blog.sucuri.net Open in urlscan Pro
192.124.249.5  Public Scan

60 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 53

• https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0 HTTP 302
• https://www.google.com/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=2995817121 HTTP 302
• https://www.google.de/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=2995817121&ipr=y

Request Chain 55

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1620681851221&url=https%3A%2F%2Fblog.sucuri.net%2F2019%2F04%2Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D179713%26time%3D1620681851221%26url%3Dhttps%253A%252F%252Fblog.sucuri.net%252F2019%252F04%252Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1620681851221&url=https%3A%2F%2Fblog.sucuri.net%2F2019%2F04%2Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1620681851221&url=https%3A%2F%2Fblog.sucuri.net%2F2019%2F04%2Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html&liSync=true&e_ipv6=AQJMGIwbX6fWbAAAAXlYKoXHGr0ZCkk5f_-fkdPGNZRlIMZ87ehcz3XO6B2TWTcfQHycurZn

76 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request malware-campaigns-sharing-network-resources-r00ts-ninja.html Show response blog.sucuri.net/2019/04/	58 KB 14 KB	1106ms 707ms	Document text/html	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 3727b9acb777b8945b09b2bab1af603118f883f5d6e5d6b9e5b4787faf0308ee Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :method GET :authority blog.sucuri.net :scheme https :path /2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers server nginx date Mon, 10 May 2021 21:24:10 GMT content-type text/html; charset=UTF-8 content-length 13902 x-sucuri-id 19005 x-xss-protection 1; mode=block 1; mode=block x-frame-options SAMEORIGIN x-content-type-options nosniff nosniff strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-security-policy upgrade-insecure-requests; upgrade-insecure-requests content-encoding gzip x-cacheable YES:Forced age 75219 vary Accept-Encoding, User-Agent x-cache cached x-cache-hit HIT x-backend all_requests accept-ranges none x-sucuri-cache MISS
GET H2	200	style.css blog.sucuri.net/wp-content/themes/sucuriblog0117/	72 KB 26 KB	49ms 46ms	Stylesheet text/css	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 5cd565b7dfb57b49ef6196a50e3de30828ca53b5935f29c3cf5e9f3b0f8f2969 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/themes/sucuriblog0117/style.css?ver=1.2.0 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1116 x-cache cached x-sucuri-cache HIT content-length 25776 x-xss-protection 1; mode=block 1; mode=block last-modified Fri, 27 Jan 2017 03:26:08 GMT server nginx x-frame-options SAMEORIGIN etag "11ffc-5470b06cf1400-gzip" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type text/css x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	style.min.css blog.sucuri.net/wp-includes/css/dist/block-library/	57 KB 9 KB	69ms 67ms	Stylesheet text/css	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-includes/css/dist/block-library/style.min.css?ver=5.7.1 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-includes/css/dist/block-library/style.min.css?ver=5.7.1 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 6672 x-cache cached x-sucuri-cache HIT content-length 8685 x-xss-protection 1; mode=block 1; mode=block last-modified Tue, 06 Apr 2021 23:50:28 GMT server nginx x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type text/css x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	select2.min.css blog.sucuri.net/wp-content/plugins/facetwp-select2/select2/	15 KB 3 KB	71ms 68ms	Stylesheet text/css	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-content/plugins/facetwp-select2/select2/select2.min.css?ver=4.0.1 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash ed026fedc8b8130aecd7be55e134a42efcaa8e90a5f2f8ec88aa9a1a5ab934ec Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/plugins/facetwp-select2/select2/select2.min.css?ver=4.0.1 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1116 x-cache cached x-sucuri-cache HIT content-length 1977 x-xss-protection 1; mode=block 1; mode=block last-modified Tue, 12 Jul 2016 17:48:32 GMT server nginx x-frame-options SAMEORIGIN etag "3af2-53773e0923c00-gzip" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type text/css x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	mashsb.min.css blog.sucuri.net/wp-content/plugins/mashsharer/assets/css/	46 KB 29 KB	76ms 74ms	Stylesheet text/css	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-content/plugins/mashsharer/assets/css/mashsb.min.css?ver=3.7.2 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash ff4832891f440eef69f6db3572ef7fc3e69f6635bf0d56af126b3930c0a5070e Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/plugins/mashsharer/assets/css/mashsb.min.css?ver=3.7.2 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1116 x-cache cached x-sucuri-cache HIT content-length 28613 x-xss-protection 1; mode=block 1; mode=block last-modified Mon, 18 Nov 2019 16:21:30 GMT server nginx x-frame-options SAMEORIGIN etag "b75f-597a15713d680-gzip" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type text/css x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	css fonts.googleapis.com/	10 KB 903 B	19ms 17ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash ed7417187bc535fe583beec5f8796cd36869aff2763265a2c29536530319c59e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Mon, 10 May 2021 21:24:10 GMT server ESF date Mon, 10 May 2021 21:24:10 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 10 May 2021 21:24:10 GMT
GET H2	200	cookie-banner.css blog.sucuri.net/wp-content/themes/sucuriblog0117/css/	10 KB 3 KB	88ms 86ms	Stylesheet text/css	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-content/themes/sucuriblog0117/css/cookie-banner.css?ver=20200427 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 5b888d5fe8064f7da845fc4b35a98b40600db773f04dd327fab5ffed447d9b82 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/themes/sucuriblog0117/css/cookie-banner.css?ver=20200427 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 990 x-cache cached x-sucuri-cache HIT content-length 2376 x-xss-protection 1; mode=block 1; mode=block last-modified Mon, 27 Apr 2020 17:30:25 GMT server nginx x-frame-options SAMEORIGIN etag "287c-5a44911fe4e40-gzip" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type text/css x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	frontend.min.js Show response blog.sucuri.net/wp-content/plugins/google-analytics-premium/assets/js/	9 KB 3 KB	89ms 87ms	Script application/javascript	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-content/plugins/google-analytics-premium/assets/js/frontend.min.js?ver=7.10.0 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 63a6d926d277a3d64d30e349fa0ea2b0630e9801d173e1947ff3bd6060147ef4 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/plugins/google-analytics-premium/assets/js/frontend.min.js?ver=7.10.0 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1116 x-cache cached x-sucuri-cache HIT content-length 2766 x-xss-protection 1; mode=block 1; mode=block last-modified Mon, 18 Nov 2019 16:19:47 GMT server nginx x-frame-options SAMEORIGIN etag "2452-597a150f02ec0-gzip" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type application/javascript x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	jquery.min.js Show response blog.sucuri.net/wp-includes/js/jquery/	87 KB 31 KB	90ms 88ms	Script application/javascript	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-includes/js/jquery/jquery.min.js?ver=3.5.1 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-includes/js/jquery/jquery.min.js?ver=3.5.1 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 6080 x-cache cached x-sucuri-cache HIT content-length 30916 x-xss-protection 1; mode=block 1; mode=block last-modified Wed, 07 Oct 2020 16:33:25 GMT server nginx x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type application/javascript x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	jquery-migrate.min.js