blog.cyble.com Open in urlscan Pro
192.0.78.183 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/Q8QvOWtpCM
Effective URL:
https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Submission: On October 20 via manual (October 20th 2021, 6:13:13 pm UTC) from US — Scanned from DE

Summary HTTP 76 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 25 IPs in 6 countries across 21 domains to perform 76 HTTP transactions. The main IP is 192.0.78.183, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is blog.cyble.com.
TLS certificate: Issued by R3 on September 13th 2021. Valid for: 3 months.

This is the only time blog.cyble.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
1 1	192.0.78.207 192.0.78.207	2635 (AUTOMATTIC) (AUTOMATTIC)
22	192.0.78.183 192.0.78.183	2635 (AUTOMATTIC) (AUTOMATTIC)
2	142.250.186.42 142.250.186.42	15169 (GOOGLE) (GOOGLE)
2	142.250.185.104 142.250.185.104	15169 (GOOGLE) (GOOGLE)
5	192.0.77.32 192.0.77.32	2635 (AUTOMATTIC) (AUTOMATTIC)
2	142.250.185.164 142.250.185.164	15169 (GOOGLE) (GOOGLE)
4	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
3	142.250.186.163 142.250.186.163	15169 (GOOGLE) (GOOGLE)
7	130.211.21.179 130.211.21.179	15169 (GOOGLE) (GOOGLE)
2	93.184.220.66 93.184.220.66	15133 (EDGECAST) (EDGECAST)
1	157.240.20.15 157.240.20.15	32934 (FACEBOOK) (FACEBOOK)
4	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
1	192.0.78.23 192.0.78.23	2635 (AUTOMATTIC) (AUTOMATTIC)
3	142.250.185.142 142.250.185.142	15169 (GOOGLE) (GOOGLE)
1	104.244.42.72 104.244.42.72	13414 (TWITTER) (TWITTER)
1	151.101.130.217 151.101.130.217	54113 (FASTLY) (FASTLY)
7 11	34.246.96.178 34.246.96.178	16509 (AMAZON-02) (AMAZON-02)
3 4	37.252.173.62 37.252.173.62	29990 (ASN-APPNEX) (ASN-APPNEX)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1 1	104.69.95.62 104.69.95.62	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	34.201.86.165 34.201.86.165	14618 (AMAZON-AES) (AMAZON-AES)
1 2	18.156.0.31 18.156.0.31	16509 (AMAZON-02) (AMAZON-02)
1 2	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	172.217.23.98 172.217.23.98	15169 (GOOGLE) (GOOGLE)
5	142.250.186.80 142.250.186.80	15169 (GOOGLE) (GOOGLE)
76	25

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.78.207 (San Francisco, United States) 1 redirects

ASN2635 (AUTOMATTIC, US)

cybleinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 192.0.78.183 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

blog.cyble.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.42 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.104 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

s0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
widgets.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.164 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.163 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 130.211.21.179 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 179.21.211.130.bc.googleusercontent.com

koi-3qnocuxufa.marketingautomation.services	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 93.184.220.66 (London, United Kingdom)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.20.15 (United States)

ASN32934 (FACEBOOK, US)
PTR: edge-star-shv-02-frt3.facebook.com

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.78.23 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

public-api.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.142 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.72 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.130.217 (United States)

ASN54113 (FASTLY, US)

tag.perfectaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 34.246.96.178 (Dublin, Ireland) 7 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-246-96-178.eu-west-1.compute.amazonaws.com

pixel-geo.prfct.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 37.252.173.62 (Ascension Island) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.69.95.62 (Netherlands) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a104-69-95-62.deploy.static.akamaitechnologies.com

cw.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.201.86.165 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-201-86-165.compute-1.amazonaws.com

pixel.prfct.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.156.0.31 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.23.98 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f98.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.186.80 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f16.1e100.net

storage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	cyble.com blog.cyble.com	711 KB
12	prfct.co 7 redirects pixel-geo.prfct.co pixel.prfct.co	5 KB
9	wp.com s0.wp.com stats.wp.com widgets.wp.com pixel.wp.com	33 KB
7	marketingautomation.services koi-3qnocuxufa.marketingautomation.services	125 KB
7	gstatic.com fonts.gstatic.com www.gstatic.com	353 KB
7	googleapis.com fonts.googleapis.com storage.googleapis.com	2 MB
4	adnxs.com 3 redirects secure.adnxs.com	4 KB
4	twitter.com platform.twitter.com syndication.twitter.com analytics.twitter.com	133 KB
3	google-analytics.com www.google-analytics.com	20 KB
2	doubleclick.net 2 redirects cm.g.doubleclick.net	642 B
2	openx.net 1 redirects us-u.openx.net	473 B
2	yahoo.com 1 redirects ups.analytics.yahoo.com	1 KB
2	google.com www.google.com	2 KB
2	googletagmanager.com www.googletagmanager.com	77 KB
1	rubiconproject.com pixel.rubiconproject.com	239 B
1	addthis.com 1 redirects cw.addthis.com	453 B
1	perfectaudience.com tag.perfectaudience.com	4 KB
1	wordpress.com public-api.wordpress.com	3 KB
1	facebook.com graph.facebook.com	678 B
1	cybleinc.com 1 redirects cybleinc.com	177 B
1	t.co t.co	554 B
76	21

	Domain	Requested by
22	blog.cyble.com	t.co blog.cyble.com
11	pixel-geo.prfct.co	7 redirects blog.cyble.com
7	koi-3qnocuxufa.marketingautomation.services	blog.cyble.com koi-3qnocuxufa.marketingautomation.services storage.googleapis.com
5	storage.googleapis.com	koi-3qnocuxufa.marketingautomation.services
4	secure.adnxs.com	3 redirects blog.cyble.com
4	www.gstatic.com	www.google.com www.gstatic.com
4	s0.wp.com	blog.cyble.com widgets.wp.com public-api.wordpress.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
3	pixel.wp.com	blog.cyble.com
3	fonts.gstatic.com	fonts.googleapis.com www.google.com
2	cm.g.doubleclick.net	2 redirects
2	us-u.openx.net	1 redirects blog.cyble.com
2	ups.analytics.yahoo.com	1 redirects blog.cyble.com
2	platform.twitter.com	blog.cyble.com platform.twitter.com
2	www.google.com	blog.cyble.com www.gstatic.com
2	www.googletagmanager.com	blog.cyble.com www.googletagmanager.com
2	fonts.googleapis.com	blog.cyble.com storage.googleapis.com
1	pixel.rubiconproject.com	blog.cyble.com
1	pixel.prfct.co	blog.cyble.com
1	cw.addthis.com	1 redirects
1	analytics.twitter.com	blog.cyble.com
1	tag.perfectaudience.com	koi-3qnocuxufa.marketingautomation.services
1	syndication.twitter.com	platform.twitter.com
1	public-api.wordpress.com	s0.wp.com
1	graph.facebook.com	blog.cyble.com
1	widgets.wp.com	blog.cyble.com
1	stats.wp.com	blog.cyble.com
1	cybleinc.com	1 redirects
1	t.co
76	29

This site contains links to these domains. Also see Links.

Domain
cyble.com
cyble.io
www.cyble.com
securitnews.wordpress.com

Subject Issuer	Validity	Valid
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
tls.automattic.com R3	`2021-09-13` - `2021-12-12`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-10-04` - `2021-12-27`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-10-04` - `2021-12-27`	3 months	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
www.google.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.marketingautomation.services Sectigo RSA Organization Validation Secure Server CA	`2020-03-12` - `2022-06-10`	2 years	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-05` - `2021-11-09`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-07-30` - `2021-10-28`	3 months	crt.sh
*.wordpress.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-12` - `2022-11-14`	2 years	crt.sh
syndication.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
*.google.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.perfectaudience.com GlobalSign Atlas R3 DV TLS CA 2020	`2021-03-22` - `2022-04-23`	a year	crt.sh
*.prfct.co DigiCert SHA2 Secure Server CA	`2019-09-03` - `2021-10-27`	2 years	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-08-17` - `2022-02-09`	6 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-03-30` - `2022-04-04`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.storage.googleapis.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh

This page contains 6 frames:

Primary Page: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Frame ID: 60834A3934B25B98E00D3196C93390D1
Requests: 55 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/master.html?ver=202142
Frame ID: B1F21A5546589494D477DBA25B81FE0A
Requests: 3 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.a53eecb4584348a2ad32ec2ae21f6eae.html?origin=https%3A%2F%2Fblog.cyble.com
Frame ID: CE7749702B1F58CE5696CB9D09B949FA
Requests: 2 HTTP requests in this frame

Frame: https://public-api.wordpress.com/wp-admin/rest-proxy/
Frame ID: 4C875FAA19E71AA6F04C6B7AEF553375
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeHcNgZAAAAAP4lW4yfIY5QQVwVhNhqOGG-R8Za&co=aHR0cHM6Ly9ibG9nLmN5YmxlLmNvbTo0NDM.&hl=de&v=YhkYx1k-yvvb8OonJPmOpoJY&size=invisible&cb=fgxa71122rmt
Frame ID: 65C1D8E4A03C16BA3B2821073A54E731
Requests: 5 HTTP requests in this frame

Frame: https://koi-3qnocuxufa.marketingautomation.services/publicChatbot?&requestedLanguage=en_US
Frame ID: 869B7CC8DE7CC58E3DCE99DE6655AA1C
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Deep Dive into BlackCocaine Ransomware — Cyble

Page URL History Show full URLs

https://t.co/Q8QvOWtpCM Page URL
https://cybleinc.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/ HTTP 301
https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
<link[^>]+s\d+\.wp\.com
/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

<(?:iframe|img)[^>]+adnxs\.(?:net|com)
adnxs\.(?:net|com)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Polyfill (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/polyfill\.min\.js

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

76
Requests

100 %
HTTPS

0 %
IPv6

21
Domains

29
Subdomains

25
IPs

6
Countries

3494 kB
Transfer

10050 kB
Size

29
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://cyble.com/
Title: Cyble Home

Search URL Search Domain Scan URL

URL: https://cyble.com/contact-us.php
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://cyble.com/cyble-vision.php
Title: Cyble Vision (Enterprise)

Search URL Search Domain Scan URL

URL: https://cyble.com/amibreached.php
Title: AmiBreached (Consumer)

Search URL Search Domain Scan URL

URL: https://cyble.com/capabilities.php
Title: Capabilities

Search URL Search Domain Scan URL

URL: https://cyble.com/about-us.php
Title: About Us

Search URL Search Domain Scan URL

URL: https://cyble.com/press.php
Title: Press Releases

Search URL Search Domain Scan URL

URL: https://cyble.io/amibreached
Title: AmIBreached.com

Search URL Search Domain Scan URL

URL: http://www.cyble.com/
Title: www.cyble.com

Search URL Search Domain Scan URL

URL: https://securitnews.wordpress.com/2021/06/05/blackcocaine-ransomware-a-new-malware-in-the-threat-landscapesecurity-affairs/
Title: BlackCocaine Ransomware, a new malware in the threat landscapeSecurity Affairs – SecuritNEWS

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/Q8QvOWtpCM Page URL
https://cybleinc.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/ HTTP 301
https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 54

https://pixel-geo.prfct.co/tagjs?a_id=167159&source=js_tag HTTP 302
https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=167159&source=js_tag

