator/js/scroll.js
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 8ca2513bb0a173ad2bff786ea33697232a5d3562046a5197a700ed8ab51cb1e7

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 06 Apr 2021 11:56:37 GMT
Server: Apache
ETag: "242-5bf4c81b16c11-gzip"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=149
Content-Length: 301
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK fix-forms.js Show response
attacksimulator.com/wp-content/themes/AttackSimulator/js/ 5 KB
2 KB 50ms
13ms Script
application/x-javascript 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/themes/AttackSimulator/js/fix-forms.js?ver=5.8.1
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: cc106b0539e64c13b080a74cd0bd729d98396db9564286f60063bacb96d21882

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Fri, 11 Sep 2020 15:09:25 GMT
Server: Apache
ETag: "1502-5af0b120bc749-gzip"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=149
Content-Length: 1721
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK xdomain-data.js Show response
attacksimulator.com/wp-content/plugins/sitepress-multilingual-cms/res/js/ 2 KB
1 KB 49ms
12ms Script
application/x-javascript 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/plugins/sitepress-multilingual-cms/res/js/xdomain-data.js?ver=4.4.12
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 58c87bd2b89dc90a862e4c6293f20390f52fdb1e685788d7ffe7de1636ad5020

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sun, 12 Sep 2021 17:39:21 GMT
Server: Apache
ETag: "8e6-5cbcfd42acfb8-gzip"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=149
Content-Length: 822
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H2 200 font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ 30 KB
7 KB 34ms
18ms Stylesheet
text/css 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Origin: https://attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:14 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 723, 617, 617
age: 14127916
cdn-cachedat: 2021-04-20 19:00:09
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 74c564503c58c51491ae0652d05821db
cf-ray: 697347de0f1a05e4-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 127 KB
50 KB 82ms
42ms Script
application/javascript 142.250.184.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-DJ4MCYXH9D

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

4ebee4e7ed4b899128d2abb2e86c8ad2ccc2232156572a6cb7dd9e6a974a7925

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:14 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50663
x-xss-protection: 0
expires: Fri, 01 Oct 2021 05:27:14 GMT

GET
H/1.1 200
OK et-divi-customizer-global.min.css
attacksimulator.com/wp-content/et-cache/global/ 10 KB
3 KB 46ms
14ms Stylesheet
text/css 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/et-cache/global/et-divi-customizer-global.min.css?ver=1632388537
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: b14541a3e71a2b474852f6bf5bd736cd19343aeaf2b12758c1d4879d223948d7

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 23 Sep 2021 09:15:37 GMT
Server: Apache
ETag: "28db-5cca612e62133-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=149
Content-Length: 2657
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK et-core-unified-tb-8191-tb-11231-tb-174-deferred-14322.min.css
attacksimulator.com/wp-content/et-cache/14322/ 9 KB
2 KB 44ms
14ms Stylesheet
text/css 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/et-cache/14322/et-core-unified-tb-8191-tb-11231-tb-174-deferred-14322.min.css?ver=1632903069
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: e71bf6952ed7a57737e3862d117a2299960b4e7f2238c665c8ea8c9826fe8fce

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 29 Sep 2021 08:11:09 GMT
Server: Apache
ETag: "2249-5cd1ddf6fcfe1-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=149
Content-Length: 2037
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H2 200 diana.png
i1.wp.com/attacksimulator.com/wp-content/uploads/ 25 KB
25 KB 24ms
6ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/attacksimulator.com/wp-content/uploads/diana.png?resize=150%2C150&ssl=1

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

46f4d00c89bfcdab9f60de0ea4f1f30abf10cfbf90d7b66ec48fbb9104ee5928

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 3
date: Fri, 01 Oct 2021 05:27:14 GMT
x-content-type-options: nosniff
last-modified: Wed, 18 Aug 2021 09:14:59 GMT
server: nginx
etag: "ab15a68d9306a753"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://attacksimulator.com/wp-content/uploads/diana.png>; rel="canonical"
content-length: 25152
expires: Fri, 18 Aug 2023 21:14:59 GMT

GET
H2 200 photon.min.js Show response
c0.wp.com/p/jetpack/10.1/_inc/build/photon/ 758 B
425 B 6ms
6ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/10.1/_inc/build/photon/photon.min.js

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

e1b0066bc1972444c0a15e1778be06ed7bf36c55d597c065b5e79041bcda291e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Fri, 01 Oct 2021 05:27:14 GMT
content-encoding: br
last-modified: Tue, 31 Mar 2020 17:26:38 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK site_tracking.js Show response
attacksimulator.com/wp-content/plugins/activecampaign-subscription-forms/ 1 KB
1 KB 12ms
12ms Script
application/x-javascript 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/plugins/activecampaign-subscription-forms/site_tracking.js?ver=5.8.1
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 9a19938485ca7f6c582d3f78d17d9e443d26b260cac24c9dd9499f70b5d28390

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 23 Sep 2021 01:18:27 GMT
Server: Apache
ETag: "57b-5cc9f68714d87-gzip"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=148
Content-Length: 633
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H2 200 7753086.js Show response
js.hs-scripts.com/ 2 KB
975 B 178ms
151ms Script
application/javascript 104.17.210.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/7753086.js?integration=WordPress
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.210.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb16adb0a04fd9919e25b0b40648299d7cac31e110a72957460ba65401be671f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:15 GMT
content-encoding: br
cf-cache-status: EXPIRED
server: cloudflare
x-hubspot-correlation-id: 8fde01ad-292f-4396-b605-7793a4e23312
x-trace: 2BBB9B71A4AF9A32F11666A651778E97D571D547C4000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://attacksimulator.com
access-control-max-age: 3600
cache-control: public, max-age=60
access-control-allow-credentials: true
cf-ray: 697347de6804c29a-FRA
expires: Fri, 01 Oct 2021 05:28:15 GMT

GET
H/1.1 200
OK table-of-contents.js Show response
attacksimulator.com/wp-content/plugins/ultimate-addons-for-gutenberg/assets/js/ 6 KB
2 KB 13ms
13ms Script
application/x-javascript 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/plugins/ultimate-addons-for-gutenberg/assets/js/table-of-contents.js?ver=1.24.2
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 399cefedaa166f14db5e61880df24a5906e3b28f13bf0d665cf471b664501f5d

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Wed, 04 Aug 2021 13:19:14 GMT
Server: Apache
ETag: "17e5-5c8bba614206a-gzip"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=148
Content-Length: 2060
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK uag-js-14322-1633018485.js Show response
attacksimulator.com/wp-content/uploads/uag-plugin/ 243 B
678 B 14ms
12ms Script
application/x-javascript 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/uploads/uag-plugin/uag-js-14322-1633018485.js?ver=1.24.2
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 839559eed175dd5d3d5c3409116e9a6c053489d886a83048d523c2e23ded7766

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 30 Sep 2021 16:14:45 GMT
Server: Apache
ETag: "f3-5cd38bec16554-gzip"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=148
Content-Length: 201
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H2 200 comment-reply.min.js Show response
c0.wp.com/c/5.8.1/wp-includes/js/ 3 KB
1 KB 8ms
6ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.1/wp-includes/js/comment-reply.min.js

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Fri, 01 Oct 2021 05:27:14 GMT
content-encoding: br
last-modified: Thu, 18 Mar 2021 17:48:23 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK scripts.min.js Show response
attacksimulator.com/wp-content/themes/Divi/js/ 249 KB
64 KB 21ms
18ms Script
application/x-javascript 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/themes/Divi/js/scripts.min.js?ver=4.10.8
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: df871b327e79278c405d56fe05db409c136288193db2d6b75450824e45512115

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 23 Sep 2021 09:15:19 GMT
Server: Apache
ETag: "3e24b-5cca611cfda58-gzip"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=31536000
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=148
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK es6-promise.auto.min.js Show response
attacksimulator.com/wp-content/themes/Divi/core/admin/js/ 7 KB
3 KB 15ms
13ms Script
application/x-javascript 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/themes/Divi/core/admin/js/es6-promise.auto.min.js?ver=4.10.8
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 7b3a7e4265228a39bea0d22ac1aedb86219a7b521a831827f7f4579ca5ae4156

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 23 Sep 2021 09:15:19 GMT
Server: Apache
ETag: "1aa1-5cca611cffd80-gzip"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=148
Content-Length: 2684
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 884 B
1018 B 44ms
19ms Script
text/javascript 142.250.185.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=6LcTY6YZAAAAAIaSBP-bbSkwzD8YJqtAs1ALgdaP&ver=4.10.8