Show response blog.sucuri.net/wp-includes/js/jquery/	11 KB 5 KB	93ms 92ms	Script application/javascript	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 6080 x-cache cached x-sucuri-cache HIT content-length 4169 x-xss-protection 1; mode=block 1; mode=block last-modified Thu, 19 Nov 2020 09:31:13 GMT server nginx x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type application/javascript x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	select2.min.js Show response blog.sucuri.net/wp-content/plugins/facetwp-select2/select2/	63 KB 19 KB	93ms 92ms	Script application/javascript	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-content/plugins/facetwp-select2/select2/select2.min.js?ver=4.0.1 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash ff6377c5173c4ee30318481c90cb7cc19987f2f5304871236266df11b0f48696 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/plugins/facetwp-select2/select2/select2.min.js?ver=4.0.1 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1116 x-cache cached x-sucuri-cache HIT content-length 18540 x-xss-protection 1; mode=block 1; mode=block last-modified Tue, 12 Jul 2016 17:48:32 GMT server nginx x-frame-options SAMEORIGIN etag "fd75-53773e0923c00-gzip" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type application/javascript x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	mashsb.min.js Show response blog.sucuri.net/wp-content/plugins/mashsharer/assets/js/	4 KB 2 KB	94ms 92ms	Script application/javascript	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-content/plugins/mashsharer/assets/js/mashsb.min.js?ver=3.7.2 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash a13a1fe4a87c09c6e9122834b5351f80012e2c539b32bc1d33c6982efab21b4b Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/plugins/mashsharer/assets/js/mashsb.min.js?ver=3.7.2 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1116 x-cache cached x-sucuri-cache HIT content-length 1533 x-xss-protection 1; mode=block 1; mode=block last-modified Mon, 18 Nov 2019 16:21:30 GMT server nginx x-frame-options SAMEORIGIN etag "114c-597a15713d680-gzip" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type application/javascript x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	48 KB 19 KB	9ms 6ms	Script text/javascript	2a00:1450:4001:828::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 09 Apr 2021 23:59:54 GMT server Golfe2 age 3438 date Mon, 10 May 2021 20:26:52 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19569 expires Mon, 10 May 2021 22:26:52 GMT
GET H2	200	17-EN-sucuri-blog-newsletter-banner.png blog.sucuri.net/wp-content/uploads/2017/09/	3 KB 4 KB	47ms 45ms	Image image/png	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Show image Full URL https://blog.sucuri.net/wp-content/uploads/2017/09/17-EN-sucuri-blog-newsletter-banner.png Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 52e26c085124647627c42c2cbce9a619b220a28420761233ea649d320f7c5518 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/uploads/2017/09/17-EN-sucuri-blog-newsletter-banner.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1107 x-cache cached x-sucuri-cache HIT content-length 3010 x-xss-protection 1; mode=block 1; mode=block last-modified Thu, 10 Oct 2019 13:11:10 GMT server nginx x-frame-options SAMEORIGIN etag "bc2-5948e2294d780" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type image/png x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	hoverIntent.min.js Show response blog.sucuri.net/wp-includes/js/	1 KB 1 KB	43ms 42ms	Script application/javascript	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-includes/js/hoverIntent.min.js?ver=1.8.1 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 495d2f8c8b7f1bbd664c2c10c086a644e63e4934b9734813b27956a34709eea4 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-includes/js/hoverIntent.min.js?ver=1.8.1 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 154569 x-cache cached x-sucuri-cache HIT content-length 492 x-xss-protection 1; mode=block 1; mode=block last-modified Tue, 26 Jan 2021 15:18:33 GMT server nginx x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type application/javascript x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	superfish.min.js Show response blog.sucuri.net/wp-content/themes/genesis/lib/js/menu/	5 KB 2 KB	43ms 43ms	Script application/javascript	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-content/themes/genesis/lib/js/menu/superfish.min.js?ver=1.7.5 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 68f2b0a3381830c544349d5df116c2b96ba1d8efa46cf0c15e3a130d91bf6ab4 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/themes/genesis/lib/js/menu/superfish.min.js?ver=1.7.5 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1115 x-cache cached x-sucuri-cache HIT content-length 1812 x-xss-protection 1; mode=block 1; mode=block last-modified Tue, 27 Nov 2018 17:57:24 GMT server nginx x-frame-options SAMEORIGIN etag "13ae-57ba92e896900-gzip" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type application/javascript x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	superfish.args.min.js Show response blog.sucuri.net/wp-content/themes/genesis/lib/js/menu/	132 B 750 B	45ms 41ms	Script application/javascript	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-content/themes/genesis/lib/js/menu/superfish.args.min.js?ver=2.7.1 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 20550f7bcb2a817ac9a5879e04260da8268e971c0b8031a6b7a2f48a55ee60d5 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/themes/genesis/lib/js/menu/superfish.args.min.js?ver=2.7.1 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1115 x-cache cached x-sucuri-cache HIT content-length 132 x-xss-protection 1; mode=block 1; mode=block last-modified Tue, 27 Nov 2018 17:57:24 GMT server nginx x-frame-options SAMEORIGIN etag "84-57ba92e896900-gzip" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type application/javascript x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	skip-links.min.js Show response blog.sucuri.net/wp-content/themes/genesis/lib/js/	344 B 854 B	46ms 42ms	Script application/javascript	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-content/themes/genesis/lib/js/skip-links.min.js?ver=2.7.1 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 0556982c2b3cf8fc78bc3d5d3c1e98b7861a0a8150ef7ecf2f3c7a733e4e0cf8 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/themes/genesis/lib/js/skip-links.min.js?ver=2.7.1 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1115 x-cache cached x-sucuri-cache HIT content-length 235 x-xss-protection 1; mode=block 1; mode=block last-modified Tue, 27 Nov 2018 17:57:24 GMT server nginx x-frame-options SAMEORIGIN etag "158-57ba92e896900-gzip" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type application/javascript x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	theme.js Show response blog.sucuri.net/wp-content/themes/sucuriblog0117/js/	3 KB 1 KB	46ms 43ms	Script application/javascript	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-content/themes/sucuriblog0117/js/theme.js?ver=1.1.0 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 6ae8162fefa27a4c1b69440f19e997af99d94d2e3fef9265e0c44c4caf7cbbda Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/themes/sucuriblog0117/js/theme.js?ver=1.1.0 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1114 x-cache cached x-sucuri-cache HIT content-length 859 x-xss-protection 1; mode=block 1; mode=block last-modified Wed, 14 Mar 2018 21:46:59 GMT server nginx x-frame-options SAMEORIGIN etag "a37-5676650887ac0-gzip" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type application/javascript x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	sticky.js Show response blog.sucuri.net/wp-content/themes/sucuriblog0117/js/	9 KB 3 KB	46ms 43ms	Script application/javascript	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-content/themes/sucuriblog0117/js/sticky.js?ver=1.0.4 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash cc07dc22acd75d21ea2a03ced344d13aeeea586029288b1d7004739f8ce3c7be Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/themes/sucuriblog0117/js/sticky.js?ver=1.0.4 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1115 x-cache cached x-sucuri-cache HIT content-length 2507 x-xss-protection 1; mode=block 1; mode=block last-modified Fri, 27 Jan 2017 03:26:08 GMT server nginx x-frame-options SAMEORIGIN etag "2502-5470b06cf1400-gzip" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type application/javascript x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	sticky-init.js Show response blog.sucuri.net/wp-content/themes/sucuriblog0117/js/	2 KB 1 KB	47ms 44ms	Script application/javascript	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-content/themes/sucuriblog0117/js/sticky-init.js?ver=1.0.1 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 36d47eadbca93ee9613695d80ee179247a0b6bd78b503a549778dbcbe46b0815 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/themes/sucuriblog0117/js/sticky-init.js?ver=1.0.1 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1114 x-cache cached x-sucuri-cache HIT content-length 536 x-xss-protection 1; mode=block 1; mode=block last-modified Fri, 27 Jan 2017 03:26:08 GMT server nginx x-frame-options SAMEORIGIN etag "667-5470b06cf1400-gzip" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type application/javascript x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	cookie-banner.js Show response blog.sucuri.net/wp-content/themes/sucuriblog0117/js/	4 KB 2 KB	47ms 44ms	Script application/javascript	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Full URL https://blog.sucuri.net/wp-content/themes/sucuriblog0117/js/cookie-banner.js?ver=20200914 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 5aafcc6bf2a5538e40efb22b67dee2fb1f1809b846853b69df489d70cac45a36 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/themes/sucuriblog0117/js/cookie-banner.js?ver=20200914 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT content-encoding gzip x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 2793 x-cache cached x-sucuri-cache HIT content-length 1277 x-xss-protection 1; mode=block 1; mode=block last-modified Mon, 14 Sep 2020 11:23:40 GMT server nginx x-frame-options SAMEORIGIN etag "e5b-5af444432af8e-gzip" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type application/javascript x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	A166802-5dda-4f98-aad8-1f58dbc8f1771.js Show response d.impactradius-event.com/	40 KB 13 KB	249ms 159ms	Script text/javascript	35.186.249.72 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.impactradius-event.com/A166802-5dda-4f98-aad8-1f58dbc8f1771.js Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.186.249.72 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 72.249.186.35.bc.googleusercontent.com Software UploadServer / Resource Hash 8235aa051c240d36805f28bb37173c4e2a40cf4b347e1d99d96db420caba3aa0 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT content-encoding gzip age 0 x-guploader-uploadid ABg5-UzO_6DSE-ONMeGNYNl5dHxNspQ-vV8WQ9vh5QThgZU448xI5phdt2MoQj3FJ_YN_THWpMNlvDUcCRqzSD-4kjnk0h2UVg x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding gzip alt-svc clear content-length 12966 last-modified Tue, 18 Feb 2020 03:14:51 GMT server UploadServer etag "7b386031dce97320ca627c68daf254c5" vary Accept-Encoding x-goog-hash crc32c=zxauHA==, md5=ezhgMdzpcyDKYnxo2vJUxQ== x-goog-generation 1581995691826115 cache-control public,max-age=900,s-maxage=300 x-goog-stored-content-length 12966 accept-ranges bytes content-type text/javascript; charset=utf-8 expires Mon, 10 May 2021 21:29:11 GMT
GET H2	200	utag.js Show response tags.tiqcdn.com/utag/gpl/sucuri/prod/	126 KB 30 KB	144ms 52ms	Script application/x-javascript	23.79.152.104 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.79.152.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-79-152-104.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cb6342a6075a391a1322ff1a4d0090475e5fd7c460fce3df8a890ffd9fdc0313 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT content-encoding gzip last-modified Tue, 27 Apr 2021 20:49:21 GMT server AkamaiNetStorage etag "86155228142db1c251738c7adfdbfb9e:1619556561.448604" vary Accept-Encoding content-type application/x-javascript cache-control max-age=300 accept-ranges bytes content-length 30192 expires Mon, 10 May 2021 21:29:11 GMT
GET H2	200	logo.png blog.sucuri.net/wp-content/themes/sucuriblog0117/images/	3 KB 4 KB	49ms 42ms	Image image/png	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Show image Full URL https://blog.sucuri.net/wp-content/themes/sucuriblog0117/images/logo.png Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 28aae72cc297372e89cf023bce6310cd1d7239a1b6612cdffdbb0fb04e10a6ec Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/themes/sucuriblog0117/images/logo.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority blog.sucuri.net referer https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0 :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1061 x-cache cached x-sucuri-cache HIT content-length 3346 x-xss-protection 1; mode=block 1; mode=block last-modified Fri, 27 Jan 2017 03:26:08 GMT server nginx x-frame-options SAMEORIGIN etag "d12-5470b06cf1400" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type image/png x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	mem8YaGs126MiZpBA-UFVZ0b.woff2 fonts.gstatic.com/s/opensans/v18/	14 KB 14 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:830::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0b.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://blog.sucuri.net Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 04 May 2021 01:50:37 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:09:22 GMT server sffe age 588813 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14380 x-xss-protection 0 expires Wed, 04 May 2022 01:50:37 GMT
GET H2	200	footer-logo.png blog.sucuri.net/wp-content/themes/sucuriblog0117/images/	5 KB 5 KB	48ms 48ms	Image image/png	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Show image Full URL https://blog.sucuri.net/wp-content/themes/sucuriblog0117/images/footer-logo.png Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 22bb0c5bd8a734570e15845cab2c13fab934924e44dc353a344ceeda1a830ff1 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/themes/sucuriblog0117/images/footer-logo.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority blog.sucuri.net referer https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0 :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:10 GMT x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1061 x-cache cached x-sucuri-cache HIT content-length 4881 x-xss-protection 1; mode=block 1; mode=block last-modified Fri, 27 Jan 2017 03:26:08 GMT server nginx x-frame-options SAMEORIGIN etag "1311-5470b06cf1400" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type image/png x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H3-29	200	mem5YaGs126MiZpBA-UNirkOUuhp.woff2 fonts.gstatic.com/s/opensans/v18/	15 KB 15 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:802::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhp.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600 Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1491de1b31182d38593bcf660c99bc6018af8e192d91663f67ec9d045a3b5ccc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://blog.sucuri.net Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 09 May 2021 10:03:38 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:09:47 GMT server sffe age 127232 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14880 x-xss-protection 0 expires Mon, 09 May 2022 10:03:38 GMT
GET DATA	200 OK	truncated /	11 KB 11 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 745caffca4b97cf5cf2374d82c6dfb6fb7c7b694e85432f92ec4dcb35f4418c9 Request headers Origin https://blog.sucuri.net Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type application/octet-stream