Request Chain 55

https://secure.adnxs.com/getuid?https://pixel-geo.prfct.co/usermap/?xid=$UID&sid=202110|61705c338e8c3c63fd1165ee&pid=pa_eopiesZY0CVQYMVX8 HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fpixel-geo.prfct.co%2Fusermap%2F%3Fxid%3D%24UID%26sid%3D202110%7C61705c338e8c3c63fd1165ee%26pid%3Dpa_eopiesZY0CVQYMVX8 HTTP 302
https://pixel-geo.prfct.co/usermap/?xid=269546146418669731&sid=202110|61705c338e8c3c63fd1165ee&pid=pa_eopiesZY0CVQYMVX8

Request Chain 56

https://pixel-geo.prfct.co/cs/?partnerId=twtr HTTP 302
https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_eopiesZY0CVQYMVX8

Request Chain 57

https://pixel-geo.prfct.co/cs/?partnerId=crw HTTP 302
https://cw.addthis.com/t.gif?pid=37&pidt=0&pdid=pa_eopiesZY0CVQYMVX8&cu=https%3A%2F%2Fpixel.prfct.co%2Fcb%3FpartnerId%3Dcrw HTTP 302
https://pixel.prfct.co/cb?partnerId=crw

Request Chain 58

https://pixel-geo.prfct.co/cs/?partnerId=yah HTTP 302
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_eopiesZY0CVQYMVX8&_origin=1 HTTP 302
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_eopiesZY0CVQYMVX8&_origin=1&verify=true

Request Chain 59

https://pixel-geo.prfct.co/cs/?partnerId=opx HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_eopiesZY0CVQYMVX8 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537114372&val=pa_eopiesZY0CVQYMVX8

Request Chain 60

https://pixel-geo.prfct.co/cs/?partnerId=rbcn HTTP 302
https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_eopiesZY0CVQYMVX8

Request Chain 61

https://pixel-geo.prfct.co/cs/?partnerId=goo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=nowspots_bidder&google_hm=cGFfZW9waWVzWlkwQ1ZRWU1WWDg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=nowspots_bidder&google_hm=cGFfZW9waWVzWlkwQ1ZRWU1WWDg&google_tc= HTTP 302
https://pixel-geo.prfct.co/cb?partnerId=goo

Request Chain 63

https://secure.adnxs.com/seg?t=2&add=27052482 HTTP 307
https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D27052482

76 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Q8QvOWtpCM
t.co/ 444 B
554 B 146ms
130ms Document
text/html 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/Q8QvOWtpCM

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

:method: GET
:authority: t.co
:scheme: https
:path: /Q8QvOWtpCM
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Wed, 20 Oct 2021 18:13:04 GMT
vary: Origin
server: tsa_o
expires: Wed, 20 Oct 2021 18:18:05 GMT
set-cookie: muc=24c240d7-eb89-497e-be2b-98d777db1e2e; Max-Age=63072000; Expires=Fri, 20 Oct 2023 18:13:05 GMT; Domain=t.co; Secure; SameSite=None
content-type: text/html; charset=utf-8
cache-control: private,max-age=300
content-length: 239
content-encoding: gzip
x-xss-protection: 0
strict-transport-security: max-age=0
x-connection-hash: 9e8cf50fc230bee2f96a8ae464bae149380df2fe734be5b2d70123773173d8dd

GET
H2

200

Primary Request / Show response
blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Redirect Chain

https://cybleinc.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

177 KB
45 KB

643ms
613ms

Document
text/html

192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Requested by

Host: t.co
URL: https://t.co/Q8QvOWtpCM

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

e59c72af5434c3ae50fcd367e1d4d41805765dac58528c94b1b0fe22616ee6e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: blog.cyble.com
:scheme: https
:path: /2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://t.co/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://t.co/Q8QvOWtpCM

Response headers

server: nginx
date: Wed, 20 Oct 2021 18:13:06 GMT
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000
vary: Accept-Encoding Cookie
x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
host-header: WordPress.com
x-pingback: https://blog.cyble.com/xmlrpc.php
link: <https://blog.cyble.com/wp-json/>; rel="https://api.w.org/" <https://blog.cyble.com/wp-json/wp/v2/posts/5019>; rel="alternate"; type="application/json" <https://wp.me/pbX1h1-1iX>; rel=shortlink
content-encoding: br
x-ac: 2.hhn _atomic_ams

Redirect headers

server: nginx
date: Wed, 20 Oct 2021 18:13:06 GMT
content-type: text/html; charset=utf-8
location: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
strict-transport-security: max-age=31536000
vary: Cookie
x-ac: 2.hhn _dca

GET
H2 200 /
blog.cyble.com/_static/ 390 KB
59 KB 305ms
304ms Stylesheet
text/css 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/_static/??-eJyVkdFuwjAMRX9oIZQWBA/TPmVyEy8E3CSKE1X9+xkEWkEq214qX8XHvu4dkzIxFAxFJ6rOB9YnLAnMWQ/RVkLWGQkKWpUilye1Msxv48+IcsRBCOCSQb6MAkiLHnzwXx6t5jIRrkQ+k/flrorsMTvdV09W9xTNWZHvM+Tphi+gBFOsRbns7WOjD4aqFV8ncYLWA5LYFHIukuCYFaEDM80dLtLyNtevrhpjtikjs+IChdUAAZxsSzle/8/Lu57zIH/GBaQmimBvASiwNoZ5rXZNh13b2Bb7/XarmsN+06wPm79uHr11l0g5Gg+kvPQ/iqVBAUcmLAXz/07lI2S04n26lj6438hPietuiaKL/CBeZXSfcMnjVl9aP4b3Ztd2TbdudutvGLI0Vg==

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f9a1b42f20a092d66a17aa396c661eecaa4eae05b7136b66116de91a71760f95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /_static/??-eJyVkdFuwjAMRX9oIZQWBA/TPmVyEy8E3CSKE1X9+xkEWkEq214qX8XHvu4dkzIxFAxFJ6rOB9YnLAnMWQ/RVkLWGQkKWpUilye1Msxv48+IcsRBCOCSQb6MAkiLHnzwXx6t5jIRrkQ+k/flrorsMTvdV09W9xTNWZHvM+Tphi+gBFOsRbns7WOjD4aqFV8ncYLWA5LYFHIukuCYFaEDM80dLtLyNtevrhpjtikjs+IChdUAAZxsSzle/8/Lu57zIH/GBaQmimBvASiwNoZ5rXZNh13b2Bb7/XarmsN+06wPm79uHr11l0g5Gg+kvPQ/iqVBAUcmLAXz/07lI2S04n26lj6438hPietuiaKL/CBeZXSfcMnjVl9aP4b3Ztd2TbdudutvGLI0Vg==
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 13 Oct 2021 15:49:20 GMT
server: nginx
x-page-optimize: uncached
etag: W/"aa9037a1f08e4de277760982ce04c2f3"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
date: Wed, 20 Oct 2021 18:13:07 GMT
x-ac: 2.hhn _atomic_ams
host-header: WordPress.com

GET
H2 200 css
fonts.googleapis.com/ 3 KB
1 KB 88ms
33ms Stylesheet
text/css 142.250.186.42
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C&display=fallback

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.42 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f10.1e100.net

Software

ESF /

Resource Hash

9b2b63b24b7c2f3d98ec7739ab17ca233a578c54f5f86fb496d8341749b48670

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 20 Oct 2021 17:39:20 GMT
server: ESF
date: Wed, 20 Oct 2021 18:13:06 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Wed, 20 Oct 2021 18:13:06 GMT

GET
H2 200 front.min.css
blog.cyble.com/wp-content/plugins/cookie-notice/css/ 5 KB
1 KB 176ms
175ms Stylesheet
text/css 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/cookie-notice/css/front.min.css

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8c21cdf7be2219908a953d92fba153dcc7175f7ee238856bd9954da18b0e05dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/plugins/cookie-notice/css/front.min.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 05 Oct 2021 06:11:14 GMT
server: nginx
etag: W/"615bec82-1568"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=604800
date: Wed, 20 Oct 2021 18:13:06 GMT
x-ac: 2.hhn _atomic_ams
expires: Wed, 27 Oct 2021 18:13:06 GMT

GET
H2 200 related-posts.min.js Show response
blog.cyble.com/wp-content/plugins/jetpack/_inc/build/related-posts/ 6 KB
2 KB 182ms
181ms Script
application/javascript 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/jetpack/_inc/build/related-posts/related-posts.min.js?m=1633452470

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

2256c9e5605323f852f232fd6819a02cf2cac3e04c84299e19efe83037fd8cda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/plugins/jetpack/_inc/build/related-posts/related-posts.min.js?m=1633452470
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 05 Oct 2021 16:47:50 GMT
server: nginx
etag: W/"615c81b6-1670"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
date: Wed, 20 Oct 2021 18:13:06 GMT
x-ac: 2.hhn _atomic_ams
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.min.js Show response
blog.cyble.com/wp-includes/js/jquery/ 87 KB
30 KB 341ms
341ms Script
application/javascript 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-includes/js/jquery/jquery.min.js

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-includes/js/jquery/jquery.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 10 Mar 2021 15:07:24 GMT
server: nginx
etag: W/"6048e0ac-15db1"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
date: Wed, 20 Oct 2021 18:13:07 GMT
x-ac: 2.hhn _atomic_ams
expires: Wed, 27 Oct 2021 18:13:06 GMT

GET
H2 200 / Show response
blog.cyble.com/_static/ 12 KB
4 KB 205ms
205ms Script
application/javascript 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/_static/??wp-includes/js/jquery/jquery-migrate.min.js,wp-content/plugins/wordpress-stats-manager-pro/js/custom_front_js.js?m=1634095097

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1190115dd7e6fbd896f8b541ad48a2dea9c4214cd240ffe2726d8e90d8eb9467

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /_static/??wp-includes/js/jquery/jquery-migrate.min.js,wp-content/plugins/wordpress-stats-manager-pro/js/custom_front_js.js?m=1634095097
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 13 Oct 2021 03:18:17 GMT
server: nginx
x-page-optimize: uncached
etag: W/"8f96331e5aa3702e6257952997cd4d72"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
date: Wed, 20 Oct 2021 18:13:06 GMT
x-ac: 2.hhn _atomic_ams
host-header: WordPress.com

GET
H2 200 front.min.js Show response
blog.cyble.com/wp-content/plugins/cookie-notice/js/ 8 KB
2 KB 190ms
190ms Script
application/javascript 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/cookie-notice/js/front.min.js

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

53c088f65c77c6b7af2804face3e267d4c1bf148177798a30fa3a15aa693c36f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/plugins/cookie-notice/js/front.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 05 Oct 2021 06:11:14 GMT
server: nginx
etag: W/"615bec82-20b3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
date: Wed, 20 Oct 2021 18:13:07 GMT
x-ac: 2.hhn _atomic_ams
expires: Wed, 27 Oct 2021 18:13:07 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 91 KB
36 KB 96ms
47ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-201575643-1

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

d7b1f5c34d7673acfa55186ef5a55e6584d594414ce3ef824181eaf81b7e6c65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 18:13:07 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 36833
x-xss-protection: 0
expires: Wed, 20 Oct 2021 18:13:07 GMT