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f4.1e100.net

Software

GSE /

Resource Hash

e01c475e0e12c653ab81ee33b58e8d00cee55755911d9d066af793ef80dead42

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 584
x-xss-protection: 1; mode=block
expires: Fri, 01 Oct 2021 05:27:14 GMT

GET
H/1.1 200
OK recaptcha.js Show response
attacksimulator.com/wp-content/themes/Divi/core/admin/js/ 2 KB
1 KB 16ms
14ms Script
application/x-javascript 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/themes/Divi/core/admin/js/recaptcha.js?ver=4.10.8
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 6c1510ef35e8322bf3c09c53aa955cd3b0a9e5ac65d15dd518c84ffc4b511c9f

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 23 Sep 2021 09:15:19 GMT
Server: Apache
ETag: "6a0-5cca611cffd80-gzip"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=146
Content-Length: 712
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK jquery.fitvids.js Show response
attacksimulator.com/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/ 3 KB
2 KB 12ms
12ms Script
application/x-javascript 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.fitvids.js?ver=4.10.8
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 462747422c6af30aa81a0373fa1cfd736455cef52bdbb816f67be9531d84eace

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 23 Sep 2021 09:15:18 GMT
Server: Apache
ETag: "d15-5cca611cee827-gzip"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=147
Content-Length: 1341
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK easypiechart.js Show response
attacksimulator.com/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/ 9 KB
3 KB 15ms
14ms Script
application/x-javascript 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/easypiechart.js?ver=4.10.8
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 5aa24e4ab926693e29ffb0d0ca1557141defd3ca61b3b4e7caebaa2fcd5bf327

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 23 Sep 2021 09:15:18 GMT
Server: Apache
ETag: "2466-5cca611ceec0f-gzip"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=147
Content-Length: 3118
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK salvattore.js Show response
attacksimulator.com/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/ 8 KB
4 KB 14ms
14ms Script
application/x-javascript 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/salvattore.js?ver=4.10.8
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: bffafb30adf0c09bfbf909eaa779391296499123dc3d90e429056ec896b2ebb9

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 23 Sep 2021 09:15:18 GMT
Server: Apache
ETag: "213d-5cca611cee827-gzip"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=145
Content-Length: 3378
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK frontend-bundle.min.js Show response
attacksimulator.com/wp-content/plugins/3it/scripts/ 2 KB
1 KB 13ms
12ms Script
application/x-javascript 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/plugins/3it/scripts/frontend-bundle.min.js?ver=1.0.0
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 6b7fcb4df3b767f9d0033039b632aa39bc74f4d20fab4d21b38ad06bb3365dfb

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Tue, 19 Nov 2019 14:43:40 GMT
Server: Apache
ETag: "913-597b41712f6ed-gzip"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=146
Content-Length: 961
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK frontend-bundle.min.js Show response
attacksimulator.com/wp-content/plugins/divi-toc/scripts/ 586 B
771 B 13ms
12ms Script
application/x-javascript 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/plugins/divi-toc/scripts/frontend-bundle.min.js?ver=1.0.0
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: ad44ca29f2237a973fca511736a9fb24557a4bd074f0703a72abb7f3e92ed960

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sun, 05 Jul 2020 13:26:32 GMT
Server: Apache
ETag: "24a-5a9b1b4e8666c-gzip"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=144
Content-Length: 317
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK common.js Show response
attacksimulator.com/wp-content/themes/Divi/core/admin/js/ 1 KB
1020 B 14ms
13ms Script
application/x-javascript 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/themes/Divi/core/admin/js/common.js?ver=4.10.8
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 1ca76922f55b389b8f590ae7e3bcc3a2dccdce3aff1e5a4335af081b76a414ea

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 23 Sep 2021 09:15:19 GMT
Server: Apache
ETag: "53f-5cca611cffd80-gzip"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=146
Content-Length: 566
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H2 200 wp-embed.min.js Show response
c0.wp.com/c/5.8.1/wp-includes/js/ 1 KB
719 B 7ms
6ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.1/wp-includes/js/wp-embed.min.js

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Fri, 01 Oct 2021 05:27:14 GMT
content-encoding: br
last-modified: Wed, 06 Jan 2021 15:29:24 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H2 200 mediaelement-and-player.min.js Show response
c0.wp.com/c/5.8.1/wp-includes/js/mediaelement/ 154 KB
35 KB 8ms
6ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.1/wp-includes/js/mediaelement/mediaelement-and-player.min.js

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

443ba0af7a7ed827223c7fb3c008c02b9ff1d651b6492e9c270378b07d9f6008

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Fri, 01 Oct 2021 05:27:14 GMT
content-encoding: br
last-modified: Tue, 29 Sep 2020 15:53:06 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H2 200 mediaelement-migrate.min.js Show response
c0.wp.com/c/5.8.1/wp-includes/js/mediaelement/ 1 KB
513 B 8ms
6ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.1/wp-includes/js/mediaelement/mediaelement-migrate.min.js

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

7f34b768792b90cf0b04fced2470e43d8fab7644f6565d5178fbfb49c4859cee

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Fri, 01 Oct 2021 05:27:14 GMT
content-encoding: br
last-modified: Wed, 06 Jan 2021 15:29:24 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H2 200 wp-mediaelement.min.js Show response
c0.wp.com/c/5.8.1/wp-includes/js/mediaelement/ 906 B
448 B 8ms
7ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.1/wp-includes/js/mediaelement/wp-mediaelement.min.js

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

3e6131330963c472b950b8aaf544ba3829735b8ccb103d614ba7793e3a786550

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Fri, 01 Oct 2021 05:27:14 GMT
content-encoding: br
last-modified: Wed, 20 Jan 2021 13:35:18 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK motion-effects.js Show response
attacksimulator.com/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/ 153 KB
38 KB 18ms
18ms Script
application/x-javascript 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/motion-effects.js?ver=4.10.8
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 4244f97e49ee5a5fd27cc0eddfd756d27648a4eee056cff069b261b96ea70ebe

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Thu, 23 Sep 2021 09:15:18 GMT
Server: Apache
ETag: "263fd-5cca611cee827-gzip"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=147
Content-Length: 38628
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H2 200 e-202139.js Show response
stats.wp.com/ 9 KB
3 KB 22ms
6ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202139.js
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn
date: Fri, 01 Oct 2021 05:27:14 GMT
content-encoding: gzip
server: nginx
etag: W/"5c6340e3-350a"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Sun, 18 Sep 2022 22:18:48 GMT

GET
H2 200 7nx3my8idx Show response
www.clarity.ms/tag/ 944 B
1 KB 192ms
128ms Script
application/x-javascript 104.212.67.157
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/7nx3my8idx
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.212.67.157 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS: muc30r3.msedge.net
Software: / ASP.NET
Resource Hash: be843202301857f5d5c4094e4be0f9ace7f279e2dae06292036f29520cf7891a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:14 GMT
x-powered-by: ASP.NET
x-azure-ref: 0M5xWYQAAAABWYvscy56BT45uJANsLcBTTVVDMzBFREdFMDMxMAA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
expires: -1
cache-control: no-cache, no-store
request-context: appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111

GET
H/1.1 200
OK Inter-V.ttf
attacksimulator.com/wp-content/uploads/et-fonts/ 759 KB
401 KB 26ms
19ms Font
application/x-font-ttf 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/uploads/et-fonts/Inter-V.ttf
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: ab348def7a91b2ae43926c6c08fc90bf77fa8c7091f7e9e9549185eb3fbeb3d5

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Origin: https://attacksimulator.com
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: font
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Origin: https://attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "bddfc-5add85ca99dde-gzip"
Vary: Accept-Encoding
Content-Type: application/x-font-ttf
Cache-Control: private max-age=31536000
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=147
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK cropped-ats_site_icon-1.png
attacksimulator.com/wp-content/uploads/ 10 KB
11 KB 13ms
13ms Image
image/webp 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/cropped-ats_site_icon-1.png
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/et-cache/global/et-divi-customizer-global.min.css?ver=1632388537
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 36fda9e4a533407607eab3d71d6212eb7b7ccb9c623cf6813be4208532252e9a

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/wp-content/et-cache/global/et-divi-customizer-global.min.css?ver=1632388537
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/wp-content/et-cache/global/et-divi-customizer-global.min.css?ver=1632388537
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sun, 04 Apr 2021 21:53:29 GMT
Server: Apache
ETag: "28a0-5bf2c9c88c1c2"
Vary: Accept
Content-Type: image/webp
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=145
Content-Length: 10400
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK phishing-simulations.svg
attacksimulator.com/wp-content/uploads/ 993 B
940 B 13ms
13ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/phishing-simulations.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 422dd3e64896e13ec274b0bf15eac6439cdee8e0bd14265eaebd27a4ae507dc7