GET H3-29	200	mem5YaGs126MiZpBA-UN7rgOUuhp.woff2 fonts.gstatic.com/s/opensans/v18/	15 KB 15 KB	7ms 7ms	Font font/woff2	2a00:1450:4001:802::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600 Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://blog.sucuri.net Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 04 May 2021 20:40:38 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:11:00 GMT server sffe age 521012 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15056 x-xss-protection 0 expires Wed, 04 May 2022 20:40:38 GMT
GET DATA	200 OK	truncated /	14 KB 14 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6 Request headers Origin https://blog.sucuri.net Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type application/x-font-woff;charset=utf-8
GET H2	200	04022019-game-console-cryptojacking_blog.jpg blog.sucuri.net/wp-content/uploads/2019/04/	45 KB 46 KB	311ms 308ms	Image image/jpeg	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Show image Full URL https://blog.sucuri.net/wp-content/uploads/2019/04/04022019-game-console-cryptojacking_blog.jpg Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash cc10cddff83482cf4ab498592d229f4c48c0c4089b496603b4dc9c5fa5ef120c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/uploads/2019/04/04022019-game-console-cryptojacking_blog.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 54131 x-cache cached x-sucuri-cache MISS content-length 46257 x-xss-protection 1; mode=block 1; mode=block last-modified Thu, 10 Oct 2019 13:17:11 GMT server nginx x-frame-options SAMEORIGIN etag "b4b1-5948e381943c0" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type image/jpeg x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	javascript-sample-snippet--650x165.png blog.sucuri.net/wp-content/uploads/2019/04/	41 KB 42 KB	713ms 711ms	Image image/png	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Show image Full URL https://blog.sucuri.net/wp-content/uploads/2019/04/javascript-sample-snippet--650x165.png Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash d9b6e567370c4b3ab28a4fc7a95ec2f1be9e30289803a10fcf468ec33d07d904 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/uploads/2019/04/javascript-sample-snippet--650x165.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 416108 x-cache cached x-sucuri-cache MISS content-length 42067 x-xss-protection 1; mode=block 1; mode=block last-modified Thu, 10 Oct 2019 13:17:09 GMT server nginx x-frame-options SAMEORIGIN etag "a453-5948e37fabf40" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type image/png x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	DNS-relationship-chart-showing-shared-infrastructure-being-used-in-the-attacks--600x403.png blog.sucuri.net/wp-content/uploads/2019/04/	45 KB 45 KB	783ms 781ms	Image image/png	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Show image Full URL https://blog.sucuri.net/wp-content/uploads/2019/04/DNS-relationship-chart-showing-shared-infrastructure-being-used-in-the-attacks--600x403.png Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash cfe10be02743677fbe3b243f83f92026e51ff0d79d799913886cd4c4c60a8548 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/uploads/2019/04/DNS-relationship-chart-showing-shared-infrastructure-being-used-in-the-attacks--600x403.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 23970 x-cache cached x-sucuri-cache MISS content-length 45657 x-xss-protection 1; mode=block 1; mode=block last-modified Thu, 10 Oct 2019 13:17:07 GMT server nginx x-frame-options SAMEORIGIN etag "b259-5948e37dc3ac0" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type image/png x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	Xbox-webview-404-error-related-to-r00ts.ninja_.-Console-was-having-performance-problems-due-to-resources-being-used-for-cryptomining-in-the-background.-600x338.jpg blog.sucuri.net/wp-content/uploads/2019/04/	19 KB 20 KB	709ms 706ms	Image image/jpeg	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Show image Full URL https://blog.sucuri.net/wp-content/uploads/2019/04/Xbox-webview-404-error-related-to-r00ts.ninja_.-Console-was-having-performance-problems-due-to-resources-being-used-for-cryptomining-in-the-background.-600x338.jpg Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 86c57b05fdc2d00b7f7f88f6807181eb296108b7a8d703fba969dbb7689906aa Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/uploads/2019/04/Xbox-webview-404-error-related-to-r00ts.ninja_.-Console-was-having-performance-problems-due-to-resources-being-used-for-cryptomining-in-the-background.-600x338.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 112060 x-cache cached x-sucuri-cache MISS content-length 19813 x-xss-protection 1; mode=block 1; mode=block last-modified Thu, 10 Oct 2019 13:17:26 GMT server nginx x-frame-options SAMEORIGIN etag "4d65-5948e38fe2580" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type image/jpeg x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	20-side-bar-widgetlogic-2019-website-threat-report.png blog.sucuri.net/wp-content/uploads/2020/02/	154 KB 154 KB	48ms 46ms	Image image/png	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Show image Full URL https://blog.sucuri.net/wp-content/uploads/2020/02/20-side-bar-widgetlogic-2019-website-threat-report.png Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 54255469b8af99948eb1636aa77fa443ae0666fd4cceb9fc3adcbdcd06eba89a Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/uploads/2020/02/20-side-bar-widgetlogic-2019-website-threat-report.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1112 x-cache cached x-sucuri-cache HIT content-length 157379 x-xss-protection 1; mode=block 1; mode=block last-modified Wed, 05 Feb 2020 17:10:47 GMT server nginx x-frame-options SAMEORIGIN etag "266c3-59dd73ccab3c0" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type image/png x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	blog-sidebar_widgetlogic_emailCourse_wordpress-security.png blog.sucuri.net/wp-content/uploads/2019/04/	12 KB 13 KB	67ms 66ms	Image image/png	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Show image Full URL https://blog.sucuri.net/wp-content/uploads/2019/04/blog-sidebar_widgetlogic_emailCourse_wordpress-security.png Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash ec374edf9c52c6aae3b672424c611799883a29af5785c94985a6d9e4eb907e93 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/uploads/2019/04/blog-sidebar_widgetlogic_emailCourse_wordpress-security.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1213 x-cache cached x-sucuri-cache HIT content-length 12283 x-xss-protection 1; mode=block 1; mode=block last-modified Thu, 10 Oct 2019 13:17:03 GMT server nginx x-frame-options SAMEORIGIN etag "2ffb-5948e379f31c0" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type image/png x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	blog-sidebar_widgetlogic_webinars_anatomy-of-website-malware.png blog.sucuri.net/wp-content/uploads/2019/05/	27 KB 28 KB	69ms 68ms	Image image/png	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Show image Full URL https://blog.sucuri.net/wp-content/uploads/2019/05/blog-sidebar_widgetlogic_webinars_anatomy-of-website-malware.png Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 79f9a0ec2c750edde8d9fa73ee77f59b6df6705fa148544dd00f7f126ce6e6d9 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/uploads/2019/05/blog-sidebar_widgetlogic_webinars_anatomy-of-website-malware.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1411 x-cache cached x-sucuri-cache HIT content-length 28078 x-xss-protection 1; mode=block 1; mode=block last-modified Thu, 10 Oct 2019 13:18:15 GMT server nginx x-frame-options SAMEORIGIN etag "6dae-5948e3be9d3c0" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type image/png x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	blog-sidebar_widgetlogic_guides_wordpress-security.png blog.sucuri.net/wp-content/uploads/2019/05/	13 KB 13 KB	71ms 70ms	Image image/png	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Show image Full URL https://blog.sucuri.net/wp-content/uploads/2019/05/blog-sidebar_widgetlogic_guides_wordpress-security.png Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 48eb8ebb42357edb3792a468c6daef81e653a9e3ad71954b58de86a0acad238c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/uploads/2019/05/blog-sidebar_widgetlogic_guides_wordpress-security.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1417 x-cache cached x-sucuri-cache HIT content-length 13016 x-xss-protection 1; mode=block 1; mode=block last-modified Thu, 10 Oct 2019 13:18:21 GMT server nginx x-frame-options SAMEORIGIN etag "32d8-5948e3c456140" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type image/png x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	blog-sidebar_widgetlogic_webinars_GUEST-plugin-security.png blog.sucuri.net/wp-content/uploads/2019/05/	23 KB 23 KB	72ms 71ms	Image image/png	192.124.249.5 SUCURI-SEC