GET
H2 200 /
blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/ 177 KB
45 KB 620ms
620ms Stylesheet
text/html 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

c40fb1a20fe9d56012b7242b5c9c2494d8f306e1fd5901492e8ce3b80811c9e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-pingback: https://blog.cyble.com/xmlrpc.php
x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 20 Oct 2021 18:13:07 GMT
server: nginx
date: Wed, 20 Oct 2021 18:13:07 GMT
vary: Accept-Encoding Cookie
content-type: text/html; charset=UTF-8
cache-control: max-age=300, must-revalidate
x-nananana: Batcache-Set
x-ac: 2.hhn _atomic_ams
host-header: WordPress.com
link: <https://blog.cyble.com/wp-json/>; rel="https://api.w.org/" <https://blog.cyble.com/wp-json/wp/v2/posts/5019>; rel="alternate"; type="application/json" <https://wp.me/pbX1h1-1iX>; rel=shortlink

GET
H2 200 bilmur.min.js Show response
s0.wp.com/wp-content/js/ 5 KB
2 KB 23ms
6ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/js/bilmur.min.js?m=202142
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: ccd1ae8d139b4ddb53c470f4a9ff95259b89b0572b88bc33b4baf78636f2782d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Wed, 20 Oct 2021 18:13:07 GMT
content-encoding: gzip
server: nginx
etag: W/"612678e4-1386"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
timing-allow-origin: *
expires: Tue, 18 Oct 2022 00:00:00 GMT

GET
H2 200 /
blog.cyble.com/_static/ 37 KB
8 KB 187ms
187ms Stylesheet
text/css 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/_static/??-eJyVjEEOgzAMBD/U1IqQwgn1LamxXKiJLZwo3y9I5dhDj7s7s90CaqlUKpg0XorDStUyvmHTuQk5YN61OQl4X4z28GxlFrqj+63/YX+HcBW/DliVhQ7MKr4yHBQwC57pVB7bFNMwjDGlMX4AksVHqA==

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ab0bc34c4b8744c2e79fc6b7d071c6669b7955c6ba1dad90e551bee5c4696f82

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /_static/??-eJyVjEEOgzAMBD/U1IqQwgn1LamxXKiJLZwo3y9I5dhDj7s7s90CaqlUKpg0XorDStUyvmHTuQk5YN61OQl4X4z28GxlFrqj+63/YX+HcBW/DliVhQ7MKr4yHBQwC57pVB7bFNMwjDGlMX4AksVHqA==
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Fri, 08 Oct 2021 18:11:11 GMT
server: nginx
x-page-optimize: uncached
etag: W/"e8a9864a4e204e7665df7777f2056908"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
date: Wed, 20 Oct 2021 18:13:06 GMT
x-ac: 2.hhn _atomic_ams
host-header: WordPress.com

GET
H2 200 / Show response
blog.cyble.com/_static/ 17 KB
4 KB 190ms
190ms Script
application/javascript 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/_static/??-eJxtjtsKwjAQRH/INKZNLz6InyIxu+rW3Gg2lP69QRREfFmGZc7MrElQsK4AZjlnaaP3GFgsmNzWeArNnHdrEjYGrn/Jd/TVaTIvpt6M/MKqka6EIDNvDv9wJblo4A0KAxDDtxaD0qg7BRq6aRqF2k+jHtr+JyW5cqNQG5GTsQ95rtPlpZADySsx4yKYPDoKnw0nf1RD1/ZqOmj1BFVRVFE=

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d77a29735922e3ab5137a20474789943fa488e93c950e777ce4ed67e1902735b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /_static/??-eJxtjtsKwjAQRH/INKZNLz6InyIxu+rW3Gg2lP69QRREfFmGZc7MrElQsK4AZjlnaaP3GFgsmNzWeArNnHdrEjYGrn/Jd/TVaTIvpt6M/MKqka6EIDNvDv9wJblo4A0KAxDDtxaD0qg7BRq6aRqF2k+jHtr+JyW5cqNQG5GTsQ95rtPlpZADySsx4yKYPDoKnw0nf1RD1/ZqOmj1BFVRVFE=
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Fri, 24 Sep 2021 21:29:01 GMT
server: nginx
x-page-optimize: uncached
etag: W/"9174a64ff6b773e5ce8ca628b737ecda"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
date: Wed, 20 Oct 2021 18:13:06 GMT
x-ac: 2.hhn _atomic_ams
host-header: WordPress.com

GET
H2 200 intersection-observer.js Show response
blog.cyble.com/wp-content/plugins/jetpack/vendor/automattic/jetpack-lazy-images/dist/ 9 KB
3 KB 185ms
185ms Script
application/javascript 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/jetpack/vendor/automattic/jetpack-lazy-images/dist/intersection-observer.js

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ba58ed4e8dd5b19dda4a55b9ea0e7561c8365d5999673ddbcbb7269fca2d3dd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/plugins/jetpack/vendor/automattic/jetpack-lazy-images/dist/intersection-observer.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 28 Sep 2021 19:34:54 GMT
server: nginx
etag: W/"61536e5e-2394"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
date: Wed, 20 Oct 2021 18:13:06 GMT
x-ac: 2.hhn _atomic_ams
expires: Wed, 27 Oct 2021 18:13:06 GMT

GET
H2 200 lazy-images.js Show response
blog.cyble.com/wp-content/plugins/jetpack/vendor/automattic/jetpack-lazy-images/dist/ 2 KB
1022 B 194ms
194ms Script
application/javascript 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/jetpack/vendor/automattic/jetpack-lazy-images/dist/lazy-images.js

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

0c97c6ce5fdeb2d91e4bc6263d3714ca800b990c1994cf0b6dac0f23c8fbabfe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/plugins/jetpack/vendor/automattic/jetpack-lazy-images/dist/lazy-images.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 31 Aug 2021 18:39:50 GMT
server: nginx
etag: W/"612e7776-98f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
date: Wed, 20 Oct 2021 18:13:06 GMT
x-ac: 2.hhn _atomic_ams
expires: Wed, 27 Oct 2021 18:13:06 GMT

GET
H2 200 / Show response
blog.cyble.com/_static/ 40 KB
12 KB 205ms
205ms Script
application/javascript 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/_static/??-eJyVjEkOwjAQBD+EPWILcEA8BTn2KNjxFo9HEbweHxKJIzl2V3fNWegUK8YK2fNgI4HDmpUe4Wmjhp6tN5AT1YBEakAZbJSOdvNfRzcxlrdciChI9rNR4e2IBM3D+FLReCw//zbzbBp3BC1i6NFs02tVEhP6lYm1WDSPcN93x8P1fOlupy9odnFP

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

964f0a230990d84fb2dda38021aedfd2296837324b6f3b57b3b96d45ead320c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /_static/??-eJyVjEkOwjAQBD+EPWILcEA8BTn2KNjxFo9HEbweHxKJIzl2V3fNWegUK8YK2fNgI4HDmpUe4Wmjhp6tN5AT1YBEakAZbJSOdvNfRzcxlrdciChI9rNR4e2IBM3D+FLReCw//zbzbBp3BC1i6NFs02tVEhP6lYm1WDSPcN93x8P1fOlupy9odnFP
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 28 Sep 2021 19:34:54 GMT
server: nginx
x-page-optimize: uncached
etag: W/"5632cf059af26ed82a9dbff368dd06c8"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
date: Wed, 20 Oct 2021 18:13:06 GMT
x-ac: 2.hhn _atomic_ams
host-header: WordPress.com

GET
H2 200 sharing.min.js Show response
blog.cyble.com/wp-content/plugins/jetpack/_inc/build/sharedaddy/ 12 KB
4 KB 181ms
181ms Script
application/javascript 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/jetpack/_inc/build/sharedaddy/sharing.min.js

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

80ee2d8ce5d2a3f78fc3b8eaa67bc266645c58b96d8a804556f1e6cb8737d0cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/plugins/jetpack/_inc/build/sharedaddy/sharing.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 26 Jan 2021 16:25:48 GMT
server: nginx
etag: W/"6010428c-2f6d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
date: Wed, 20 Oct 2021 18:13:06 GMT
x-ac: 2.hhn _atomic_ams
expires: Wed, 27 Oct 2021 18:13:06 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 884 B
1021 B 89ms
39ms Script
text/javascript 142.250.185.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=6LeHcNgZAAAAAP4lW4yfIY5QQVwVhNhqOGG-R8Za

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f4.1e100.net

Software

GSE /

Resource Hash

79530645f505feaf1116f9c014a96cb2563ecfc242b56700b4aa5cb80b2f9503

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 18:13:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 587
x-xss-protection: 1; mode=block
expires: Wed, 20 Oct 2021 18:13:07 GMT

GET
H2 200 script.js Show response
blog.cyble.com/wp-content/plugins/google-captcha/js/ 9 KB
2 KB 338ms
338ms Script
application/javascript 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/google-captcha/js/script.js?m=1633716671

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

0199ad8ea9b2446429410cb808de39dff62aa7ca44de37bb3360ba3a60984048

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/plugins/google-captcha/js/script.js?m=1633716671
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Fri, 08 Oct 2021 18:11:11 GMT
server: nginx
etag: W/"616089bf-22b5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
date: Wed, 20 Oct 2021 18:13:07 GMT
x-ac: 2.hhn _atomic_ams
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 e-202142.js Show response
stats.wp.com/ 9 KB
3 KB 23ms
6ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202142.js
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn
date: Wed, 20 Oct 2021 18:13:07 GMT
content-encoding: gzip
server: nginx
etag: W/"5c6340e3-350a"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Sun, 09 Oct 2022 22:34:09 GMT

GET
H2 200 wsm_new.js Show response
blog.cyble.com/wp-content/plugins/wordpress-stats-manager-pro/js/ 23 KB
8 KB 177ms
177ms Script
application/javascript 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/wordpress-stats-manager-pro/js/wsm_new.js

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

a2dd78e7291fc44d932317439b6141942d43e07156e69e04fb3cba6dba89294b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/plugins/wordpress-stats-manager-pro/js/wsm_new.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 13 Oct 2021 03:18:17 GMT
server: nginx
etag: W/"61664ff9-5cea"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
date: Wed, 20 Oct 2021 18:13:07 GMT
x-ac: 2.hhn _atomic_ams
expires: Wed, 27 Oct 2021 18:13:07 GMT

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v26/ 16 KB
17 KB 91ms
24ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v26/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C&display=fallback

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

sffe /

Resource Hash

53bb85849942fe0fdb6998300d0c68f1727a6f34a3bdcd9f6f8f12476f64b1e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blog.cyble.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 17:06:43 GMT
x-content-type-options: nosniff
age: 522384
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16736
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 16:50:15 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 14 Oct 2022 17:06:43 GMT

GET
H2 200 astra.woff
blog.cyble.com/wp-content/themes/astra/assets/fonts/ 3 KB
3 KB 185ms
184ms Font
application/font-woff 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/themes/astra/assets/fonts/astra.woff

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ec7ef7aa5fd1e019f1c26193e95e46d481d4983673936a9dda086705ada6e3d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/themes/astra/assets/fonts/astra.woff
pragma: no-cache
origin: https://blog.cyble.com
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Origin: https://blog.cyble.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 18:13:07 GMT
x-ac: 2.hhn _atomic_ams
last-modified: Mon, 12 Jul 2021 16:55:30 GMT
server: nginx
etag: "60ec7402-ce8"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, HEAD
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
content-length: 3304
expires: Wed, 27 Oct 2021 18:13:07 GMT