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "3e1-5af4569393935-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=143
Content-Length: 519
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK edu-platform.svg
attacksimulator.com/wp-content/uploads/ 765 B
787 B 13ms
13ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/edu-platform.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 3d6ffd09624842608fc9099c37c189875759d596ae040451561d8459bf2bdd6d

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "2fd-5af455ca3add8-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=145
Content-Length: 366
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK interactive-games.svg
attacksimulator.com/wp-content/uploads/ 690 B
777 B 13ms
13ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/interactive-games.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 64dedd47374d0eda43cdeaf0ed5806d3f0ab1b50f360c9fb6d932f68c9d2c812

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "2b2-5af4566f8f8e3-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=146
Content-Length: 356
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK use-cases.svg
attacksimulator.com/wp-content/uploads/ 622 B
798 B 12ms
12ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/use-cases.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: e4afc24136181320da3f87e8907fb4ad5e72b7c7f1a7fd8a90da91fa94ae9dc4

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "26e-5af45af583b52-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=144
Content-Length: 377
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK compliance.svg
attacksimulator.com/wp-content/uploads/ 808 B
865 B 16ms
15ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/compliance.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 64edb862b0ca755c9e03b07c2d2d3fa3fcc59a417cbad9d1fb8b5cf5eb040ad8

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "328-5af4558f152ec-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=142
Content-Length: 444
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK plans.svg
attacksimulator.com/wp-content/uploads/ 806 B
833 B 14ms
14ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/plans.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 3e34fb430ed25b25c68112919ccac0ce286f8690194fd1f9d6fe743129214552

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "326-5b9b7ca69796d-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=144
Content-Length: 412
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK compare-plans.svg
attacksimulator.com/wp-content/uploads/ 606 B
795 B 13ms
13ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/compare-plans.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: a19b8f2acae60fb0df544a326fb0e0a3d9f71f0645c2f23a0e69daef21430460

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "25e-5af4558e3f507-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=146
Content-Length: 374
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK help-me-choose.svg
attacksimulator.com/wp-content/uploads/ 765 B
828 B 13ms
13ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/help-me-choose.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 5029032bdb39ef38c22d1fe99573b1aec6b64824fbf837c185327810f1b25de3

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "2fd-5af45668aa2a5-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=145
Content-Length: 407
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK free-trial.svg
attacksimulator.com/wp-content/uploads/ 627 B
809 B 12ms
12ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/free-trial.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 71b86f2fc9657145fec62471ea9436544823a2c8d72f47fcad8060ad3ccfb89c

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "273-5af456346059f-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=143
Content-Length: 388
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK admin-panel.svg
attacksimulator.com/wp-content/uploads/ 2 KB
1 KB 15ms
12ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/admin-panel.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: db9cdc732c9377cdfefb27cfd0375ed01ce41786f1b31d32dd93dcbe15da9cfb

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:15 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "7a7-5af455391d021-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=143
Content-Length: 644
Expires: Sat, 01 Oct 2022 05:27:15 GMT

GET
H/1.1 200
OK educational-platform.svg
attacksimulator.com/wp-content/uploads/ 2 KB
1 KB 13ms
13ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/educational-platform.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: cc80ee7dd5427dd0cc7d1d5946741602f23922766f81670e855b902c5d8cc0b6

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:15 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "93e-5af456210a5fa-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=144
Content-Length: 957
Expires: Sat, 01 Oct 2022 05:27:15 GMT

GET
H/1.1 200
OK parteners-portal.svg
attacksimulator.com/wp-content/uploads/ 2 KB
1 KB 13ms
12ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/parteners-portal.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: ef8b2a42e84013192b60517040f37611f2f19ddd27fab626251f3b5e66657fbf

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/wp-content/themes/AttackSimulator/style.css?ver=1.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:15 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "7df-5af45686faf2f-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=141
Content-Length: 618
Expires: Sat, 01 Oct 2022 05:27:15 GMT

GET
H/1.1 200
OK modules.ttf
attacksimulator.com/wp-content/themes/Divi/core/admin/fonts/modules/all/ 90 KB
37 KB 17ms
16ms Font
application/x-font-ttf 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://attacksimulator.com/wp-content/themes/Divi/core/admin/fonts/modules/all/modules.ttf
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: d201a2c3118a00c82cc48e89815f5139f23956bbe248107dcf522acc77b97c09

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Origin: https://attacksimulator.com
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: font
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Origin: https://attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:14 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "168f0-5cca611d00938-gzip"
Vary: Accept-Encoding
Content-Type: application/x-font-ttf
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=147
Content-Length: 37445
Expires: Sat, 01 Oct 2022 05:27:14 GMT

GET
H/1.1 200
OK attack-simulator-logo-hook.svg
attacksimulator.com/wp-content/uploads/ 4 KB
2 KB 13ms
13ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/attack-simulator-logo-hook.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: b709ed74fc13dd3d9bce315ca6e0ad25054844434fc494f1f95e999d0662c15e

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:15 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "114a-5beac009385d3-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=143
Content-Length: 1811
Expires: Sat, 01 Oct 2022 05:27:15 GMT

GET
H/1.1 200
OK android-seeklogo.com_.svg
attacksimulator.com/wp-content/uploads/ 6 KB
2 KB 13ms
13ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/android-seeklogo.com_.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: cdcbc2f3f69d2fb5e807346244695d0a4110bbad355ac97e3778400ad12ef771

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:15 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "170e-5cd1dde945003-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=140
Content-Length: 2122
Expires: Sat, 01 Oct 2022 05:27:15 GMT

GET
H2 200 logo_square-1-1.png
i2.wp.com/attacksimulator.com/wp-content/uploads/ 5 KB
5 KB 9ms
8ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/attacksimulator.com/wp-content/uploads/logo_square-1-1.png?resize=300%2C300&ssl=1

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

20ea4672f086c9f857fd54b500ff0e413ed7b5f2e8dd0a5dec998e0b7c9270d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Fri, 01 Oct 2021 05:27:15 GMT
x-content-type-options: nosniff
last-modified: Wed, 29 Sep 2021 12:01:28 GMT
server: nginx
etag: "bc5e32418095887a"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://attacksimulator.com/wp-content/uploads/logo_square-1-1.png>; rel="canonical"
content-length: 4984
expires: Sat, 30 Sep 2023 00:01:28 GMT

GET
H/1.1 200
OK no-fishing.svg
attacksimulator.com/wp-content/uploads/ 2 KB
1 KB 12ms
12ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/no-fishing.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 4e837d8432bdf15edfd570a21596654cffde24335c060373700a3dd542977cd7

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:15 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "879-5ccc234208ee9-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=142
Content-Length: 893
Expires: Sat, 01 Oct 2022 05:27:15 GMT

GET
H2 200 diffuser.js Show response
diffuser-cdn.app-us1.com/diffuser/ 24 KB
6 KB 49ms
23ms Script
application/javascript 104.17.145.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://diffuser-cdn.app-us1.com/diffuser/diffuser.js
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/plugins/activecampaign-subscription-forms/site_tracking.js?ver=5.8.1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.145.91 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 07ef661be38be006eb690a15613c557d418b8780900ff490545bb2b75d23fcd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:15 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 281
x-cache: Hit from cloudfront
last-modified: Mon, 22 Feb 2021 18:41:52 GMT
server: cloudflare
etag: W/"1e16152334c325a4abb81f1a8ee52e51"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 f891d17fa862cc74a05434e03fa58dcb.cloudfront.net (CloudFront)
cache-control: public, max-age=300
x-amz-cf-pop: FRA56-C2
cf-ray: 697347df28434ec1-FRA
x-amz-cf-id: TfTML7vMqZ5srs7T1_WWohOWHWhmzbpLs33dYgBiva4Y-dGUB_bWfw==

GET
DATA 200
OK truncated
/ 434 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c47777a4374d9344402f6136e2fbb833540d1df1fd72bd5cecad8502235b8c9a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK house.svg
attacksimulator.com/wp-content/uploads/ 2 KB
1 KB 13ms
13ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/house.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/et-cache/14322/et-core-unified-tb-8191-tb-11231-tb-174-deferred-14322.min.css?ver=1632903069
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: 4adb7a9cb767b327596d7e9d8fd195546e894325a10df19d385d87030a04ffd7

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/wp-content/et-cache/14322/et-core-unified-tb-8191-tb-11231-tb-174-deferred-14322.min.css?ver=1632903069
Cookie: ac_enable_tracking=1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/wp-content/et-cache/14322/et-core-unified-tb-8191-tb-11231-tb-174-deferred-14322.min.css?ver=1632903069
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:15 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "855-5af4566bf435f-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=139
Content-Length: 1066
Expires: Sat, 01 Oct 2022 05:27:15 GMT