General Check archive.org Show headers Download Go to Show image Full URL https://blog.sucuri.net/wp-content/uploads/2019/05/blog-sidebar_widgetlogic_webinars_GUEST-plugin-security.png Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US), Reverse DNS cloudproxy10005.sucuri.net Software nginx / Resource Hash 97ae5da22b00765eaf567337437481788d3c81f95b8c1f295cf994c6e597167c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains X-Content-Type-Options nosniff nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block 1; mode=block Request headers :path /wp-content/uploads/2019/05/blog-sidebar_widgetlogic_webinars_GUEST-plugin-security.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority blog.sucuri.net referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html :scheme https sec-fetch-site same-origin :method GET Referer https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff nosniff x-cacheable YES x-backend all_requests age 1418 x-cache cached x-sucuri-cache HIT content-length 23061 x-xss-protection 1; mode=block 1; mode=block last-modified Thu, 10 Oct 2019 13:18:10 GMT server nginx x-frame-options SAMEORIGIN etag "5a15-5948e3b9d8880" strict-transport-security max-age=31536000 max-age=300 max-age=31536000; includeSubDomains content-type image/png x-cache-hit HIT cache-control max-age=315360000 x-sucuri-id 19005 content-security-policy upgrade-insecure-requests; upgrade-insecure-requests accept-ranges bytes expires Thu, 31 Dec 2037 23:55:55 GMT
POST H3-29	200	collect Show response www.google-analytics.com/j/	4 B 24 B	13ms 13ms	XHR text/plain	2a00:1450:4001:828::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1838192592&t=pageview&_s=1&dl=https%3A%2F%2Fblog.sucuri.net%2F2019%2F04%2Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html&ul=en-us&de=UTF-8&dt=Malware%20Campaigns%20Sharing%20Network%20Resources%3A%20r00ts.ninja&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IGBACEABBAAAAC~&jid=1384798351&gjid=519424324&cid=1902923596.1620681851&tid=UA-4077922-18&_gid=1959016528.1620681851&_r=1&_slc=1&z=935442863 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://blog.sucuri.net cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 88 B	15ms 15ms	XHR text/plain	2a00:1450:400c:c04::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-4077922-18&cid=1902923596.1620681851&jid=1384798351&gjid=519424324&_gid=1959016528.1620681851&_u=IGBACEAABAAAAC~&z=1765067594 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c04::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Mon, 10 May 2021 21:24:11 GMT content-type text/plain access-control-allow-origin https://blog.sucuri.net cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	mixpanel-2-latest.min.js Show response cdn.mxpnl.com/libs/	75 KB 25 KB	45ms 39ms	Script text/javascript	130.211.5.208 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 130.211.5.208 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 208.5.211.130.bc.googleusercontent.com Software UploadServer / Resource Hash 07bf87548212f24057ba352fed5ec567dab724b44a7fc88ddc393cbc7706d033 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:17:23 GMT content-encoding gzip age 408 x-guploader-uploadid ABg5-UxgbSR29Ud7YJGlSZIRF-cYdXgSxJP9WSbTrPvmFvcVZQLMCexz8zZ57LEFH-5IHD1aFNc1gO65oH2GVZ1ZGvo x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 2 x-goog-stored-content-encoding gzip alt-svc clear content-length 25572 last-modified Thu, 28 Jan 2021 18:21:54 GMT server UploadServer etag "765779983eed1c9fc2821b4507eea08b" vary Accept-Encoding x-goog-hash crc32c=kP//+g==, md5=dld5mD7tHJ/CghtFB+6giw== x-goog-generation 1611858114590219 access-control-allow-origin * cache-control public,max-age=600 x-goog-stored-content-length 25572 accept-ranges bytes content-type text/javascript expires Mon, 10 May 2021 21:27:23 GMT
GET H2	200	loader0.js Show response static.olark.com/jsclient/ Frame 6D18	9 KB 3 KB	184ms 43ms	Script application/javascript	93.184.220.42 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://static.olark.com/jsclient/loader0.js Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.184.220.42 London, United Kingdom, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6BA1) / Resource Hash 808eb265de61e9113e4e7e91dd0d50062a103b11d0a73efa4a101d17996d1b8a Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT content-encoding gzip last-modified Fri, 11 Dec 2020 21:20:29 GMT server ECS (amb/6BA1) age 1681 etag W/"5fd3e29d-234d" vary Accept-Encoding x-cache HIT p3p CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p' via 1.1 google cache-control max-age=2700 accept-ranges bytes content-type application/javascript; charset=utf-8 content-length 3199 expires Mon, 10 May 2021 22:09:11 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	17ms 17ms	Image image/gif	2a00:1450:4001:831::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-4077922-18&cid=1902923596.1620681851&jid=1384798351&_u=IGBACEAABAAAAC~&z=1411471687 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	16ms 16ms	Image image/gif	2a00:1450:4001:829::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-4077922-18&cid=1902923596.1620681851&jid=1384798351&_u=IGBACEAABAAAAC~&z=1411471687 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	88 KB 35 KB	19ms 19ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-4077922-18 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash d9c45c40e6dc13d76078d5c5c45992887fded0a4909cfb21239b3cfc98070197 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35721 x-xss-protection 0 last-modified Mon, 10 May 2021 21:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 10 May 2021 21:24:11 GMT
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	4 KB 2 KB	8ms 7ms	Script application/x-javascript	2a02:26f0:6c00:296::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:296::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 10 May 2021 21:24:11 GMT Content-Encoding gzip Last-Modified Mon, 04 Jan 2021 22:14:03 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=25814 Connection keep-alive Accept-Ranges bytes Content-Length 1855
GET H2	200	bat.js Show response bat.bing.com/	30 KB 9 KB	30ms 29ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 3183481f09352eade87e53d32ac3c1f6ab5b853e2b5bde4035834680b53d9299 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT content-encoding gzip last-modified Tue, 13 Apr 2021 17:21:02 GMT x-msedge-ref Ref A: 9BF78D21B6C444C195AFBC948CA89B9E Ref B: FRAEDGE1511 Ref C: 2021-05-10T21:24:11Z etag "0d398608930d71:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 8910
GET H2	200	498146.js Show response js.hs-scripts.com/	987 B 883 B	472ms 453ms	Script application/javascript	2606:4700::6811:d6cc CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-scripts.com/498146.js Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6811:d6cc , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 53f0b8105379853181807da7e7f7a924c8d867e92abfb8d72cff9908130ba6fc Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT content-encoding br vary Accept-Encoding cf-cache-status EXPIRED x-hubspot-correlation-id e18998f7-0d38-495a-8553-e66fd4eab70b cf-request-id 09f9c3994e00004ac3e300f000000001 server cloudflare x-trace 2B22B2A8E76731CBB6477A4392141D11C83CB58EE3000000000000000000 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3600 content-type application/javascript;charset=utf-8 access-control-allow-origin https://blog.sucuri.net cache-control public, max-age=60 access-control-allow-credentials true cf-ray 64d63ba21f9e4ac3-FRA expires Mon, 10 May 2021 21:25:11 GMT