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c

Request headers

Referer
Origin: https://blog.cyble.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 ss.js Show response
koi-3qnocuxufa.marketingautomation.services/client/ 12 KB
5 KB 194ms
118ms Script
application/javascript 130.211.21.179
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://koi-3qnocuxufa.marketingautomation.services/client/ss.js?ver=2.4.0
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.21.179 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 179.21.211.130.bc.googleusercontent.com
Software: openresty /
Resource Hash: 8c78a51baaafdb60084333cabd9099b2f37278adf882cea7d5de0ef1188c5aa6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 18:13:07 GMT
content-encoding: gzip
last-modified: Wed, 20 Oct 2021 14:01:48 GMT
server: openresty
etag: W/"6170214c-2fc1"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 google
cache-control: max-age=604800, public
alt-svc: clear
expires: Wed, 27 Oct 2021 18:13:07 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 96 KB
29 KB 38ms
7ms Script
application/javascript 93.184.220.66
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJxtjtsKwjAQRH/INKZNLz6InyIxu+rW3Gg2lP69QRREfFmGZc7MrElQsK4AZjlnaaP3GFgsmNzWeArNnHdrEjYGrn/Jd/TVaTIvpt6M/MKqka6EIDNvDv9wJblo4A0KAxDDtxaD0qg7BRq6aRqF2k+jHtr+JyW5cqNQG5GTsQ95rtPlpZADySsx4yKYPDoKnw0nf1RD1/ZqOmj1BFVRVFE=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/67E2) /
Resource Hash: 00a57617df99ac957720b7332f9d15449def3ebe11169d68f12c47a3cde5168d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Wed, 20 Oct 2021 18:13:07 GMT
Content-Encoding: gzip
Last-Modified: Mon, 18 Oct 2021 18:33:56 GMT
Server: ECS (frb/67E2)
Age: 1251
Etag: "a709ab1b2c0d5d5e7c19895f6e1dcbfd+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 29104

GET
H2 200 master.html Show response
widgets.wp.com/likes/ Frame B1F2 3 KB
1 KB 8ms
7ms Document
text/html 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.wp.com/likes/master.html?ver=202142
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 3f8783f02df4a222a0ace31fa459efe88422cbce27fe272b07dd110396770659

Request headers

:method: GET
:authority: widgets.wp.com
:scheme: https
:path: /likes/master.html?ver=202142
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cyble.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/

Response headers

server: nginx
date: Wed, 20 Oct 2021 18:13:07 GMT
content-type: text/html
last-modified: Tue, 12 Oct 2021 23:06:08 GMT
vary: Accept-Encoding
etag: W/"616614e0-aed"
content-encoding: gzip
x-ac: 2.hhn _dfw
access-control-allow-methods: GET, HEAD
access-control-allow-origin: *
timing-allow-origin: *
x-nc: HIT hhn 2

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 9ms
7ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A10.3-a.3&blog=176605947&post=5019&tz=-4&srv=blog.cyble.com&host=blog.cyble.com&ref=https%3A%2F%2Ft.co%2F&fcp=0&rand=0.7876936275289521
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 18:13:07 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 / Show response
blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/ 2 KB
974 B 597ms
596ms XHR
application/json 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/?relatedposts=1

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/wp-content/plugins/jetpack/_inc/build/related-posts/related-posts.min.js?m=1633452470

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ff8f27b09179d63d447916d984c45126ddd02c50feca4d533de2cbd57935afc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

:path: /2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/?relatedposts=1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: blog.cyble.com
x-requested-with: XMLHttpRequest
:scheme: https
sec-fetch-site: same-origin
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:method: GET
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
x-requested-with: XMLHttpRequest
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-pingback: https://blog.cyble.com/xmlrpc.php
x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
strict-transport-security: max-age=31536000
content-encoding: br
x-content-type-options: nosniff
server: nginx
date: Wed, 20 Oct 2021 18:13:07 GMT
vary: Accept-Encoding Cookie
content-type: application/json; charset=utf-8
x-ac: 2.hhn _atomic_ams
host-header: WordPress.com

GET
H2 200 / Show response
graph.facebook.com/ 244 B
678 B 61ms
36ms Script
text/javascript 157.240.20.15
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fblog.cyble.com%2F2021%2F06%2F03%2Fnucleus-software-becomes-victim-of-the-blackcocaine-ransomware%2F

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/wp-content/plugins/jetpack/_inc/build/sharedaddy/sharing.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.20.15 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-shv-02-frt3.facebook.com

Software

Resource Hash

c219e03b0e7e5456d670f133166f335807bb8e706665b7012a6b3ff313404dfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
x-fb-rev: 1004585316
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 184
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: gmoB/xvI7ybI0uAZb5iJ4EnXKXyVmqQL+gYaV+Mfh1eXvwjqOzWxi58LRiWp4sIasuQaHQ3OK5BpiROkU4nBdw==
x-fb-trace-id: B1vUdj2jd2Z
date: Wed, 20 Oct 2021 18:13:07 GMT
vary: Origin, Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: AS6Mw-P4Z2ff-WxUlvpiIOg
cache-control: no-store
facebook-api-version: v4.0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
92 B 8ms
7ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.43030538664461804
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 18:13:07 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 cropped-Cyble-Logo-200x52.png
blog.cyble.com/wp-content/uploads/2021/07/ 6 KB
7 KB 186ms
185ms Image
image/webp 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.cyble.com/wp-content/uploads/2021/07/cropped-Cyble-Logo-200x52.png

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

487eb945b4b40b80638387640b40bf1c2272a28a8def698e2c9e271732cf38ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

:path: /wp-content/uploads/2021/07/cropped-Cyble-Logo-200x52.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 18:13:07 GMT
x-ac: 2.hhn _atomic_ams
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
content-length: 6478
x-nc: HIT bur 4
last-modified: Fri, 24 Sep 2021 21:32:22 GMT
server: nginx
etag: "ce4dd3edc6f01c60"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
expires: Mon, 25 Sep 2023 09:32:22 GMT

GET
H2 200 image-8-1024x576.png
blog.cyble.com/wp-content/uploads/2021/06/ 416 KB
416 KB 194ms
194ms Image
image/webp 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.cyble.com/wp-content/uploads/2021/06/image-8-1024x576.png

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

6f57fb9a35844c9f3a3de7e77064fb4c99420947b2d9490936462c9a0fd40f67

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

:path: /wp-content/uploads/2021/06/image-8-1024x576.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 18:13:07 GMT
x-ac: 2.hhn _atomic_ams
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
content-length: 425480
x-nc: HIT bur 1
last-modified: Mon, 30 Aug 2021 17:48:25 GMT
server: nginx
etag: "3015bd4a5dad25a8"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
expires: Thu, 31 Aug 2023 05:48:25 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ Frame B1F2 22 KB
5 KB 8ms
8ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/js/postmessage.js,/wp-content/js/rlt-proxy.js?m=20210413
Requested by: Host: widgets.wp.com
URL: https://widgets.wp.com/likes/master.html?ver=202142
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 2e443dbb116d4efb3edfddb77cd4b2c93313cb6d8e75800602a92f0a9fa22d88

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://widgets.wp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Wed, 20 Oct 2021 18:13:07 GMT
content-encoding: gzip
last-modified: Thu, 01 Apr 2021 21:48:08 GMT
server: nginx
etag: W/"60663f98-56cb"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
timing-allow-origin: *
expires: Thu, 14 Apr 2022 02:02:08 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ Frame B1F2 62 KB
16 KB 8ms
8ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/js/tannin/compat.min.js,/wp-content/js/wpcom-proxy-request.js,/wp-content/js/likes-rest-nojquery.js?m=20210831
Requested by: Host: widgets.wp.com
URL: https://widgets.wp.com/likes/master.html?ver=202142
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 71d0ae4a963e44b9703ca229bf96f09d47feb12f36f014f50219a73702bac1d5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://widgets.wp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Wed, 20 Oct 2021 18:13:07 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 23:07:41 GMT
server: nginx
etag: W/"6166153d-f7e6"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
timing-allow-origin: *
expires: Wed, 12 Oct 2022 23:07:48 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/YhkYx1k-yvvb8OonJPmOpoJY/ 346 KB
136 KB 81ms
23ms Script
text/javascript 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/YhkYx1k-yvvb8OonJPmOpoJY/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LeHcNgZAAAAAP4lW4yfIY5QQVwVhNhqOGG-R8Za

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

dda2aba38252dcb4fde2222ecdcf5806f23fc3e9400f310f0ee1927329243c78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.cyble.com/
Origin: https://blog.cyble.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 17:55:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1070
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 138388
x-xss-protection: 0
last-modified: Mon, 18 Oct 2021 04:02:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Thu, 20 Oct 2022 17:55:17 GMT

GET
H/1.1 200
OK widget_iframe.a53eecb4584348a2ad32ec2ae21f6eae.html Show response
platform.twitter.com/widgets/ Frame CE77 319 KB
103 KB 12ms
12ms Document
text/html 93.184.220.66
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.a53eecb4584348a2ad32ec2ae21f6eae.html?origin=https%3A%2F%2Fblog.cyble.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6711) /
Resource Hash: c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://blog.cyble.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 76294
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Wed, 20 Oct 2021 18:13:07 GMT
Etag: "8321d7cf58d70200c1423dfa0bca40f6+gzip"
Last-Modified: Mon, 18 Oct 2021 18:32:00 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/6711)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 105433

GET
H2 200 / Show response
public-api.wordpress.com/wp-admin/rest-proxy/ Frame 4C87 8 KB
3 KB 125ms
109ms Document
text/html 192.0.78.23
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://public-api.wordpress.com/wp-admin/rest-proxy/

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-content/js/tannin/compat.min.js,/wp-content/js/wpcom-proxy-request.js,/wp-content/js/likes-rest-nojquery.js?m=20210831

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.23 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

13c6db1ac0497928444e50aac43b5213354270c74537966202618efc12778122

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:method: GET
:authority: public-api.wordpress.com
:scheme: https
:path: /wp-admin/rest-proxy/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://widgets.wp.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://widgets.wp.com/

Response headers

server: nginx
date: Wed, 20 Oct 2021 18:13:07 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
set-cookie: wp_api=+; expires=Tue, 20-Oct-2020 18:13:07 GMT; Max-Age=0; path=/wp-admin/rest-proxy/; domain=public-api.wordpress.com; secure; SameSite=None wp_api_sec=+; expires=Tue, 20-Oct-2020 18:13:07 GMT; Max-Age=0; path=/; domain=public-api.wordpress.com; secure; HttpOnly; SameSite=None
content-encoding: gzip
x-ac: 1.hhn _dca
strict-transport-security: max-age=15552000

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 73ms
23ms Script
text/javascript 142.250.185.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-201575643-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

fc27aed7787a4f63d2feba50e6bc6122ac3c5479456d40c0a445899a08ad92f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 19 Oct 2021 16:47:48 GMT
server: Golfe2
age: 5170
date: Wed, 20 Oct 2021 16:46:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19887
expires: Wed, 20 Oct 2021 18:46:57 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 103 KB
41 KB 47ms
46ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-4FJGSRPM4S&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-201575643-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

031add161d91814922bde2623cb229b874838141693c74623103f7b35e61fd61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 18:13:07 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 41963
x-xss-protection: 0
expires: Wed, 20 Oct 2021 18:13:07 GMT

GET
H2 200 settings Show response
syndication.twitter.com/ Frame CE77 232 B
432 B 132ms
116ms Fetch
application/json 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=10939764defb597c64c5f0f373c2c4410a26759a

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.a53eecb4584348a2ad32ec2ae21f6eae.html?origin=https%3A%2F%2Fblog.cyble.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 18:13:07 GMT
content-encoding: gzip
last-modified: Wed, 20 Oct 2021 18:13:07 GMT
server: tsa_o
vary: Origin
strict-transport-security: max-age=631138519
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
x-connection-hash: 9226833ceaec46bebf2a5d9e983d606396831aa714e7e2606d085b5d4e7c5b8b
content-length: 166