GET
H/1.1 200
OK phone.svg
attacksimulator.com/wp-content/uploads/ 1 KB
1 KB 13ms
12ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/phone.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/et-cache/14322/et-core-unified-tb-8191-tb-11231-tb-174-deferred-14322.min.css?ver=1632903069
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: ca098104a5a5a18d1472fd95541c2edeb93c1a3c1b8b3598090aa57e0bcf8875

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/wp-content/et-cache/14322/et-core-unified-tb-8191-tb-11231-tb-174-deferred-14322.min.css?ver=1632903069
Cookie: ac_enable_tracking=1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/wp-content/et-cache/14322/et-core-unified-tb-8191-tb-11231-tb-174-deferred-14322.min.css?ver=1632903069
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:15 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "491-5af45694779aa-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=142
Content-Length: 629
Expires: Sat, 01 Oct 2022 05:27:15 GMT

GET
H/1.1 200
OK envelope.svg
attacksimulator.com/wp-content/uploads/ 3 KB
2 KB 13ms
13ms Image
image/svg+xml 94.130.135.206
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attacksimulator.com/wp-content/uploads/envelope.svg
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/wp-content/et-cache/14322/et-core-unified-tb-8191-tb-11231-tb-174-deferred-14322.min.css?ver=1632903069
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 94.130.135.206 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: catalogo-online.com
Software: Apache /
Resource Hash: c91fc203d2217bfe73c27d4abe601786da50b46d2332dfa6bcb3d63c393ac72e

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://attacksimulator.com/wp-content/et-cache/14322/et-core-unified-tb-8191-tb-11231-tb-174-deferred-14322.min.css?ver=1632903069
Cookie: ac_enable_tracking=1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/wp-content/et-cache/14322/et-core-unified-tb-8191-tb-11231-tb-174-deferred-14322.min.css?ver=1632903069
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 05:27:15 GMT
Content-Encoding: gzip
Referrer-Policy: no-referrer-when-downgrade
Server: Apache
ETag: "b09-5af4562300d15-gzip"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: private max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=141
Content-Length: 1315
Expires: Sat, 01 Oct 2022 05:27:15 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/-TriQeni1Ls-Mdq_ssN2cUL5/ 346 KB
136 KB 29ms
7ms Script
text/javascript 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/-TriQeni1Ls-Mdq_ssN2cUL5/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LcTY6YZAAAAAIaSBP-bbSkwzD8YJqtAs1ALgdaP&ver=4.10.8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f99.1e100.net

Software

sffe /

Resource Hash

b0236d5c7c5a438a04858e85fe41d24cdcc0cf55a99a45cd2dc36bef08905980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Origin: https://attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 30 Sep 2021 18:14:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40344
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 138353
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 04:02:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Fri, 30 Sep 2022 18:14:51 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
115 B 6ms
5ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A10.1&blog=172453644&post=14322&tz=2&srv=attacksimulator.com&host=attacksimulator.com&ref=&fcp=1532&rand=0.3923930022502349
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:15 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 petya-ransomware.gif
i2.wp.com/attacksimulator.com/wp-content/uploads/ 532 KB
533 KB 7ms
7ms Image
image/gif 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/attacksimulator.com/wp-content/uploads/petya-ransomware.gif?resize=400%2C250&ssl=1

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

72336773056658b94f86a862d0eff531d8ddd92757eebf183451ee6a24934d71

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 3
date: Fri, 01 Oct 2021 05:27:15 GMT
x-content-type-options: nosniff
last-modified: Wed, 29 Sep 2021 10:38:21 GMT
server: nginx
etag: "0fa060707b8242b7"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://attacksimulator.com/wp-content/uploads/petya-ransomware.gif>; rel="canonical"
content-length: 544806
expires: Fri, 29 Sep 2023 22:38:21 GMT

GET
H2 200 chris-hardy-Aj-QoUE3Vqc-unsplash-1.jpg
i2.wp.com/attacksimulator.com/wp-content/uploads/ 5 KB
5 KB 7ms
7ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/attacksimulator.com/wp-content/uploads/chris-hardy-Aj-QoUE3Vqc-unsplash-1.jpg?resize=400%2C250&ssl=1

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

98a7cec2f5b98d2a0ae6efb46404fe6ff0aacbaa06da9474ceed6271e6271e08

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 4
date: Fri, 01 Oct 2021 05:27:15 GMT
x-content-type-options: nosniff
last-modified: Mon, 27 Sep 2021 06:17:06 GMT
server: nginx
etag: "d811872ca8621a26"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://attacksimulator.com/wp-content/uploads/chris-hardy-Aj-QoUE3Vqc-unsplash-1.jpg>; rel="canonical"
content-length: 4744
expires: Wed, 27 Sep 2023 18:17:06 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 96 KB
38 KB 41ms
40ms Script
application/javascript 142.250.184.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-187846804-1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DJ4MCYXH9D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

249fc6136655c3dabc4bbf910ae654b13afc6a2f58e6388d0520f613ce820394

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:15 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39014
x-xss-protection: 0
last-modified: Fri, 01 Oct 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 01 Oct 2021 05:27:15 GMT

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 81 KB
26 KB 42ms
16ms Script
application/javascript 104.17.128.171
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hscollectedforms.net/collectedforms.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/7753086.js?integration=WordPress
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.128.171 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0e8f49ce2aa1c4720cc187c184c8d800182aea43645aa3193c0614703d0c8f4

Request headers

Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Origin: https://attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:15 GMT
via: 1.1 c35f767218cbd1125d801b52fa785c8d.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 57389
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=collected-forms-embed-js/static-1.247/bundles/project.js&cfRay=696dcecafc500605-IAD
x-cache: Hit from cloudfront
access-control-max-age: 3000
x-amz-replication-status: COMPLETED
content-encoding: br
cf-ray: 697347e03f155b4a-FRA
last-modified: Tue, 28 Sep 2021 10:08:32 UTC
server: cloudflare
etag: W/"a5dc58d02593ddd2c3c6bbe2230fc074"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
x-amz-version-id: s1CYAXlTSydz_cSjotzU3Em8FOsfSJIb
access-control-allow-origin: *
cache-control: s-maxage=86400, max-age=0
x-hs-cache-status: MISS
x-amz-cf-pop: IAD89-C3
content-type: application/javascript; charset=utf-8
x-amz-cf-id: KEw_Ysy5hLhI0U27JUdL2eq8ISukwVbWIgJFSMFZEaFVlH1MIWTb-g==
x-hs-target-asset: collected-forms-embed-js/static-1.247/bundles/project.js

GET
H2 200 7753086.js Show response
js.hs-banner.com/ 60 KB
16 KB 423ms
400ms Script
text/javascript 104.18.21.191
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/7753086.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/7753086.js?integration=WordPress
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.21.191 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: adc9bbc7e4048a011ddb534439068515ab95e69e099c4fbf60e699c732258e45

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:15 GMT
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: K9PXZ5Y9M0Y4FH5V
x-amz-server-side-encryption: AES256
content-type: text/javascript; charset=UTF-8
access-control-max-age: 604800
x-amz-id-2: 8eta7Gr8scpg2mx9BSA6OvoWVMu/24AYIpnZSDdlZCSbD8NRJtDIKAGRD3xntKV2/6zpeLlzjFg=
timing-allow-origin: *
last-modified: Fri, 03 Sep 2021 21:13:29 GMT
server: cloudflare
etag: W/"e65ea34a667e1151f3a567cee207364e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-amz-version-id: QVd6KTQyoTDrz82SR1ErmrUA4qL2RHol
access-control-allow-origin: https://attacksimulator.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300, public
access-control-allow-credentials: true
cf-ray: 697347e03ef2432d-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
expires: Fri, 01 Oct 2021 05:32:15 GMT

GET
H2 200 7753086.js Show response
js.hs-analytics.net/analytics/1633065900000/ 62 KB
20 KB 170ms
143ms Script
text/javascript 104.17.71.176
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1633065900000/7753086.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/7753086.js?integration=WordPress
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.71.176 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 91298c29454e0502262eff1f64b1f55e1d7581f0917a4a33c906a7e6214fff28

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:15 GMT
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: GP61C5F8XW4BKT1K
x-amz-server-side-encryption: AES256
cf-ray: 697347e03f4e4a7a-FRA
x-amz-id-2: cijN+CJmLz7m/heBvTKcA1I9r+k8t05cG3OLd0cEtSrhaR/160gF6eHbD6J2QuBEV4oMpYX4BSY=
last-modified: Mon, 19 Jul 2021 16:05:47 GMT
server: cloudflare
etag: W/"ec5801d6f70b0ce7d06000447d479eee"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: null
cache-control: max-age=300, public
access-control-allow-credentials: false
content-type: text/javascript
expires: Fri, 01 Oct 2021 05:32:15 GMT