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	92 KB 24 KB	20ms 6ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash a517525b8a7d39bcaf1cf5f9695c5be8fce7a6b920a3924c1a4f70e8ea748c05 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; content-encoding gzip x-content-type-options nosniff content-security-policy-report-only default-src https: data: wss: blob: chrome-extension: 'unsafe-inline' 'unsafe-eval';report-uri https://www.facebook.com/csp/reporting/; cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 23959 x-xss-protection 0 pragma public x-fb-debug yH7i9JmHG60Rv5ZeXvKv6DX4qwIq1Dk3kLLM6Jl/v79h/7Bgvd/rDQVd2O5/qBUwMauxrbQje4Qdbt8hRaETDA== x-fb-trip-id 686109401 x-frame-options DENY date Mon, 10 May 2021 21:24:11 GMT strict-transport-security max-age=31536000; preload; includeSubDomains content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	hotjar-1177970.js Show response static.hotjar.com/c/	3 KB 2 KB	151ms 49ms	Script application/javascript	13.32.25.2 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-1177970.js?sv=6 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.25.2 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-25-2.fra56.r.cloudfront.net Software / Resource Hash 9dd34a9b4575b9e907d944ad25d59e2b4eeb576927d86a624a0fa4d83812634e Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:23:40 GMT content-encoding br x-content-type-options nosniff cache-control max-age=60 age 31 etag W/5bd8822c24535b4dd5ff247cebf72da4 vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript; charset=UTF-8 access-control-allow-origin * x-cache-hit 1 x-amz-cf-pop FRA56-C2 content-length 1539 via 1.1 753f415578c1ca010e51a83aef192331.cloudfront.net (CloudFront) x-amz-cf-id SpACOeOXg03WBQzejvq1KIDSLZq6GOqL263ALxL0If5IcGkAq6oqEA==
GET H2	200	uwt.js Show response static.ads-twitter.com/	5 KB 2 KB	129ms 37ms	Script application/javascript	199.232.136.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT via 1.1 varnish last-modified Fri, 04 Dec 2020 00:21:46 GMT age 73954 etag "cbc512946c8abb461c6215ed5b454e5f+gzip" vary Accept-Encoding,Host x-cache HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" content-encoding gzip cache-control no-cache accept-ranges bytes content-type application/javascript; charset=utf-8 content-length 1957 x-timer S1620681851.313306,VS0,VE0 x-served-by cache-hhn11579-HHN
GET H2	200	utag.v.js Show response tags.tiqcdn.com/utag/tiqapp/	2 B 202 B	44ms 43ms	Script application/x-javascript	23.79.152.104 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=gpl/sucuri/202104272049&cb=1620681851200 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.79.152.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-79-152-104.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT last-modified Thu, 14 Apr 2016 16:57:51 GMT server AkamaiNetStorage etag "7bc0ee636b3b83484fc3b9348863bd22:1460653071" content-type application/x-javascript cache-control max-age=600 accept-ranges bytes content-length 2 expires Mon, 10 May 2021 21:34:11 GMT
GET H3-29	200	/ www.google.de/pagead/1p-user-list/1040458670/ Redirect Chain https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0 https://www.google.com/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=2995817121 https://www.google.de/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=2995817121&ipr=y	42 B 64 B	29ms 28ms	Image image/gif	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=2995817121&ipr=y Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type image/gif location https://www.google.de/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=2995817121&ipr=y cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	3713 Show response sucuri.7eer.net/xur/	46 B 470 B	155ms 50ms	XHR application/json	35.186.240.205 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sucuri.7eer.net/xur/3713 Requested by Host: d.impactradius-event.com URL: https://d.impactradius-event.com/A166802-5dda-4f98-aad8-1f58dbc8f1771.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.186.240.205 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 205.240.186.35.bc.googleusercontent.com Software / Resource Hash a39e93d52fae5de509e8489cad2ebacc34f81774bc5e23cd969323e45dd5b581 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/x-www-form-urlencoded;charset=UTF-8 Response headers pragma no-cache date Mon, 10 May 2021 21:24:11 GMT via 1.1 google p3p policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT" access-control-allow-origin https://blog.sucuri.net cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 access-control-allow-credentials true content-type application/json; charset=UTF-8 alt-svc clear expires Mon, 10 May 2021 21:24:11 GMT
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1620681851221&url=https%3A%2F%2Fblog.sucuri.net%2F2019%2F04%2Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D179713%26time%3D1620681851221%26url%3Dhttps%253A%252F%252Fblog.sucuri.net%252F201... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1620681851221&url=https%3A%2F%2Fblog.sucuri.net%2F2019%2F04%2Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html&liSync=true https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1620681851221&url=https%3A%2F%2Fblog.sucuri.net%2F2019%2F04%2Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html&liSync=tru...	0 155 B	456ms 184ms	Image application/javascript	108.174.10.14 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1620681851221&url=https%3A%2F%2Fblog.sucuri.net%2F2019%2F04%2Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html&liSync=true&e_ipv6=AQJMGIwbX6fWbAAAAXlYKoXHGr0ZCkk5f_-fkdPGNZRlIMZ87ehcz3XO6B2TWTcfQHycurZn Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 108.174.10.14 , United States, ASN14413 (LINKEDIN, US), Reverse DNS 108-174-10-14.fwd.linkedin.com Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:12 GMT server Play linkedin-action 1 x-li-fabric prod-ltx1 x-li-proto http/2 x-li-pop prod-edc2 content-type application/javascript content-length 0 x-li-uuid oWxR8o7RfRYwsA3JmSsAAA== Redirect headers date Mon, 10 May 2021 21:24:12 GMT server Play linkedin-action 1 x-li-fabric prod-ltx1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1620681851221&url=https%3A%2F%2Fblog.sucuri.net%2F2019%2F04%2Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html&liSync=true&e_ipv6=AQJMGIwbX6fWbAAAAXlYKoXHGr0ZCkk5f_-fkdPGNZRlIMZ87ehcz3XO6B2TWTcfQHycurZn x-li-proto http/2 x-li-pop prod-esv5 content-length 0 x-li-uuid Xzp/1Y7RfRaQbGjN1yoAAA==
GET H3-29	200	309646199598471 Show response connect.facebook.net/signals/config/	254 KB 73 KB	84ms 84ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/309646199598471?v=2.9.39&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 8cd16467c1fe18bb38fe682ad84927bd4664b84e6ce0f098c5af3a54a735b2f6 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; content-encoding gzip x-content-type-options nosniff x-xss-protection 0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 x-fb-rlafr 0 pragma public x-fb-debug xTLiC3NhlZwOxXBVT2vyZ8ew5FzjXS4KnFtczeUPL+kEHI0XrVRUzC4r84HR/+vDdx/VG3mbEWw4rou64/4Uuw== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Mon, 10 May 2021 21:24:11 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	204	28110669 Show response bat.bing.com/p/action/	0 92 B	29ms 29ms	Script text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/28110669 Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / ARR/3.0 Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers access-control-allow-origin * date Mon, 10 May 2021 21:24:11 GMT cache-control private,max-age=86400 x-msedge-ref Ref A: AB600426CB734EDBBF2B221750183E60 Ref B: FRAEDGE1511 Ref C: 2021-05-10T21:24:11Z x-powered-by ARR/3.0 x-cache CONFIG_NOCACHE