GET
H2 200 /
blog.cyble.com/ 0
57 B 600ms
600ms Image
text/html 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.cyble.com/?wmcAction=wmcTrack&action_name=Deep%20Dive%20into%20BlackCocaine%20Ransomware%20%E2%80%94%20Cyble&siteId=1&rec=1&rand=316403&h=18&m=13&s=7&url=https%3A%2F%2Fblog.cyble.com%2F2021%2F06%2F03%2Fnucleus-software-becomes-victim-of-the-blackcocaine-ransomware%2F&uid=0&pid=5019&visitorId=7ea3f018a46c91a7&fvts=1634753587&vc=1&idn=0&refts=1634753587&lvts=1634753587&ref=t.co%2F&refType=ssl&fullRef=t.co%2F&send_image=1&pdf=1&qt=0&rp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gtms=674&pvId=ZQZsjZ&browser=Chrome_93&os=Windows_10&device=Desktop

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /?wmcAction=wmcTrack&action_name=Deep%20Dive%20into%20BlackCocaine%20Ransomware%20%E2%80%94%20Cyble&siteId=1&rec=1&rand=316403&h=18&m=13&s=7&url=https%3A%2F%2Fblog.cyble.com%2F2021%2F06%2F03%2Fnucleus-software-becomes-victim-of-the-blackcocaine-ransomware%2F&uid=0&pid=5019&visitorId=7ea3f018a46c91a7&fvts=1634753587&vc=1&idn=0&refts=1634753587&lvts=1634753587&ref=t.co%2F&refType=ssl&fullRef=t.co%2F&send_image=1&pdf=1&qt=0&rp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gtms=674&pvId=ZQZsjZ&browser=Chrome_93&os=Windows_10&device=Desktop
pragma: no-cache
cookie: _wsm_ref_1_abdf=%5B%22%22%2C%22%22%2C1634753587%2C%22https%3A%2F%2Ft.co%2F%22%5D; _wsm_id_1_abdf=7ea3f018a46c91a7.1634753587.1.1634753587.1634753587; _wsm_ses_1_abdf=*
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
strict-transport-security: max-age=31536000
content-encoding: br
server: nginx
date: Wed, 20 Oct 2021 18:13:08 GMT
vary: Accept-Encoding Cookie
content-type: text/html; charset=utf-8
x-ac: 2.hhn _atomic_ams
host-header: WordPress.com

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 60ms
31ms Ping
text/plain 142.250.185.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-4FJGSRPM4S&gtm=2oeai0&_p=332287076&sr=1600x1200&ul=en-us&cid=646664508.1634753588&_s=1&dl=https%3A%2F%2Fblog.cyble.com%2F2021%2F06%2F03%2Fnucleus-software-becomes-victim-of-the-blackcocaine-ransomware%2F&dr=https%3A%2F%2Ft.co%2F&dt=Deep%20Dive%20into%20BlackCocaine%20Ransomware%20%E2%80%94%20Cyble&sid=1634753587&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4FJGSRPM4S&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.142 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s50-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.cyble.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 20 Oct 2021 18:13:07 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.cyble.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 65C1 7 KB
1 KB 86ms
39ms Document
text/html 142.250.185.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeHcNgZAAAAAP4lW4yfIY5QQVwVhNhqOGG-R8Za&co=aHR0cHM6Ly9ibG9nLmN5YmxlLmNvbTo0NDM.&hl=de&v=YhkYx1k-yvvb8OonJPmOpoJY&size=invisible&cb=fgxa71122rmt

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/YhkYx1k-yvvb8OonJPmOpoJY/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f4.1e100.net

Software

GSE /

Resource Hash

e546d67779e98f0e4e81ae78801ea3d7d50be625d03c63f62de57b1cc9cacb83

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-rXr5VPbSsy+joMRss8TFLg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LeHcNgZAAAAAP4lW4yfIY5QQVwVhNhqOGG-R8Za&co=aHR0cHM6Ly9ibG9nLmN5YmxlLmNvbTo0NDM.&hl=de&v=YhkYx1k-yvvb8OonJPmOpoJY&size=invisible&cb=fgxa71122rmt
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cyble.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-security-policy: script-src 'report-sample' 'nonce-rXr5VPbSsy+joMRss8TFLg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
content-encoding: gzip
date: Wed, 20 Oct 2021 18:13:07 GMT
expires: Wed, 20 Oct 2021 18:13:07 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1041
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 32ms
32ms XHR
text/plain 142.250.185.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j94&aip=1&a=332287076&t=pageview&_s=1&dl=https%3A%2F%2Fblog.cyble.com%2F2021%2F06%2F03%2Fnucleus-software-becomes-victim-of-the-blackcocaine-ransomware%2F&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=Deep%20Dive%20into%20BlackCocaine%20Ransomware%20%E2%80%94%20Cyble&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACUABBAAAAC~&jid=866541371&gjid=1056918119&cid=646664508.1634753588&tid=UA-201575643-1&_gid=981059902.1634753588&_r=1&gtm=2ouai0&did=dZTNiMT&z=841018274

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.cyble.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 20 Oct 2021 18:13:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.cyble.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 koi Show response
koi-3qnocuxufa.marketingautomation.services/ 147 B
605 B 280ms
280ms Script
application/javascript 130.211.21.179
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://koi-3qnocuxufa.marketingautomation.services/koi?rf=https%3A%2F%2Ft.co%2F&hn=blog.cyble.com&lg=en-US&sr=1600x1200&cd=24&vr=2.4.0&se=1634753587521&ac=KOI-4JTSOSSFQA&ts=1634753588&pt=0&pl=0&loc=https%3A%2F%2Fblog.cyble.com%2F2021%2F06%2F03%2Fnucleus-software-becomes-victim-of-the-blackcocaine-ransomware%2F&tp=page&ti=Deep%20Dive%20into%20BlackCocaine%20Ransomware%20%E2%80%94%20Cyble

Requested by

Host: koi-3qnocuxufa.marketingautomation.services
URL: https://koi-3qnocuxufa.marketingautomation.services/client/ss.js?ver=2.4.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

130.211.21.179 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

179.21.211.130.bc.googleusercontent.com

Software

openresty /

Resource Hash

ad54fb3ec271e2a3834a223435faf9cda951ee7cad66ee311683230c387c683e

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Oct 2021 18:13:07 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett
last-modified: Wed, 20 Oct 2021 18:13:07 GMT
server: openresty
vary: Accept-Encoding
p3p: CP='This is not a P3P policy! See https://sharpspring.com/legal/privacy/ for more info.'
via: 1.1 google
cache-control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0
pod-hostname: koi-546dd8968d-8smng
content-type: application/javascript
alt-svc: clear
x-xss-protection: 1; mode=block
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 image-2.png
blog.cyble.com/wp-content/uploads/2021/06/ 53 KB
53 KB 392ms
392ms Image
image/png 192.0.78.183
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.cyble.com/wp-content/uploads/2021/06/image-2.png

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ebb66d63a8a9022ea2689ddcd30b44867e0d6721a6c42c5db76e11cdb81f3e26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/uploads/2021/06/image-2.png
pragma: no-cache
cookie: _wsm_ref_1_abdf=%5B%22%22%2C%22%22%2C1634753587%2C%22https%3A%2F%2Ft.co%2F%22%5D; _wsm_id_1_abdf=7ea3f018a46c91a7.1634753587.1.1634753587.1634753587; _wsm_ses_1_abdf=*; _ga_4FJGSRPM4S=GS1.1.1634753587.1.0.1634753587.0; __ss=1634753587521; __ss_referrer=https%3A//blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/; _ga=GA1.2.646664508.1634753588; _gid=GA1.2.981059902.1634753588; _gat_gtag_UA_201575643_1=1
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: blog.cyble.com
referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 18:13:08 GMT
x-ac: 2.hhn _atomic_ams
last-modified: Thu, 03 Jun 2021 06:26:05 GMT
server: nginx
etag: "60b875fd-d4b5"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
content-length: 54453
expires: Wed, 27 Oct 2021 18:13:07 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ Frame 4C87 22 KB
5 KB 6ms
6ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/js/postmessage.js,/wp-content/js/rlt-proxy.js?m=20210413
Requested by: Host: public-api.wordpress.com
URL: https://public-api.wordpress.com/wp-admin/rest-proxy/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 2e443dbb116d4efb3edfddb77cd4b2c93313cb6d8e75800602a92f0a9fa22d88

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public-api.wordpress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Wed, 20 Oct 2021 18:13:07 GMT
content-encoding: gzip
last-modified: Thu, 01 Apr 2021 21:48:08 GMT
server: nginx
etag: W/"60663f98-56cb"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
timing-allow-origin: *
expires: Thu, 14 Apr 2022 02:02:08 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/YhkYx1k-yvvb8OonJPmOpoJY/ Frame 65C1 52 KB
25 KB 60ms
26ms Stylesheet
text/css 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/YhkYx1k-yvvb8OonJPmOpoJY/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeHcNgZAAAAAP4lW4yfIY5QQVwVhNhqOGG-R8Za&co=aHR0cHM6Ly9ibG9nLmN5YmxlLmNvbTo0NDM.&hl=de&v=YhkYx1k-yvvb8OonJPmOpoJY&size=invisible&cb=fgxa71122rmt

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

295426f89c923624640e8f1bb52e3438a7b43fb7efa84c1dc6bbbd41971c0f10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 18:54:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 170313
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 25743
x-xss-protection: 0
last-modified: Mon, 18 Oct 2021 04:02:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Tue, 18 Oct 2022 18:54:34 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/YhkYx1k-yvvb8OonJPmOpoJY/ Frame 65C1 346 KB
135 KB 75ms
41ms Script
text/javascript 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/YhkYx1k-yvvb8OonJPmOpoJY/recaptcha__de.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

dda2aba38252dcb4fde2222ecdcf5806f23fc3e9400f310f0ee1927329243c78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 17:55:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1070
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 138388
x-xss-protection: 0
last-modified: Mon, 18 Oct 2021 04:02:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Thu, 20 Oct 2022 17:55:17 GMT

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 65C1 2 KB
2 KB 26ms
26ms Image
image/png 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/YhkYx1k-yvvb8OonJPmOpoJY/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/YhkYx1k-yvvb8OonJPmOpoJY/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 17 Oct 2021 11:16:19 GMT
x-content-type-options: nosniff
age: 284208
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Sun, 24 Oct 2021 11:16:19 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 65C1 15 KB
15 KB 58ms
24ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 19:58:13 GMT
x-content-type-options: nosniff
age: 166494
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 18 Oct 2022 19:58:13 GMT

GET
H2 200 60ef1a936db9b8560600055a.js Show response
tag.perfectaudience.com/serve/ 12 KB
4 KB 31ms
7ms Script
text/javascript 151.101.130.217
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.perfectaudience.com/serve/60ef1a936db9b8560600055a.js

Requested by

Host: koi-3qnocuxufa.marketingautomation.services
URL: https://koi-3qnocuxufa.marketingautomation.services/client/ss.js?ver=2.4.0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.130.217 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Cowboy /