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 537 KB
87 KB 67ms
41ms Script
application/javascript 104.17.231.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsleadflows.net/leadflows.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/7753086.js?integration=WordPress
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.231.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b38803f733f36ff943399e6539b7fe1fa26611706ce6878b5b21c6a4f96ec862

Request headers

Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Origin: https://attacksimulator.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:15 GMT
via: 1.1 c34bd35d24f6df50307d1ac92d0f6110.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 84419
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=lead-flows-js/static-1.1056/bundle/main/lead-flows-release.js&cfRay=696b3ae14c663233-IAD
x-cache: RefreshHit from cloudfront
access-control-max-age: 3000
x-amz-replication-status: COMPLETED
content-encoding: br
cf-ray: 697347e038634a5b-FRA
last-modified: Thu, 23 Sep 2021 09:11:54 UTC
server: cloudflare
etag: W/"9af442c5acbde436228f228f7502bfc8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
x-amz-version-id: BdP6Nyyw4.FdbyHhgb7cfRPPJ2MC6STP
access-control-allow-origin: *
cache-control: s-maxage=86400, max-age=0
x-hs-cache-status: MISS
x-amz-cf-pop: IAD89-C3
content-type: application/javascript; charset=utf-8
x-amz-cf-id: VVE_aNhunqHwZRZRMABhzzCQi1_DcHK8ESAVJ1bK8WbU2gAAUP4E5w==
x-hs-target-asset: lead-flows-js/static-1.1056/bundle/main/lead-flows-release.js

GET
H2 200 clarity.js Show response
www.clarity.ms/eus/s/0.6.24/ 51 KB
22 KB 124ms
124ms Script
application/javascript 104.212.67.157
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/eus/s/0.6.24/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/7nx3my8idx
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.212.67.157 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS: muc30r3.msedge.net
Software: / ASP.NET
Resource Hash: 6bbb5e354138bdacaf7fe81409ec991637f79792f4a140480764628a993e7251

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:15 GMT
content-encoding: br
etag: "1d7b3fa47e3ac5c"
last-modified: Mon, 27 Sep 2021 23:49:16 GMT
x-powered-by: ASP.NET
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: public,max-age=86400
x-azure-ref: 0M5xWYQAAAACyG1tmm6/BS44e4uSKaLY0TVVDMzBFREdFMDMxMAA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
accept-ranges: bytes
request-context: appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?CtsSyncId=90BAA9B5F63F40DC82E70A8F52D7B1F0&RedC=c.clarity.ms&MXFR=30ED3A638E786BF7210E2AA08A78650C
https://c.clarity.ms/c.gif?CtsSyncId=90BAA9B5F63F40DC82E70A8F52D7B1F0&MUID=285F1645CEA66A4920D50686CFE36BFC

42 B
369 B

40ms
40ms

Image
image/gif

52.142.114.2
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?CtsSyncId=90BAA9B5F63F40DC82E70A8F52D7B1F0&MUID=285F1645CEA66A4920D50686CFE36BFC
Requested by: Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 01 Oct 2021 05:27:14 GMT
last-modified: Wed, 15 Sep 2021 17:29:40 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "367bb54357aad71:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Fri, 01 Oct 2021 05:27:15 GMT
x-msedge-ref: Ref A: 3BA710501E6346C9A286058655BCBA5E Ref B: PRG01EDGE0718 Ref C: 2021-10-01T05:27:15Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?CtsSyncId=90BAA9B5F63F40DC82E70A8F52D7B1F0&MUID=285F1645CEA66A4920D50686CFE36BFC
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H3 200 anchor Show response
www.google.com/recaptcha/api2/ Frame AEF2 39 KB
20 KB 53ms
35ms Document
text/html 142.250.185.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcTY6YZAAAAAIaSBP-bbSkwzD8YJqtAs1ALgdaP&co=aHR0cHM6Ly9hdHRhY2tzaW11bGF0b3IuY29tOjQ0Mw..&hl=de&v=-TriQeni1Ls-Mdq_ssN2cUL5&size=invisible&cb=g80bkk97cj38

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-TriQeni1Ls-Mdq_ssN2cUL5/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f4.1e100.net

Software

GSE /

Resource Hash

c4a33f4cc6363eca2411ba813333976bf4861bdb8a28f215402a5fd9f8acdc2f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-B2+l+MIh6aZ8r7+f0dT6Wg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LcTY6YZAAAAAIaSBP-bbSkwzD8YJqtAs1ALgdaP&co=aHR0cHM6Ly9hdHRhY2tzaW11bGF0b3IuY29tOjQ0Mw..&hl=de&v=-TriQeni1Ls-Mdq_ssN2cUL5&size=invisible&cb=g80bkk97cj38
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 01 Oct 2021 05:27:15 GMT
content-security-policy: script-src 'report-sample' 'nonce-B2+l+MIh6aZ8r7+f0dT6Wg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 20071
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 / Show response
prism.app-us1.com/ 246 B
365 B 196ms
188ms Script
application/javascript 104.17.145.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prism.app-us1.com/?a=26612610&u=https%3A%2F%2Fattacksimulator.com%2Fblog%2Fnew-android-malware-tanglebot%2F
Requested by: Host: diffuser-cdn.app-us1.com
URL: https://diffuser-cdn.app-us1.com/diffuser/diffuser.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.145.91 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.2.34
Resource Hash: 03d2d2a2bfc8255adbe035dbe470e88fa06929608e114a73b292ca2b31fed778

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:15 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: PHP/7.2.34
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/javascript
cache-control: no-cache, private
cf-ray: 697347e06a384ec1-FRA

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 48ms
13ms Script
text/javascript 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-187846804-1&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 2115
date: Fri, 01 Oct 2021 04:52:00 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Fri, 01 Oct 2021 06:52:00 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
173 B 57ms
26ms Ping
text/plain 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-DJ4MCYXH9D&gtm=2oe9r0&_p=1931617203&sr=1600x1200&ul=en-us&cid=1861394100.1633066035&_s=1&dl=https%3A%2F%2Fattacksimulator.com%2Fblog%2Fnew-android-malware-tanglebot%2F&dt=New%20COVID-19%20Themed%20Android%20Malware%20Reaches%20Deep%20Into%20Device%20Functions%20-%20ATTACK%20Simulator&sid=1633066035&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DJ4MCYXH9D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.184.238 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 01 Oct 2021 05:27:15 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://attacksimulator.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/-TriQeni1Ls-Mdq_ssN2cUL5/ Frame AEF2 52 KB
25 KB 23ms
8ms Stylesheet
text/css 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/-TriQeni1Ls-Mdq_ssN2cUL5/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcTY6YZAAAAAIaSBP-bbSkwzD8YJqtAs1ALgdaP&co=aHR0cHM6Ly9hdHRhY2tzaW11bGF0b3IuY29tOjQ0Mw..&hl=de&v=-TriQeni1Ls-Mdq_ssN2cUL5&size=invisible&cb=g80bkk97cj38

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f99.1e100.net

Software

sffe /

Resource Hash

5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 19:47:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 294002
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25732
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 04:02:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Tue, 27 Sep 2022 19:47:13 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/-TriQeni1Ls-Mdq_ssN2cUL5/ Frame AEF2 346 KB
135 KB 21ms
7ms Script
text/javascript 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/-TriQeni1Ls-Mdq_ssN2cUL5/recaptcha__de.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f99.1e100.net

Software

sffe /

Resource Hash

b0236d5c7c5a438a04858e85fe41d24cdcc0cf55a99a45cd2dc36bef08905980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 30 Sep 2021 18:14:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40344
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 138353
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 04:02:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Fri, 30 Sep 2022 18:14:51 GMT

GET
H2 200 json Show response
forms.hubspot.com/collected-forms/v1/config/ 115 B
1 KB 143ms
117ms XHR
application/json 104.19.154.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/collected-forms/v1/config/json?portalId=7753086&utk=

Requested by

Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.154.83 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