GET H2	204	0 bat.bing.com/action/	0 93 B	31ms 30ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=28110669&Ver=2&mid=a2327735-b3cb-4142-a5dc-d6639937beeb&sid=0fe33c20b1d611eba2adff55e3001f87&vid=0fe4c180b1d611eb99c04f35d514b484&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Malware%20Campaigns%20Sharing%20Network%20Resources%3A%20r00ts.ninja&p=https%3A%2F%2Fblog.sucuri.net%2F2019%2F04%2Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html&r=&lt=1418&evt=pageLoad&msclkid=N&sv=1&rn=597228 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers access-control-allow-origin * pragma no-cache date Mon, 10 May 2021 21:24:11 GMT cache-control no-cache, must-revalidate x-msedge-ref Ref A: C10E03F38C6249519DA4BE8A90FF1A97 Ref B: FRAEDGE1511 Ref C: 2021-05-10T21:24:11Z x-cache CONFIG_NOCACHE expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-29	200	js Show response www.google-analytics.com/gtm/	205 KB 51 KB	27ms 27ms	Script application/javascript	2a00:1450:4001:828::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/js?id=GTM-TMKM2TQ&t=gtag_UA_4077922_18&cid=1902923596.1620681851 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash d5c547f45a76b1e9936c681b6ed351f98803fd4ba381697d48a2421cb3cea540 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 52294 x-xss-protection 0 expires Mon, 10 May 2021 21:24:11 GMT
POST H3-29	200	collect Show response www.google-analytics.com/j/	2 B 22 B	13ms 13ms	XHR text/plain	2a00:1450:4001:828::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1838192592&t=pageview&_s=1&dl=https%3A%2F%2Fblog.sucuri.net%2F2019%2F04%2Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html&ul=en-us&de=UTF-8&dt=Malware%20Campaigns%20Sharing%20Network%20Resources%3A%20r00ts.ninja&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=6GDACUADRAAAAC~&jid=1436966307&gjid=2062289408&cid=1902923596.1620681851&tid=UA-4077922-18&_gid=1959016528.1620681851&_r=1&gtm=2ou4s0&npa=1&z=217558521 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://blog.sucuri.net cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	adsct t.co/i/	43 B 456 B	243ms 156ms	Image image/gif	104.244.42.197 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=nuyl9&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fblog.sucuri.net%2F2019%2F04%2Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_devel / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT content-encoding gzip x-content-type-options nosniff status 200 OK x-twitter-response-tags BouncerCompliant content-length 65 x-xss-protection 0 pragma no-cache last-modified Mon, 10 May 2021 21:24:11 GMT server tsa_devel x-frame-options SAMEORIGIN strict-transport-security max-age=0 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash e16b7d2de4d3c8385a8820254ecde15125aec48757d2813fd25126ad797b0ad5 x-transaction 2eb5fccc750f80c5 expires Tue, 31 Mar 1981 05:00:00 GMT
POST H3-29	200	collect Show response stats.g.doubleclick.net/j/	4 B 25 B	28ms 13ms	XHR text/plain	2a00:1450:400c:c04::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-4077922-18&cid=1902923596.1620681851&jid=1436966307&gjid=2062289408&_gid=1959016528.1620681851&npa=1&_u=6GDACUADRAAAAC~&z=2134914975 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:400c:c04::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Mon, 10 May 2021 21:24:11 GMT content-type text/plain access-control-allow-origin https://blog.sucuri.net cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	modules.a7cb52be9b339377f5a3.js Show response script.hotjar.com/	220 KB 58 KB	137ms 50ms	Script application/javascript	13.32.25.19 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.a7cb52be9b339377f5a3.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-1177970.js?sv=6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.25.19 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-25-19.fra56.r.cloudfront.net Software / Resource Hash a131890941c3f6c4d8c82439a8aa28c97cfef692bd019b228f14373d788ee80c Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 14:57:08 GMT content-encoding br x-content-type-options nosniff age 23223 x-cache Hit from cloudfront content-length 59161 access-control-allow-origin * last-modified Mon, 10 May 2021 14:56:23 GMT etag "409ad317a25fe46b9ce380ffbe7d8756" vary Accept-Encoding content-type application/javascript via 1.1 34435958fa6d40b77fd22fa1c1f56176.cloudfront.net (CloudFront) cache-control max-age=31536000 x-amz-cf-pop FRA56-C2 accept-ranges bytes x-robots-tag none x-amz-cf-id eUAkSulRx_q1Ur6qaW1Jn-vaQ2IMcbIhXUEjcL3ZIpIQwjRKRwY2rw==
GET H2	200	/ www.facebook.com/tr/	44 B 407 B	18ms 6ms	Image image/gif	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=309646199598471&ev=PageView&dl=https%3A%2F%2Fblog.sucuri.net%2F2019%2F04%2Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html&rl=&if=false&ts=1620681851422&sw=1600&sh=1200&v=2.9.39&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1620681851419.777670380&it=1620681851235&coo=false&exp=l1&rqm=GET Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Mon, 10 May 2021 21:24:11 GMT
GET H3-29	200	ga-audiences www.google.com/ads/	42 B 63 B	17ms 17ms	Image image/gif	2a00:1450:4001:831::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-4077922-18&cid=1902923596.1620681851&jid=1436966307&npa=1&_u=6GDACUADRAAAAC~&z=231981585 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-29	200	ga-audiences www.google.de/ads/	42 B 63 B	18ms 18ms	Image image/gif	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-4077922-18&cid=1902923596.1620681851&jid=1436966307&npa=1&_u=6GDACUADRAAAAC~&z=231981585 Requested by Host: blog.sucuri.net URL: https://blog.sucuri.net/2019/04/malware-campaigns-sharing-network-resources-r00ts-ninja.html Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Mon, 10 May 2021 21:24:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	box-5e3cec51ed8e99df6977c199d27812d7.html Show response vars.hotjar.com/ Frame AFBD	1 KB 1 KB	138ms 44ms	Document text/html	65.9.97.123 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vars.hotjar.com/box-5e3cec51ed8e99df6977c199d27812d7.html Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-1177970.js?sv=6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.97.123 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 486762d56893f9b12fdfad41c3a76f11fc745b5436e97e596a63c22ee13d2e33 Request headers :method GET :authority vars.hotjar.com :scheme https :path /box-5e3cec51ed8e99df6977c199d27812d7.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://blog.sucuri.net/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://blog.sucuri.net/ Response headers content-type text/html content-length 684 date Tue, 30 Mar 2021 16:10:32 GMT accept-ranges bytes cache-control max-age=31536000 content-encoding br etag "4e332edbbc3b46800c87f197cc7d3bb6" last-modified Tue, 30 Mar 2021 14:48:51 GMT x-robots-tag none vary Accept-Encoding x-cache Hit from cloudfront via 1.1 1f7383179aa19c47a962c46236696426.cloudfront.net (CloudFront) x-amz-cf-pop PRG50-C1 x-amz-cf-id OtmUlahkBc9XCPRV9LT-DWukprSWkY6gQXh-cuvyvomGMRni92DtDg== age 3561219
GET H2	200	app.js Show response static.olark.com/jsclient/ Frame FA34	54 KB 18 KB	43ms 43ms	Script application/javascript	93.184.220.42 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://static.olark.com/jsclient/app.js Requested by Host: static.olark.com URL: https://static.olark.com/jsclient/loader0.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.184.220.42 London, United Kingdom, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6BAE) / Resource Hash a1a395234e15be575e363da6fed3464028632efa71a46e55edb6f4ac9f45d084 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT content-encoding gzip last-modified Thu, 15 Apr 2021 21:24:21 GMT server ECS (amb/6BAE) age 10525 etag W/"6078af05-d957" vary Accept-Encoding x-cache HIT content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=10800 accept-ranges bytes content-length 18467 via 1.1 google expires Tue, 11 May 2021 00:24:11 GMT