Resource Hash

b5c5ef71bd69f096d2e4a3101793df24319cb32b8e784aa5bd064bdb8bffd9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 18:13:07 GMT
via: 1.1 vegur, 1.1 varnish
x-content-type-options: nosniff
server: Cowboy
age: 202
x-served-by: cache-hhn4075-HHN
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
content-encoding: gzip
cache-control: max-age=1800
accept-ranges: bytes
x-timer: S1634753588.968843,VS0,VE1
content-length: 3900
x-cache-hits: 1

GET
H/1.1

200
OK

tagjs Show response
pixel-geo.prfct.co/
Redirect Chain

https://pixel-geo.prfct.co/tagjs?a_id=167159&source=js_tag
https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=167159&source=js_tag

136 B
465 B

33ms
32ms

Script
text/javascript

34.246.96.178
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=167159&source=js_tag
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.96.178 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-96-178.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 77d279abfeb9b3b4923f4f464b9b25ca78adb34169c547fcefef6f65780265bf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, private
Connection: keep-alive
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Content-Length: 136
Content-Type: text/javascript

Redirect headers

Location: https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=167159&source=js_tag
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H/1.1

200
OK

/
pixel-geo.prfct.co/usermap/
Redirect Chain

https://secure.adnxs.com/getuid?https://pixel-geo.prfct.co/usermap/?xid=$UID&sid=202110|61705c338e8c3c63fd1165ee&pid=pa_eopiesZY0CVQYMVX8
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fpixel-geo.prfct.co%2Fusermap%2F%3Fxid%3D%24UID%26sid%3D202110%7C61705c338e8c3c63fd1165ee%26pid%3Dpa_eopiesZY0CVQYMVX8
https://pixel-geo.prfct.co/usermap/?xid=269546146418669731&sid=202110|61705c338e8c3c63fd1165ee&pid=pa_eopiesZY0CVQYMVX8

43 B
256 B

58ms
29ms

Image
image/gif

34.246.96.178
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-geo.prfct.co/usermap/?xid=269546146418669731&sid=202110|61705c338e8c3c63fd1165ee&pid=pa_eopiesZY0CVQYMVX8
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.96.178 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-96-178.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, private
Connection: keep-alive
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Content-Length: 43
Content-Type: image/gif

Redirect headers

Pragma: no-cache
Date: Wed, 20 Oct 2021 18:13:08 GMT
X-Proxy-Origin: 216.131.111.149; 216.131.111.149; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 1110e51f-7219-4c37-8126-43df0146bf28
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://pixel-geo.prfct.co/usermap/?xid=269546146418669731&sid=202110|61705c338e8c3c63fd1165ee&pid=pa_eopiesZY0CVQYMVX8
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

adsct
analytics.twitter.com/i/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=twtr
https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_eopiesZY0CVQYMVX8

43 B
581 B

134ms
117ms

Image
image/gif

104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_eopiesZY0CVQYMVX8

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 18:13:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Wed, 20 Oct 2021 18:13:08 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: a17419b29adfae2346f2293f66841065d57dc5e67cc572f00e3d58540301fb2a
x-transaction: 2aebcd08c3f00c30
expires: Tue, 31 Mar 1981 05:00:00 GMT

Redirect headers

Location: https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_eopiesZY0CVQYMVX8
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H/1.1

200
OK

cb
pixel.prfct.co/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=crw
https://cw.addthis.com/t.gif?pid=37&pidt=0&pdid=pa_eopiesZY0CVQYMVX8&cu=https%3A%2F%2Fpixel.prfct.co%2Fcb%3FpartnerId%3Dcrw
https://pixel.prfct.co/cb?partnerId=crw

43 B
365 B

416ms
99ms

Image
image/gif

34.201.86.165
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.prfct.co/cb?partnerId=crw
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.201.86.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-201-86-165.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, private
Connection: keep-alive
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Content-Length: 43
Content-Type: image/gif

Redirect headers

location: https://pixel.prfct.co/cb?partnerId=crw
pragma: no-cache
date: Wed, 20 Oct 2021 18:13:08 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
expires: Wed, 20 Oct 2021 18:13:08 GMT

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/58288/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=yah
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_eopiesZY0CVQYMVX8&_origin=1
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_eopiesZY0CVQYMVX8&_origin=1&verify=true

0
735 B

10ms
10ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_eopiesZY0CVQYMVX8&_origin=1&verify=true

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.138 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Wed, 20 Oct 2021 18:13:08 GMT
Server: ATS/7.1.2.138
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

Date: Wed, 20 Oct 2021 18:13:08 GMT
Server: ATS/7.1.2.138
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_eopiesZY0CVQYMVX8&_origin=1&verify=true
Connection: keep-alive
Content-Length: 0

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=opx
https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_eopiesZY0CVQYMVX8
https://us-u.openx.net/w/1.0/sd?cc=1&id=537114372&val=pa_eopiesZY0CVQYMVX8

43 B
180 B

29ms
28ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537114372&val=pa_eopiesZY0CVQYMVX8
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Oct 2021 18:13:08 GMT
via: 1.1 google
server: OXGW/16.217.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537114372&val=pa_eopiesZY0CVQYMVX8
date: Wed, 20 Oct 2021 18:13:08 GMT
via: 1.1 google
server: OXGW/16.217.0
alt-svc: clear
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=rbcn
https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_eopiesZY0CVQYMVX8

0
239 B

30ms
8ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_eopiesZY0CVQYMVX8
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Content-Type: image/gif

Redirect headers

Location: https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_eopiesZY0CVQYMVX8
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H/1.1

200
OK

cb
pixel-geo.prfct.co/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=goo
https://cm.g.doubleclick.net/pixel?google_nid=nowspots_bidder&google_hm=cGFfZW9waWVzWlkwQ1ZRWU1WWDg
https://cm.g.doubleclick.net/pixel?google_nid=nowspots_bidder&google_hm=cGFfZW9waWVzWlkwQ1ZRWU1WWDg&google_tc=
https://pixel-geo.prfct.co/cb?partnerId=goo

43 B
365 B

30ms
30ms

Image
image/gif

34.246.96.178
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-geo.prfct.co/cb?partnerId=goo
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.96.178 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-96-178.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, private
Connection: keep-alive
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Content-Length: 43
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 20 Oct 2021 18:13:08 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel-geo.prfct.co/cb?partnerId=goo
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 240
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK /
pixel-geo.prfct.co/seg/ 43 B
365 B 113ms
113ms Image
image/gif 34.246.96.178
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-geo.prfct.co/seg/?add=27052482&source=js_tag&a_id=167159
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.96.178 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-96-178.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, private
Connection: keep-alive
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Content-Length: 43
Content-Type: image/gif

GET
H/1.1

200
OK

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/seg?t=2&add=27052482
https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D27052482

43 B
1 KB

23ms
23ms

Image
image/gif

37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D27052482

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Oct 2021 18:13:08 GMT
X-Proxy-Origin: 216.131.111.149; 216.131.111.149; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 93bb466d-5975-45dc-8613-f63e63406932
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 20 Oct 2021 18:13:08 GMT
X-Proxy-Origin: 216.131.111.149; 216.131.111.149; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: fa0d2f5c-472e-4333-9283-93457f844da1
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D27052482
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 getChatbot Show response
koi-3qnocuxufa.marketingautomation.services/ 242 B
289 B 229ms
229ms Script
application/javascript 130.211.21.179
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://koi-3qnocuxufa.marketingautomation.services/getChatbot?rf=https%3A%2F%2Ft.co%2F&hn=blog.cyble.com&lg=en-US&sr=1600x1200&cd=24&vr=2.4.0&se=1634753587521&ac=KOI-4JTSOSSFQA&ts=1634753589&pt=0&pl=0&loc=https%3A%2F%2Fblog.cyble.com%2F2021%2F06%2F03%2Fnucleus-software-becomes-victim-of-the-blackcocaine-ransomware%2F&tk=202110%7C61705c338e8c3c63fd1165ee

Requested by

Host: koi-3qnocuxufa.marketingautomation.services
URL: https://koi-3qnocuxufa.marketingautomation.services/client/ss.js?ver=2.4.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

130.211.21.179 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

179.21.211.130.bc.googleusercontent.com

Software

openresty /

Resource Hash

e719f0d742bc72d3f5f7cb95dd14986179039aa32b7976d4a3d37bf64fbb21b2

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 18:13:09 GMT
content-encoding: gzip
x-clacks-overhead: GNU Terry Pratchett
server: openresty
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 google
pod-hostname: app-pubapi-866c685f6-pqxl6
alt-svc: clear
x-xss-protection: 1; mode=block

GET
H2 200 publicChatbot Show response
koi-3qnocuxufa.marketingautomation.services/ Frame 869B 2 KB
918 B 123ms
123ms Document
text/html 130.211.21.179
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://koi-3qnocuxufa.marketingautomation.services/publicChatbot?&requestedLanguage=en_US

Requested by

Host: koi-3qnocuxufa.marketingautomation.services
URL: https://koi-3qnocuxufa.marketingautomation.services/client/ss.js?ver=2.4.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

130.211.21.179 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

179.21.211.130.bc.googleusercontent.com

Software

openresty /

Resource Hash

721058e7650d86401dca5dd898f1124d41d0f6ade38f54cb6412dc52f4d5a22c

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: koi-3qnocuxufa.marketingautomation.services
:scheme: https
:path: /publicChatbot?&requestedLanguage=en_US
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cyble.com/
accept-encoding: gzip, deflate, br
cookie: koitk=202110%7C61705c338e8c3c63fd1165ee
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/

Response headers

server: openresty
date: Wed, 20 Oct 2021 18:13:09 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
pod-hostname: app-7cc95b684f-8vwv4
x-xss-protection: 1; mode=block
x-clacks-overhead: GNU Terry Pratchett
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H2 200 polyfill.min.js Show response
koi-3qnocuxufa.marketingautomation.services/includes/js/dist/ Frame 869B 202 KB
58 KB 126ms
125ms Script
application/javascript 130.211.21.179
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://koi-3qnocuxufa.marketingautomation.services/includes/js/dist/polyfill.min.js?ver=9c22bbdc19-1
Requested by: Host: koi-3qnocuxufa.marketingautomation.services
URL: https://koi-3qnocuxufa.marketingautomation.services/publicChatbot?&requestedLanguage=en_US
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.21.179 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 179.21.211.130.bc.googleusercontent.com
Software: openresty /
Resource Hash: b9a6fca766ed9a201b3658950e9692b259d61f22b13e27b76cbc58d8fb5a4d86

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://koi-3qnocuxufa.marketingautomation.services/publicChatbot?&requestedLanguage=en_US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 18:13:09 GMT
content-encoding: gzip
last-modified: Wed, 20 Oct 2021 14:01:25 GMT
server: openresty
etag: W/"61702135-32984"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 google
cache-control: max-age=2592000, public
alt-svc: clear
expires: Fri, 19 Nov 2021 18:13:09 GMT

GET
H2 200 de.js Show response
storage.googleapis.com/frontend-prod/i18next/master/ Frame 869B 348 KB
84 KB 167ms
116ms Script
application/javascript 142.250.186.80
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/frontend-prod/i18next/master/de.js
Requested by: Host: koi-3qnocuxufa.marketingautomation.services
URL: https://koi-3qnocuxufa.marketingautomation.services/publicChatbot?&requestedLanguage=en_US
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.80 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s05-in-f16.1e100.net
Software: UploadServer /
Resource Hash: e54678dfd058b64a22548382b37278a0282507715439bcbe8de53826a8357736