01ebad6ab8aab56fc64cc183ad1bbdb029c8cb7a743149c69eb8b58f416e43a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/json, text/plain, */*
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:15 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: f979fd30-7558-4947-93ed-05ca816ee203
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fC5DTaexMqo5AlQFrjTEokNNAHpNlJYJH%2BKSZuR2dOE3gEQ8xwMCk1cpdg%2BOEND5ZwCGrCTbTdCestBLm1MLF6061BdU78S5S%2BYGlBVf%2F5pi%2Bi6fOuC3JSj%2F7WP0W3TnTVhd"}],"group":"cf-nel","max_age":604800}
content-type: application/json;charset=utf-8
access-control-allow-origin: https://attacksimulator.com
x-robots-tag: none
access-control-allow-credentials: false
cf-ray: 697347e2282068e5-FRA
access-control-allow-headers: *

GET
H2 200 t_prism_sitemessages.php Show response
trackcmp.net/ 0
271 B 291ms
98ms Script
text/javascript 54.162.17.5
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trackcmp.net/t_prism_sitemessages.php?trackid=26612610&prismid=2d9a4fb0-703d-4bc9-af99-0793a3b0c6bc&url=https%3A%2F%2Fattacksimulator.com%2Fblog%2Fnew-android-malware-tanglebot%2F
Requested by: Host: diffuser-cdn.app-us1.com
URL: https://diffuser-cdn.app-us1.com/diffuser/diffuser.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.162.17.5 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-162-17-5.compute-1.amazonaws.com
Software: Apache/2.4.48 (Amazon) / PHP/7.1.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:15 GMT
server: Apache/2.4.48 (Amazon)
x-powered-by: PHP/7.1.33
p3p: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
cache-control: no-cache, private
x-privacy-policy: You can find our privacy policy here: https://www.activecampaign.com/help/privacy-policy/
content-type: text/javascript;charset=UTF-8
content-length: 0

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 28ms
14ms XHR
text/plain 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1931617203&t=pageview&_s=1&dl=https%3A%2F%2Fattacksimulator.com%2Fblog%2Fnew-android-malware-tanglebot%2F&ul=en-us&de=UTF-8&dt=New%20COVID-19%20Themed%20Android%20Malware%20Reaches%20Deep%20Into%20Device%20Functions%20-%20ATTACK%20Simulator&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAAC~&jid=1109785887&gjid=1543468348&cid=1861394100.1633066035&tid=UA-187846804-1&_gid=221811202.1633066036&_r=1&gtm=2ou9r0&z=436082829

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 01 Oct 2021 05:27:15 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://attacksimulator.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame AEF2 2 KB
2 KB 7ms
6ms Image
image/png 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-TriQeni1Ls-Mdq_ssN2cUL5/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f99.1e100.net

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/-TriQeni1Ls-Mdq_ssN2cUL5/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 24 Sep 2021 13:18:13 GMT
x-content-type-options: nosniff
age: 576542
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Fri, 01 Oct 2021 13:18:13 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame AEF2 15 KB
15 KB 28ms
6ms Font
font/woff2 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 19:58:13 GMT
x-content-type-options: nosniff
age: 293342
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 27 Sep 2022 19:58:13 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame AEF2 15 KB
15 KB 33ms
11ms Font
font/woff2 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 28 Sep 2021 01:35:26 GMT
x-content-type-options: nosniff
age: 273109
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 28 Sep 2022 01:35:26 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame AEF2 102 B
134 B 16ms
15ms Other
text/javascript 142.250.185.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=-TriQeni1Ls-Mdq_ssN2cUL5

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f4.1e100.net

Software

GSE /

Resource Hash

28cef70df91237002571f751148d45bb126a81b241be56d9f304f7d8706be505

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcTY6YZAAAAAIaSBP-bbSkwzD8YJqtAs1ALgdaP&co=aHR0cHM6Ly9hdHRhY2tzaW11bGF0b3IuY29tOjQ0Mw..&hl=de&v=-TriQeni1Ls-Mdq_ssN2cUL5&size=invisible&cb=g80bkk97cj38
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Fri, 01 Oct 2021 05:27:15 GMT

POST
H2 204 collect Show response
d.clarity.ms/ 0
178 B 560ms
328ms XHR
text/plain 40.76.174.66
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/eus/s/0.6.24/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.76.174.66 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin: https://attacksimulator.com
date: Fri, 01 Oct 2021 05:27:15 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111

GET
H2 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
519 B 142ms
118ms Image
image/gif 104.16.88.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1

Requested by

Host: attacksimulator.com
URL: https://attacksimulator.com/blog/new-android-malware-tanglebot/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.88.5 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:15 GMT
cf-cache-status: DYNAMIC
server: cloudflare
x-hubspot-correlation-id: 39bbba7a-160c-48fd-ae46-ef98fe0f4eb9
x-trace: 2BC1956171AC1174CA0D61C1A4C14DBC32FD2B162E000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 697347e34a63062d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 35
x-robots-tag: none

POST
H3 200 reload Show response
www.google.com/recaptcha/api2/ Frame AEF2 29 KB
16 KB 54ms
53ms XHR
application/json 142.250.185.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6LcTY6YZAAAAAIaSBP-bbSkwzD8YJqtAs1ALgdaP

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-TriQeni1Ls-Mdq_ssN2cUL5/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f4.1e100.net

Software

GSE /

Resource Hash

fca57d4ae8321d33ff2c7c6f1c4a0d9ca88f1e8037596c3559d9fc980209d5f1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcTY6YZAAAAAIaSBP-bbSkwzD8YJqtAs1ALgdaP&co=aHR0cHM6Ly9hdHRhY2tzaW11bGF0b3IuY29tOjQ0Mw..&hl=de&v=-TriQeni1Ls-Mdq_ssN2cUL5&size=invisible&cb=g80bkk97cj38
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Fri, 01 Oct 2021 05:27:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16494
x-xss-protection: 1; mode=block
expires: Fri, 01 Oct 2021 05:27:15 GMT

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
990 B 58ms
33ms Image
image/gif 104.19.154.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3169173831&v=1.1&a=7753086&ct=blog-post&rcu=https%3A%2F%2Fattacksimulator.com%2Fblog%2Fnew-android-malware-tanglebot%2F&pu=https%3A%2F%2Fattacksimulator.com%2Fblog%2Fnew-android-malware-tanglebot%2F&t=New+COVID-19+Themed+Android+Malware+Reaches+Deep+Into+Device+Functions+-+ATTACK+Simulator&cts=1633066035847&vi=47ce6647b550bf74b3500f69e879c9b7&nc=true&ce=false&cc=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.154.83 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:15 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: b4f22db6-9d74-4131-b5af-2475124cc27d
cf-ray: 697347e43bb02c42-FRA
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 45
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2%2Fc7Qx5BdAQtPNm702bcbRucctxrUvPz7%2FtNffTYtYFbO%2BdGz3mRjclOpOe7cLke2J3M41V6Yn0StdT3uFQBAC5OvP8jxrZhZHbKVHTzrk5DVYaH%2F%2B%2F6pIqbKsaXgz6p4d%2BY"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
x-robots-tag: none

GET
H3 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 2 KB
2 KB 170ms
158ms XHR
application/json 104.19.154.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=7753086&utk=47ce6647b550bf74b3500f69e879c9b7&__hstc=252785622.47ce6647b550bf74b3500f69e879c9b7.1633066035845.1633066035845.1633066035845.1&__hssc=252785622.1.1633066035845&currentUrl=https%3A%2F%2Fattacksimulator.com%2Fblog%2Fnew-android-malware-tanglebot%2F

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.154.83 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f76a75ff7c17fd54e12c0595cc431de1384a7aab0eca8e8aa4d1f56ed22cf13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:16 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 0922256b-e52d-4f7b-b473-db6693c07bf6
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-robots-tag: none
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h8H5UeEQYfufHTCJfOs9tPcZj8f6CH5K3cWeLGynHQxAqQBJC6jUNxs7%2BHc6dckgvYKMSM5gRpedGvI9THd7YuV5DE2dv97NahGlYnm2ubxiW7NHw4ELw%2B2BD%2F%2FWC%2BB9Xog0"}],"group":"cf-nel","max_age":604800}
content-type: application/json;charset=utf-8
access-control-allow-origin: https://attacksimulator.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
cf-ray: 697347e45a584e74-FRA
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent

GET
H3 200 __ptq.gif
track.hubspot.com/ 45 B
759 B 46ms
36ms Image
image/gif 104.19.154.83
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=16&fi=bf837bff-219e-4856-9ed7-ac363d51f376&lfi=1801749&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3169173831&v=1.1&a=7753086&ct=blog-post&rcu=https%3A%2F%2Fattacksimulator.com%2Fblog%2Fnew-android-malware-tanglebot%2F&pu=https%3A%2F%2Fattacksimulator.com%2Fblog%2Fnew-android-malware-tanglebot%2F&t=New+COVID-19+Themed+Android+Malware+Reaches+Deep+Into+Device+Functions+-+ATTACK+Simulator&cts=1633066036057&vi=47ce6647b550bf74b3500f69e879c9b7&nc=true&u=252785622.47ce6647b550bf74b3500f69e879c9b7.1633066035845.1633066035845.1633066035845.1&b=252785622.1.1633066035845&cc=15