GET H2	200	5005-531-10-9691.js Show response static.olark.com/a/assets/v0/site/ Frame FA34	22 KB 22 KB	43ms 43ms	Script application/javascript	93.184.220.42 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://static.olark.com/a/assets/v0/site/5005-531-10-9691.js?cb=1620681851501 Requested by Host: static.olark.com URL: https://static.olark.com/jsclient/app.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.184.220.42 London, United Kingdom, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6BC0) / Resource Hash 78372c5a673bee728118067ecd1e3d5ed61af10a2494d8c3521fafa07166735f Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT via 1.1 google last-modified Mon, 10 May 2021 19:40:50 GMT server ECS (amb/6BC0) age 6201 x-cache HIT content-type application/javascript access-control-allow-origin * accept-ranges bytes content-length 22046
GET H2	200	498146.js Show response js.hs-banner.com/	60 KB 15 KB	51ms 32ms	Script text/javascript	2606:4700::6812:15bf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/498146.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/498146.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:15bf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5552c5c656fdd542ad1a5caf27c1ad9bc4e145e6bab236ab65406d074de8f01c Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT content-encoding br cf-cache-status HIT age 256 x-amz-server-side-encryption AES256 content-type text/javascript; charset=UTF-8 access-control-max-age 604800 x-amz-request-id CQ5H67W39PXCFHJ6 x-amz-id-2 01QjIkSOI5qxHJWJkCzq94PX7Ol1fY1asvXtR1pZBUAropxzfY4mIbAtOfDrijHTPdSKS0s7Sxc= timing-allow-origin * last-modified Tue, 04 May 2021 17:38:11 GMT server cloudflare etag W/"28e398d35b432eeef401f48f8e7e3b37" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD x-amz-version-id wFH0mWQcXfYjYrWndCl8f10TtiAEbQy8 access-control-allow-origin https://sitecheck.sucuri.net access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300, public access-control-allow-credentials true cf-request-id 09f9c39b2900002c4a8abd5000000001 cf-ray 64d63ba50d1f2c4a-FRA access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id expires Mon, 10 May 2021 21:24:55 GMT
GET H2	200	498146.js Show response js.hs-analytics.net/analytics/1620681600000/	62 KB 19 KB	41ms 22ms	Script text/javascript	2606:4700::6811:47b0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-analytics.net/analytics/1620681600000/498146.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/498146.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6811:47b0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b4d53b42d368c99b50c587c8803bbd750dd9d169954723219d8af819f17aa344 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:11 GMT content-encoding br cf-cache-status HIT age 68 x-amz-server-side-encryption AES256 x-amz-request-id K1VEJGFMGG44VJDG x-amz-id-2 uZ8Y97BAohb/jnAOfwfUqI9FM+9hu4Z1lShmDBPmB6p1hf7lgRnPbnvRb4SPUNSYjwAjF/a1e/g= last-modified Tue, 04 May 2021 15:10:27 GMT server cloudflare etag W/"843126c8b562ebe2c85f37de6688db82" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript cache-control max-age=300, public access-control-allow-credentials false x-amz-version-id null cf-request-id 09f9c39b2900004aa975b53000000001 cf-ray 64d63ba50e644aa9-FRA expires Mon, 10 May 2021 21:28:03 GMT
POST H3-29	200	/ www.facebook.com/tr/	0 15 B	13ms 6ms	Ping text/plain	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryqpGTsze4iSTolxZ9 Response headers strict-transport-security max-age=31536000; includeSubDomains server proxygen-bolt date Mon, 10 May 2021 21:24:11 GMT content-type text/plain access-control-allow-origin https://blog.sucuri.net access-control-allow-credentials true cross-origin-resource-policy cross-origin content-length 0 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 priority u=3,i
GET H3-29	200	mem6YaGs126MiZpBA-UFUK0Zdc0.woff2 fonts.gstatic.com/s/opensans/v18/	13 KB 13 KB	7ms 6ms	Font font/woff2	2a00:1450:4001:802::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v18/mem6YaGs126MiZpBA-UFUK0Zdc0.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600 Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash da407a15b1ea0c1b4bb774bd77bb608d6b1c90397b5a75b8895bbccfda5feb63 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://blog.sucuri.net Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 06 May 2021 15:44:02 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:09:37 GMT server sffe age 366010 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13780 x-xss-protection 0 expires Fri, 06 May 2022 15:44:02 GMT
GET H2	200	adsct Show response analytics.twitter.com/i/	31 B 659 B	254ms 159ms	Script application/javascript	104.244.42.195 TWITTER
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=nuyl9&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fblog.sucuri.net%2F2019%2F04%2Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.195 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_devel / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:13 GMT content-encoding gzip x-content-type-options nosniff p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200 OK x-twitter-response-tags BouncerCompliant content-length 57 x-xss-protection 0 pragma no-cache last-modified Mon, 10 May 2021 21:24:13 GMT server tsa_devel x-frame-options SAMEORIGIN strict-transport-security max-age=631138519 content-type application/javascript;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 11b6fd9e026701a959ac18db5ca5f4c0056725f8696470b65cf5968900ecfaae x-transaction a7c6c715780a4ae0 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	498146.js Show response js-na1.hs-scripts.com/	880 B 616 B	25ms 17ms	Script application/javascript	2606:4700::6811:d6cc CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-na1.hs-scripts.com/498146.js Requested by Host: js.hs-analytics.net URL: https://js.hs-analytics.net/analytics/1620681600000/498146.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6811:d6cc , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a33904a0fd1422dee0e60a83270498e03d1cd1daf3220da6a22e2d491521f556 Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:12 GMT content-encoding br vary Accept-Encoding cf-cache-status HIT age 26 cf-polished origSize=987 cf-request-id 09f9c3a02500004ac38e119000000001 x-hubspot-correlation-id cc023fc0-4fe0-473b-abf8-72cab6feeaa7 cf-bgj minify server cloudflare x-trace 2BD457FA457842C662AC8F4560E436C3B402D907DF000000000000000000 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3600 content-type application/javascript;charset=utf-8 access-control-allow-origin https://sitecheck.sucuri.net cache-control public, max-age=30 access-control-allow-credentials true cf-ray 64d63bad09714ac3-FRA
GET H2	200	__ptq.gif track.hubspot.com/	45 B 788 B	54ms 31ms	Image image/gif	2606:4700::6813:9b53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2736934676&v=1.1&a=498146&rcu=https%3A%2F%2Fblog.sucuri.net%2F2019%2F04%2Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html&pu=https%3A%2F%2Fblog.sucuri.net%2F2019%2F04%2Fmalware-campaigns-sharing-network-resources-r00ts-ninja.html&t=Malware+Campaigns+Sharing+Network+Resources%3A+r00ts.ninja&cts=1620681852957&vi=84e5e882caed22d7615fd125c48cca60&nc=true&ce=false Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://blog.sucuri.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 10 May 2021 21:24:13 GMT vary Accept-Encoding cf-cache-status DYNAMIC nel {"report_to":"cf-nel","max_age":604800} x-hubspot-correlation-id abee99dd-2cdf-407b-b938-200c2614f5cf cf-ray 64d63bad2bf84e20-FRA p3p CP="NOI CUR ADM OUR NOR STA NID" alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 45 cf-request-id 09f9c3a03600004e207d36e000000001 server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=PcuWH7vLwPkZrcXdb1G%2Ft8w1FFLfyZkI7V%2FAJD04D6%2B5bvZUkgvsZTTJMD6DuZQTLKMmM9GY6K4tE5FRauOfT6uYCHGFm7i9eqQq7C6zYv94Glh%2FTkNchbjFIZE2kw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control no-cache, no-store, no-transform access-control-allow-credentials false x-robots-tag none