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://koi-3qnocuxufa.marketingautomation.services/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 17:34:33 GMT
content-encoding: gzip
age: 2316
x-guploader-uploadid: ADPycdvNoJnsMZvkxz1hR4KyqQQdrZCd9DIjQ4n_9YB5-0JHZUEe7_Ayu8H5K6YIGP6P1p4DhlWqheg5mSfpNLGBMKg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 85704
last-modified: Fri, 15 Oct 2021 15:14:44 GMT
server: UploadServer
etag: "a20e6b0d2083c8e3adaec127e06c4d68"
x-goog-hash: crc32c=ZSDVBQ==, md5=og5rDSCDyOOtrsEn4GxNaA==
x-goog-generation: 1634310884813451
cache-control: public, max-age=31536000,no-transform
x-goog-stored-content-length: 85704
accept-ranges: bytes
content-type: application/javascript
expires: Thu, 20 Oct 2022 17:34:33 GMT

GET
H2 200 antd.css
storage.googleapis.com/frontend-prod/fireant/ae5dea6e/style/ Frame 869B 439 KB
440 KB 116ms
65ms Stylesheet
text/css 142.250.186.80
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/frontend-prod/fireant/ae5dea6e/style/antd.css
Requested by: Host: koi-3qnocuxufa.marketingautomation.services
URL: https://koi-3qnocuxufa.marketingautomation.services/publicChatbot?&requestedLanguage=en_US
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.80 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s05-in-f16.1e100.net
Software: UploadServer /
Resource Hash: 934ecb719a9eb78212ebfa8985f42d4242769b9b650622a1d6e16184378d8eb4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://koi-3qnocuxufa.marketingautomation.services/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 17:47:05 GMT
x-goog-meta-goog-reserved-file-mtime: 1634565015
age: 1564
x-guploader-uploadid: ADPycdsmx9lSHHt8Dt9wo_9Hj__TX-z1f2wfI8skpCe9pVKSw9lA19aNIKjSLvhKwRh__wyCt4COqKKcyQJrUSf5XUc8PKa3Fw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 449797
last-modified: Mon, 18 Oct 2021 15:17:54 GMT
server: UploadServer
etag: "79f1517ddc36a516ffbac1d4c1d47233"
x-goog-hash: crc32c=Joc7bg==, md5=efFRfdw2pRb/usHUwdRyMw==
x-goog-generation: 1634570274516380
cache-control: public, max-age=3600
x-goog-stored-content-length: 449797
accept-ranges: bytes
content-type: text/css
expires: Wed, 20 Oct 2021 18:47:05 GMT

GET
H2 200 en_US.main.css
storage.googleapis.com/frontend-prod/common/2b65a175/ Frame 869B 122 KB
63 KB 73ms
23ms Stylesheet
text/css 142.250.186.80
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/frontend-prod/common/2b65a175/en_US.main.css
Requested by: Host: koi-3qnocuxufa.marketingautomation.services
URL: https://koi-3qnocuxufa.marketingautomation.services/publicChatbot?&requestedLanguage=en_US
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.80 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s05-in-f16.1e100.net
Software: UploadServer /
Resource Hash: f1ed859b4f8d99954cde6f7b026c2b7fed468b457781cd0a15a4054350c60e77

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://koi-3qnocuxufa.marketingautomation.services/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 17:37:09 GMT
content-encoding: gzip
age: 2160
x-guploader-uploadid: ADPycdvEoZBF47a6WnrdP1yTGFV8kJLtEcLH9ZqYLDLCMmukZov83N-V0R0TPSnCaaJAo4bHRNAMZqS4PSfwE2m4wZA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64270
last-modified: Fri, 15 Oct 2021 15:10:03 GMT
server: UploadServer
etag: "7aec82a7eda3bc42af3cc16a00f56e2e"
x-goog-hash: crc32c=WRPaVA==, md5=euyCp+2jvEKvPMFqAPVuLg==
x-goog-generation: 1634310603183989
cache-control: public, max-age=31536000,no-transform
x-goog-stored-content-length: 64270
accept-ranges: bytes
content-type: text/css
expires: Thu, 20 Oct 2022 17:37:09 GMT

GET
H2 200 en_US.main.css
storage.googleapis.com/frontend-prod/chatbot-client/ae5dea6e/ Frame 869B 467 KB
62 KB 126ms
76ms Stylesheet
text/css 142.250.186.80
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/frontend-prod/chatbot-client/ae5dea6e/en_US.main.css
Requested by: Host: koi-3qnocuxufa.marketingautomation.services
URL: https://koi-3qnocuxufa.marketingautomation.services/publicChatbot?&requestedLanguage=en_US
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.80 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s05-in-f16.1e100.net
Software: UploadServer /
Resource Hash: d91b7379173a610f5694bdf81d5981ac06396de98d81d9b6c3ec974af7199a8e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://koi-3qnocuxufa.marketingautomation.services/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 17:37:09 GMT
content-encoding: gzip
age: 2160
x-guploader-uploadid: ADPycds2MY_hG55r7m22_yXxgPKkrqXLTnZRF17zyiRLv7rySB6F6IPqicHtg5WETnYtYBEanuw-eteyM5q52D5zVYk
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63057
last-modified: Mon, 18 Oct 2021 15:17:57 GMT
server: UploadServer
etag: "aecc18a24b66ee5a60e85fd1721fe5d0"
x-goog-hash: crc32c=peQl/Q==, md5=rswYoktm7lpg6F/Rch/l0A==
x-goog-generation: 1634570277365191
cache-control: public, max-age=31536000,no-transform
x-goog-stored-content-length: 63057
accept-ranges: bytes
content-type: text/css
expires: Thu, 20 Oct 2022 17:37:09 GMT

GET
H2 200 en_US.main.js Show response
storage.googleapis.com/frontend-prod/chatbot-client/ae5dea6e/ Frame 869B 5 MB
1 MB 183ms
133ms Script
application/javascript 142.250.186.80
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/frontend-prod/chatbot-client/ae5dea6e/en_US.main.js
Requested by: Host: koi-3qnocuxufa.marketingautomation.services
URL: https://koi-3qnocuxufa.marketingautomation.services/publicChatbot?&requestedLanguage=en_US
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.80 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s05-in-f16.1e100.net
Software: UploadServer /
Resource Hash: ce769faa3d393c9422fb5418b752a73f0205ff6226ff526cec4b8f4bac42b18c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://koi-3qnocuxufa.marketingautomation.services/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 17:37:09 GMT
content-encoding: gzip
age: 2160
x-guploader-uploadid: ADPycdsrXJOQ106rtqGEU9momcqGt0x6IJhIZkUdP5XfAybd1CBE4PwwpckIwHzhUlnvHPszNmyJcDbLQKI8Yi9P4b8
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1307388
last-modified: Mon, 18 Oct 2021 15:17:59 GMT
server: UploadServer
etag: "56408f2af2c53d46d0f7936023ef5639"
x-goog-hash: crc32c=bOdXqw==, md5=VkCPKvLFPUbQ95NgI+9WOQ==
x-goog-generation: 1634570279771176
cache-control: public, max-age=31536000,no-transform
x-goog-stored-content-length: 1307388
accept-ranges: bytes
content-type: application/javascript
expires: Thu, 20 Oct 2022 17:37:09 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 869B 3 KB
452 B 76ms
36ms Stylesheet
text/css 142.250.186.42
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:300,400,700,400italic

Requested by

Host: storage.googleapis.com
URL: https://storage.googleapis.com/frontend-prod/common/2b65a175/en_US.main.css

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.42 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f10.1e100.net

Software

ESF /

Resource Hash

a5ddf2469807caf322bb1497448b719f38b32836bd59e333899e005404412382

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://storage.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 20 Oct 2021 17:10:37 GMT
server: ESF
date: Wed, 20 Oct 2021 18:13:09 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Wed, 20 Oct 2021 18:13:09 GMT

POST
H2 200 graphql-public Show response
koi-3qnocuxufa.marketingautomation.services/ Frame 869B 30 KB
30 KB 260ms
260ms XHR
application/json 130.211.21.179
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://koi-3qnocuxufa.marketingautomation.services/graphql-public
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/frontend-prod/chatbot-client/ae5dea6e/en_US.main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.21.179 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 179.21.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 3deedebb6765a0807e2b256d4524d1774d351b4ed74276ba0d2f6010e35cd0b1

Request headers

accept: */*
Referer: https://koi-3qnocuxufa.marketingautomation.services/publicChatbot?&requestedLanguage=en_US
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type: application/json

Response headers

date: Wed, 20 Oct 2021 18:13:10 GMT
via: 1.1 google
vary: Origin
content-type: application/json
access-control-allow-origin: https://koi-3qnocuxufa.marketingautomation.services
alt-svc: clear
content-length: 30598
x-kube-pod: api-6f77b74bdd-zclb6

GET
H3 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v20/ Frame 869B 23 KB
23 KB 34ms
34ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v20/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,700,400italic

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

sffe /

Resource Hash

c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://koi-3qnocuxufa.marketingautomation.services
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 15:11:30 GMT
x-content-type-options: nosniff
age: 183700
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23484
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:19:01 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 18 Oct 2022 15:11:30 GMT

GET
DATA 200
OK truncated
/ Frame 869B 91 KB
91 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5265ceb942a286e3910b372c97f4466b3db1e7a6861af11618dfd852307adaab

Request headers

Referer
Origin: https://koi-3qnocuxufa.marketingautomation.services
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: font/woff

POST
H2 200 graphql-public Show response
koi-3qnocuxufa.marketingautomation.services/ Frame 869B 30 KB
30 KB 196ms
190ms XHR
application/json 130.211.21.179
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://koi-3qnocuxufa.marketingautomation.services/graphql-public
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/frontend-prod/chatbot-client/ae5dea6e/en_US.main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.21.179 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 179.21.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 3deedebb6765a0807e2b256d4524d1774d351b4ed74276ba0d2f6010e35cd0b1

Request headers

accept: */*
Referer: https://koi-3qnocuxufa.marketingautomation.services/publicChatbot?&requestedLanguage=en_US
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type: application/json

Response headers

date: Wed, 20 Oct 2021 18:13:10 GMT
via: 1.1 google
vary: Origin
content-type: application/json
access-control-allow-origin: https://koi-3qnocuxufa.marketingautomation.services
alt-svc: clear
content-length: 30598
x-kube-pod: api-6f77b74bdd-bg5cw

GET
H2 204 boom.gif
pixel.wp.com/ 0
36 B 6ms
6ms Image
text/plain 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/boom.gif?bilmur=1&cumulative_layout_shift=0.349&largest_contentful_paint=1772&provider=wordpress.com&service=atomic&effective_connection_type=4g&host_name=blog.cyble.com&url_path=%2F2021%2F06%2F03%2Fnucleus-software-becomes-victim-of-the-blackcocaine-ransomware%2F&nt_fetchStart=156&nt_domainLookupStart=157&nt_domainLookupEnd=172&nt_connectStart=172&nt_connectEnd=187&nt_secureConnectionStart=178&nt_requestStart=187&nt_responseStart=800&nt_responseEnd=861&nt_domLoading=803&nt_domInteractive=1452&nt_domContentLoadedEventStart=1454&nt_domContentLoadedEventEnd=1456&nt_domComplete=3002&nt_loadEventStart=3002&nt_loadEventEnd=3004&nt_redirectCount=0&nt_api_level=2&start_render=1438&first_contentful_paint=1438&resource_size=657553&resource_transferred=141087&js_size=211001&js_transferred=70135&resource_cache_percent=0&js_cache_percent=0&last_resource_end=3374
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 18:13:11 GMT
cache-control: no-cache
server: nginx