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.154.83 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:27:16 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 3985d174-2749-43f8-bac3-4c4c7fed435b
cf-ray: 697347e5780b6957-FRA
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 45
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UtibMzdO%2Bk5CYd9ql979EWBDBcnMH72ECMScajl5LzQVTBl06xMRsokHXetGOBHoL8mczQEsmKurqSTv2SYFmV8VeIjdO376koT3synCBbZfqjT8ouMrAtyL4Z7QdVm%2BuPv2"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
x-robots-tag: none

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
6ms Image
image/gif 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j93&a=1931617203&t=event&ni=1&_s=2&dl=https%3A%2F%2Fattacksimulator.com%2Fblog%2Fnew-android-malware-tanglebot%2F&ul=en-us&de=UTF-8&dt=New%20COVID-19%20Themed%20Android%20Malware%20Reaches%20Deep%20Into%20Device%20Functions%20-%20ATTACK%20Simulator&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Clarity&ea=1u6chi6&_u=aDDAAUABAAAAAC~&jid=&gjid=&cid=1861394100.1633066035&tid=UA-187846804-1&_gid=221811202.1633066036&gtm=2ou9r0&cd1=https%3A%2F%2Fclarity.microsoft.com%2Fga%2F7nx3my8idx%2Fsa3bvu%2F1u6chi6&z=197166149

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Sep 2021 14:12:12 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54904
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 logo-filled-300.png
cdn2.hubspot.net/hubfs/7753086/ 5 KB
6 KB 108ms
82ms Image
image/webp 104.17.244.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn2.hubspot.net/hubfs/7753086/logo-filled-300.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.244.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1559e651d90b7bf0bc6020518c391d7de2559460dbbd055817a235ae4d7d04c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-meta-cache-tag: F-43668997035,P-7753086,FLS-ALL
age: 932841
x-amz-server-side-encryption: AES256
edge-cache-tag: F-43668997035,P-7753086,FLS-ALL
x-amz-replication-status: COMPLETED
content-disposition: inline; filename="logo-filled-300.webp"
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 12
x-amz-request-id: N6J7MPJB6DSB3DCT
cf-bgj: imgq:85,h2pri
etag: "92473c0609ca93af6c29fd11e3affe4d"
vary: Accept, Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-robots-tag: none
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 12
x-amz-meta-created-unix-time-millis: 1616506974137
date: Fri, 01 Oct 2021 05:27:17 GMT
via: 1.1 f2fa38e6635ded6d22a69d089217bc90.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: FRA56-C1
x-hs-alternate-content-type: text/plain
cf-polished: origFmt=png, origSize=9885
x-cache: RefreshHit from cloudfront
x-amz-meta-index-tag: none
content-length: 5256
x-amz-id-2: 6Qos7x+SStQ1YWrRMs2jYYQrDBYq+nbeU3kbEb+tGjjEHSm7ibfoil7JnhZGzxwhCXlIKv74y7g=
last-modified: Tue, 23 Mar 2021 13:42:55 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZtGhVaE6ecUEcR80dIctmDupv%2Fj%2BIHNhabOULlwC8LWeQLLUiqzH2e6tkrNWpzneJBQpkNz0H30b7Z2XKtE%2BfBPXWER9CZOU3hcp9aM96oFEeYTRfCRLqMW%2BQwp4YkVWTgE%3D"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: 4RnTb6TzlsFRFiABOsxyGXcDpLN58FZg
accept-ranges: bytes
cf-ray: 697347ebcbcec29a-FRA
x-amz-cf-id: yId6FU9JrABwhTX-otqS4ZwwtuQrhpd2FisFyr7fLZaqVwO_VaqaBw==

POST
H2 204 collect Show response
d.clarity.ms/ 0
48 B 109ms
109ms XHR
text/plain 40.76.174.66
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/eus/s/0.6.24/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.76.174.66 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://attacksimulator.com/blog/new-android-malware-tanglebot/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin: https://attacksimulator.com
date: Fri, 01 Oct 2021 05:27:16 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111

Verdicts & Comments Add Verdict or Comment

157 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

20 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.google.com/recaptcha	1970-01-20 01:56:58	Name: _GRECAPTCHA Value: 09AOdpsqLk555nZ5QkwHzJm-uExhLhwY_lQFF_MLz5p2TZUiuyCg9nnGnhCoPaKoCSi8fdasyrHHRLq5Mo63CG2Lw
attacksimulator.com/	1970-01-19 22:20:58	Name: ac_enable_tracking Value: 1
www.clarity.ms/	1970-01-20 06:23:22	Name: CLID Value: 6888401a25274091a3f6428d5b1262b5.20211001.20221001
.attacksimulator.com/	1970-01-20 15:08:58	Name: _ga_DJ4MCYXH9D Value: GS1.1.1633066035.1.0.1633066035.0
prism.app-us1.com/	1970-01-19 22:20:58	Name: prism_26612610 Value: 2d9a4fb0-703d-4bc9-af99-0793a3b0c6bc
.attacksimulator.com/	1970-01-20 06:23:22	Name: _clck Value: sa3bvu\|1\|ev7\|0
.c.bing.com/	1970-01-20 06:59:22	Name: SRM_B Value: 285F1645CEA66A4920D50686CFE36BFC
.attacksimulator.com/	1970-01-19 22:20:58	Name: prism_26612610 Value: 2d9a4fb0-703d-4bc9-af99-0793a3b0c6bc
.attacksimulator.com/	1970-01-20 15:08:58	Name: _ga Value: GA1.2.1861394100.1633066035
.attacksimulator.com/	1970-01-19 21:39:12	Name: _gid Value: GA1.2.221811202.1633066036
.attacksimulator.com/	1970-01-19 21:37:46	Name: _gat_gtag_UA_187846804_1 Value: 1
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-20 06:59:22	Name: MUID Value: 285F1645CEA66A4920D50686CFE36BFC
.c.clarity.ms/	1970-01-19 21:37:46	Name: ANONCHK Value: 0
.attacksimulator.com/	1970-01-20 06:59:22	Name: __hstc Value: 252785622.47ce6647b550bf74b3500f69e879c9b7.1633066035845.1633066035845.1633066035845.1
.attacksimulator.com/	1970-01-20 06:59:22	Name: hubspotutk Value: 47ce6647b550bf74b3500f69e879c9b7
.attacksimulator.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.attacksimulator.com/	1970-01-19 21:37:47	Name: __hssc Value: 252785622.1.1633066035845
.hubspot.com/	1970-01-19 21:37:47	Name: __cf_bm Value: er0FD_ub_OHvMsvHbncXXFnalFkDzkhK0mvxbeBN7Co-1633066035-0-AX1D3yJt2oNGKL8PfTCZdNbDNuMsHPfQcOb3VwX6cElYO+ukd6k8yt2OxBR4GF9PEgDuB9NTK9pQD8QnsaoTYpk=
.attacksimulator.com/	1970-01-19 21:39:12	Name: _clsk Value: 1u6chi6\|1633066036208\|1\|1\|d.clarity.ms/collect