Verdicts & Comments Add Verdict or Comment

99 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

29 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.t.co/	1970-01-20 15:37:05	Name: muc Value: 24c240d7-eb89-497e-be2b-98d777db1e2e
blog.cyble.com/	1970-01-20 02:28:41	Name: _wsm_ref_1_abdf Value: %5B%22%22%2C%22%22%2C1634753587%2C%22https%3A%2F%2Ft.co%2F%22%5D
blog.cyble.com/	1970-01-20 07:31:48	Name: _wsm_id_1_abdf Value: 7ea3f018a46c91a7.1634753587.1.1634753587.1634753587
blog.cyble.com/	1970-01-19 22:05:55	Name: _wsm_ses_1_abdf Value: *
.cyble.com/	1970-01-20 15:37:05	Name: _ga_4FJGSRPM4S Value: GS1.1.1634753587.1.0.1634753587.0
blog.cyble.com/	1970-01-19 22:07:19	Name: __ss Value: 1634753587521
blog.cyble.com/	1970-01-19 22:05:57	Name: __ss_referrer Value: https%3A//blog.cyble.com/2021/06/03/nucleus-software-becomes-victim-of-the-blackcocaine-ransomware/
.cyble.com/	1970-01-20 15:37:05	Name: _ga Value: GA1.2.646664508.1634753588
.cyble.com/	1970-01-19 22:07:19	Name: _gid Value: GA1.2.981059902.1634753588
.cyble.com/	1970-01-19 22:05:53	Name: _gat_gtag_UA_201575643_1 Value: 1
.marketingautomation.services/	1970-01-23 13:41:53	Name: koitk Value: 202110%7C61705c338e8c3c63fd1165ee
blog.cyble.com/	1970-01-29 01:05:53	Name: __ss_tk Value: 202110%7C61705c338e8c3c63fd1165ee
.prfct.co/	1970-01-20 15:37:05	Name: pa_uid Value: pa_eopiesZY0CVQYMVX8
.prfct.co/	1970-01-20 15:37:05	Name: pa_twitter_ts Value: 1634753588204
.adnxs.com/	1970-01-20 00:15:29	Name: uuid2 Value: 7768424339185166985
.adnxs.com/	1970-01-20 00:15:29	Name: anj Value: dTM7k!M4/8CxrEQF']wIg2In39iu/z!@wnf-Te9(>wL5L!!'U>$h`p+
.prfct.co/	1970-01-20 15:37:05	Name: pa_crosswise_ts Value: 1634753588236
.prfct.co/	1970-01-20 15:37:05	Name: pa_yahoo_ts Value: 1634753588258
.prfct.co/	1970-01-20 15:37:05	Name: pa_openx_ts Value: 1634753588258
.prfct.co/	1970-01-20 15:37:05	Name: pa_rubicon_ts Value: 1634753588259
.prfct.co/	1970-01-20 15:37:05	Name: pa_google_ts Value: 1634753588261
.yahoo.com/	1970-01-20 06:51:51	Name: A3 Value: d=AQABBDRccGECEBk9815UP9CZ4hdl97V4ZyMFEgEBAQGtcWF6YQAAAAAA_eMAAA&S=AQAAAqTOVb2bZ3mIH7ZJiCnV-Ew
.analytics.yahoo.com/	1970-01-20 06:52:55	Name: IDSYNC Value: 18z4~212i
.openx.net/	1970-01-20 06:51:29	Name: i Value: 020a7ac9-199b-4858-8e3d-73449ac793bc\|1634753588
.twitter.com/	1970-01-20 15:37:05	Name: personalization_id Value: "v1_f0Ob8wmNvpTXjDMIEKmHJw=="
.doubleclick.net/	1970-01-20 07:27:29	Name: IDE Value: AHWqTUkgWVbmt2wpFEVODsp1gLvMflG1X4Kbfx-HcgRnxXTqRTUKEXCHLReb166uwNQ
.addthis.com/	1970-01-20 07:27:29	Name: ouid Value: 61705c34000108dc991b44d28c4624e923ff10147b22d23ee80a
.addthis.com/	1970-01-20 07:27:29	Name: uid Value: 61705c348c13c372
.addthis.com/	1970-01-20 07:27:29	Name: na_id Value: 2021102018130840300290851705

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.twitter.com
blog.cyble.com
cm.g.doubleclick.net
cw.addthis.com
cybleinc.com
fonts.googleapis.com
fonts.gstatic.com
graph.facebook.com
koi-3qnocuxufa.marketingautomation.services
pixel-geo.prfct.co
pixel.prfct.co
pixel.rubiconproject.com
pixel.wp.com
platform.twitter.com
public-api.wordpress.com
s0.wp.com
secure.adnxs.com
stats.wp.com
storage.googleapis.com
syndication.twitter.com
t.co
tag.perfectaudience.com
ups.analytics.yahoo.com
us-u.openx.net
widgets.wp.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.gstatic.com
104.244.42.131
104.244.42.197
104.244.42.72
104.69.95.62
130.211.21.179
142.250.185.104
142.250.185.142
142.250.185.164
142.250.186.163
142.250.186.35
142.250.186.42
142.250.186.80
151.101.130.217
157.240.20.15
172.217.23.98
18.156.0.31
192.0.76.3
192.0.77.32
192.0.78.183
192.0.78.207
192.0.78.23
34.201.86.165
34.246.96.178
34.98.64.218
37.252.173.62
69.173.144.139
93.184.220.66
00a57617df99ac957720b7332f9d15449def3ebe11169d68f12c47a3cde5168d
0199ad8ea9b2446429410cb808de39dff62aa7ca44de37bb3360ba3a60984048
031add161d91814922bde2623cb229b874838141693c74623103f7b35e61fd61
0c97c6ce5fdeb2d91e4bc6263d3714ca800b990c1994cf0b6dac0f23c8fbabfe
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
1190115dd7e6fbd896f8b541ad48a2dea9c4214cd240ffe2726d8e90d8eb9467
13c6db1ac0497928444e50aac43b5213354270c74537966202618efc12778122
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
2256c9e5605323f852f232fd6819a02cf2cac3e04c84299e19efe83037fd8cda
295426f89c923624640e8f1bb52e3438a7b43fb7efa84c1dc6bbbd41971c0f10
2e443dbb116d4efb3edfddb77cd4b2c93313cb6d8e75800602a92f0a9fa22d88
3deedebb6765a0807e2b256d4524d1774d351b4ed74276ba0d2f6010e35cd0b1
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3f8783f02df4a222a0ace31fa459efe88422cbce27fe272b07dd110396770659
487eb945b4b40b80638387640b40bf1c2272a28a8def698e2c9e271732cf38ad
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5265ceb942a286e3910b372c97f4466b3db1e7a6861af11618dfd852307adaab
53bb85849942fe0fdb6998300d0c68f1727a6f34a3bdcd9f6f8f12476f64b1e9
53c088f65c77c6b7af2804face3e267d4c1bf148177798a30fa3a15aa693c36f
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6f57fb9a35844c9f3a3de7e77064fb4c99420947b2d9490936462c9a0fd40f67
71d0ae4a963e44b9703ca229bf96f09d47feb12f36f014f50219a73702bac1d5
721058e7650d86401dca5dd898f1124d41d0f6ade38f54cb6412dc52f4d5a22c
726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3
77d279abfeb9b3b4923f4f464b9b25ca78adb34169c547fcefef6f65780265bf
79530645f505feaf1116f9c014a96cb2563ecfc242b56700b4aa5cb80b2f9503
80ee2d8ce5d2a3f78fc3b8eaa67bc266645c58b96d8a804556f1e6cb8737d0cf
8c21cdf7be2219908a953d92fba153dcc7175f7ee238856bd9954da18b0e05dd
8c78a51baaafdb60084333cabd9099b2f37278adf882cea7d5de0ef1188c5aa6
934ecb719a9eb78212ebfa8985f42d4242769b9b650622a1d6e16184378d8eb4
964f0a230990d84fb2dda38021aedfd2296837324b6f3b57b3b96d45ead320c5
9b2b63b24b7c2f3d98ec7739ab17ca233a578c54f5f86fb496d8341749b48670
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a2dd78e7291fc44d932317439b6141942d43e07156e69e04fb3cba6dba89294b
a5ddf2469807caf322bb1497448b719f38b32836bd59e333899e005404412382
ab0bc34c4b8744c2e79fc6b7d071c6669b7955c6ba1dad90e551bee5c4696f82
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad54fb3ec271e2a3834a223435faf9cda951ee7cad66ee311683230c387c683e
b5c5ef71bd69f096d2e4a3101793df24319cb32b8e784aa5bd064bdb8bffd9df
b9a6fca766ed9a201b3658950e9692b259d61f22b13e27b76cbc58d8fb5a4d86
ba58ed4e8dd5b19dda4a55b9ea0e7561c8365d5999673ddbcbb7269fca2d3dd0
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c219e03b0e7e5456d670f133166f335807bb8e706665b7012a6b3ff313404dfb
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
c40fb1a20fe9d56012b7242b5c9c2494d8f306e1fd5901492e8ce3b80811c9e3
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e
ccd1ae8d139b4ddb53c470f4a9ff95259b89b0572b88bc33b4baf78636f2782d
cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c
ce769faa3d393c9422fb5418b752a73f0205ff6226ff526cec4b8f4bac42b18c
d77a29735922e3ab5137a20474789943fa488e93c950e777ce4ed67e1902735b
d7b1f5c34d7673acfa55186ef5a55e6584d594414ce3ef824181eaf81b7e6c65
d91b7379173a610f5694bdf81d5981ac06396de98d81d9b6c3ec974af7199a8e
dda2aba38252dcb4fde2222ecdcf5806f23fc3e9400f310f0ee1927329243c78
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e54678dfd058b64a22548382b37278a0282507715439bcbe8de53826a8357736
e546d67779e98f0e4e81ae78801ea3d7d50be625d03c63f62de57b1cc9cacb83
e59c72af5434c3ae50fcd367e1d4d41805765dac58528c94b1b0fe22616ee6e9
e719f0d742bc72d3f5f7cb95dd14986179039aa32b7976d4a3d37bf64fbb21b2
ebb66d63a8a9022ea2689ddcd30b44867e0d6721a6c42c5db76e11cdb81f3e26
ec7ef7aa5fd1e019f1c26193e95e46d481d4983673936a9dda086705ada6e3d5
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1ed859b4f8d99954cde6f7b026c2b7fed468b457781cd0a15a4054350c60e77
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f9a1b42f20a092d66a17aa396c661eecaa4eae05b7136b66116de91a71760f95
fc27aed7787a4f63d2feba50e6bc6122ac3c5479456d40c0a445899a08ad92f3
ff8f27b09179d63d447916d984c45126ddd02c50feca4d533de2cbd57935afc4

blog.cyble.com Open in urlscan Pro 192.0.78.183 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

76 Requests

100 %HTTPS

0 %IPv6

21 Domains

29 Subdomains

25 IPs

6 Countries

3494 kBTransfer

10050 kBSize

29 Cookies

10 Outgoing links

Page URL History

Redirected requests

76 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

blog.cyble.com Open in urlscan Pro
192.0.78.183 Public Scan

Screenshot
Live screenshot

Full Image

76
Requests

100 %
HTTPS

0 %
IPv6

21
Domains

29
Subdomains

25
IPs

6
Countries

3494 kB
Transfer

10050 kB
Size

29
Cookies

76 HTTP transactions
3 data transactions