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

attacksimulator.com
c.bing.com
c.clarity.ms
c0.wp.com
cdn2.hubspot.net
d.clarity.ms
diffuser-cdn.app-us1.com
fonts.gstatic.com
forms.hsforms.com
forms.hubspot.com
i1.wp.com
i2.wp.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hscollectedforms.net
js.hsleadflows.net
pixel.wp.com
prism.app-us1.com
stackpath.bootstrapcdn.com
stats.wp.com
track.hubspot.com
trackcmp.net
www.clarity.ms
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.gstatic.com
104.16.88.5
104.17.128.171
104.17.145.91
104.17.210.204
104.17.231.204
104.17.244.204
104.17.71.176
104.18.10.207
104.18.21.191
104.19.154.83
104.212.67.157
13.107.21.200
142.250.184.200
142.250.184.238
142.250.185.132
142.250.186.35
172.217.23.99
192.0.76.3
192.0.77.2
192.0.77.37
40.76.174.66
52.142.114.2
54.162.17.5
94.130.135.206
01ebad6ab8aab56fc64cc183ad1bbdb029c8cb7a743149c69eb8b58f416e43a4
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
03d2d2a2bfc8255adbe035dbe470e88fa06929608e114a73b292ca2b31fed778
07ef661be38be006eb690a15613c557d418b8780900ff490545bb2b75d23fcd7
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103
192a2063fbade1f2bc789cff35aa1ff6a25281750b4a961a549c285cfdc250dc
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1ca76922f55b389b8f590ae7e3bcc3a2dccdce3aff1e5a4335af081b76a414ea
20ea4672f086c9f857fd54b500ff0e413ed7b5f2e8dd0a5dec998e0b7c9270d5
249fc6136655c3dabc4bbf910ae654b13afc6a2f58e6388d0520f613ce820394
28cef70df91237002571f751148d45bb126a81b241be56d9f304f7d8706be505
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
36fda9e4a533407607eab3d71d6212eb7b7ccb9c623cf6813be4208532252e9a
399cefedaa166f14db5e61880df24a5906e3b28f13bf0d665cf471b664501f5d
3d6ffd09624842608fc9099c37c189875759d596ae040451561d8459bf2bdd6d
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3e34fb430ed25b25c68112919ccac0ce286f8690194fd1f9d6fe743129214552
3e6131330963c472b950b8aaf544ba3829735b8ccb103d614ba7793e3a786550
40cb3fe6821556d72734200c197700f0e75f0ce6aec97e4a66c4f26790f18eda
422dd3e64896e13ec274b0bf15eac6439cdee8e0bd14265eaebd27a4ae507dc7
4244f97e49ee5a5fd27cc0eddfd756d27648a4eee056cff069b261b96ea70ebe
443ba0af7a7ed827223c7fb3c008c02b9ff1d651b6492e9c270378b07d9f6008
462747422c6af30aa81a0373fa1cfd736455cef52bdbb816f67be9531d84eace
46f4d00c89bfcdab9f60de0ea4f1f30abf10cfbf90d7b66ec48fbb9104ee5928
4adb7a9cb767b327596d7e9d8fd195546e894325a10df19d385d87030a04ffd7
4c71cab3e2b7defd9022059c922d2c91359df1ba71dd47e8543b108c70537f25
4e837d8432bdf15edfd570a21596654cffde24335c060373700a3dd542977cd7
4ebee4e7ed4b899128d2abb2e86c8ad2ccc2232156572a6cb7dd9e6a974a7925
5029032bdb39ef38c22d1fe99573b1aec6b64824fbf837c185327810f1b25de3
55bd442d45ef481e3f0eb795894dd94f1a5e38f2a4847c2f49371010e1e013c2
58c87bd2b89dc90a862e4c6293f20390f52fdb1e685788d7ffe7de1636ad5020
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5aa24e4ab926693e29ffb0d0ca1557141defd3ca61b3b4e7caebaa2fcd5bf327
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f
62a6e39931fdade454bf74dd1f40ed0a2ba8eef2f69e99513b44df1e5ba54bfa
64dedd47374d0eda43cdeaf0ed5806d3f0ab1b50f360c9fb6d932f68c9d2c812
64edb862b0ca755c9e03b07c2d2d3fa3fcc59a417cbad9d1fb8b5cf5eb040ad8
69bf8b1cdd4daea1e6a286efac67b5deeda0ca248327e14ff7cf889607c60665
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b7fcb4df3b767f9d0033039b632aa39bc74f4d20fab4d21b38ad06bb3365dfb
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bbb5e354138bdacaf7fe81409ec991637f79792f4a140480764628a993e7251
6c1510ef35e8322bf3c09c53aa955cd3b0a9e5ac65d15dd518c84ffc4b511c9f
71b86f2fc9657145fec62471ea9436544823a2c8d72f47fcad8060ad3ccfb89c
72336773056658b94f86a862d0eff531d8ddd92757eebf183451ee6a24934d71
7360247aa71631b7a1af89fbd2d2fed41a85faa26e0e825b242857716f8d9e82
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7b3a7e4265228a39bea0d22ac1aedb86219a7b521a831827f7f4579ca5ae4156
7f34b768792b90cf0b04fced2470e43d8fab7644f6565d5178fbfb49c4859cee
7f76a75ff7c17fd54e12c0595cc431de1384a7aab0eca8e8aa4d1f56ed22cf13
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
839559eed175dd5d3d5c3409116e9a6c053489d886a83048d523c2e23ded7766
8ca2513bb0a173ad2bff786ea33697232a5d3562046a5197a700ed8ab51cb1e7
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
91298c29454e0502262eff1f64b1f55e1d7581f0917a4a33c906a7e6214fff28
98a7cec2f5b98d2a0ae6efb46404fe6ff0aacbaa06da9474ceed6271e6271e08
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a19938485ca7f6c582d3f78d17d9e443d26b260cac24c9dd9499f70b5d28390
9af98e149ed5a7af3bbfe75257ddb5a7d4bc5f0be036822f89b2a1fa809fd21e
a0e8f49ce2aa1c4720cc187c184c8d800182aea43645aa3193c0614703d0c8f4
a19b8f2acae60fb0df544a326fb0e0a3d9f71f0645c2f23a0e69daef21430460
ab348def7a91b2ae43926c6c08fc90bf77fa8c7091f7e9e9549185eb3fbeb3d5
ad44ca29f2237a973fca511736a9fb24557a4bd074f0703a72abb7f3e92ed960
adc9bbc7e4048a011ddb534439068515ab95e69e099c4fbf60e699c732258e45
b0236d5c7c5a438a04858e85fe41d24cdcc0cf55a99a45cd2dc36bef08905980
b14541a3e71a2b474852f6bf5bd736cd19343aeaf2b12758c1d4879d223948d7
b1559e651d90b7bf0bc6020518c391d7de2559460dbbd055817a235ae4d7d04c
b38803f733f36ff943399e6539b7fe1fa26611706ce6878b5b21c6a4f96ec862
b709ed74fc13dd3d9bce315ca6e0ad25054844434fc494f1f95e999d0662c15e
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
be843202301857f5d5c4094e4be0f9ace7f279e2dae06292036f29520cf7891a
bffafb30adf0c09bfbf909eaa779391296499123dc3d90e429056ec896b2ebb9
c47777a4374d9344402f6136e2fbb833540d1df1fd72bd5cecad8502235b8c9a
c4a33f4cc6363eca2411ba813333976bf4861bdb8a28f215402a5fd9f8acdc2f
c60209be192e782443d96c9e00850e782a136bb89b4d48a72b5d64e0da5496a2
c91fc203d2217bfe73c27d4abe601786da50b46d2332dfa6bcb3d63c393ac72e
ca098104a5a5a18d1472fd95541c2edeb93c1a3c1b8b3598090aa57e0bcf8875
cc106b0539e64c13b080a74cd0bd729d98396db9564286f60063bacb96d21882
cc80ee7dd5427dd0cc7d1d5946741602f23922766f81670e855b902c5d8cc0b6
cdcbc2f3f69d2fb5e807346244695d0a4110bbad355ac97e3778400ad12ef771
d201a2c3118a00c82cc48e89815f5139f23956bbe248107dcf522acc77b97c09
db9cdc732c9377cdfefb27cfd0375ed01ce41786f1b31d32dd93dcbe15da9cfb
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
df871b327e79278c405d56fe05db409c136288193db2d6b75450824e45512115
e01c475e0e12c653ab81ee33b58e8d00cee55755911d9d066af793ef80dead42
e1b0066bc1972444c0a15e1778be06ed7bf36c55d597c065b5e79041bcda291e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4afc24136181320da3f87e8907fb4ad5e72b7c7f1a7fd8a90da91fa94ae9dc4
e71bf6952ed7a57737e3862d117a2299960b4e7f2238c665c8ea8c9826fe8fce
eb16adb0a04fd9919e25b0b40648299d7cac31e110a72957460ba65401be671f
ef8b2a42e84013192b60517040f37611f2f19ddd27fab626251f3b5e66657fbf
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
fca57d4ae8321d33ff2c7c6f1c4a0d9ca88f1e8037596c3559d9fc980209d5f1
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

attacksimulator.com Open in urlscan Pro 94.130.135.206 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

102 Requests

100 %HTTPS

0 %IPv6

19 Domains

28 Subdomains

24 IPs

4 Countries

2000 kBTransfer

4669 kBSize

20 Cookies

14 Outgoing links

Redirected requests

102 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

attacksimulator.com Open in urlscan Pro
94.130.135.206 Public Scan

Screenshot
Live screenshot

Full Image

102
Requests

100 %
HTTPS

0 %
IPv6

19
Domains

28
Subdomains

24
IPs

4
Countries

2000 kB
Transfer

4669 kB
Size

20
Cookies

102 HTTP transactions
1 data transactions