cyble.com Open in urlscan Pro
192.0.78.152  Public Scan

43 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 82

• https://s.adroll.com/j/exp/ELNAF2EZDFHJRAP3ODLCUU/index.js HTTP 302
• https://s.adroll.com/j/exp/index.js

Request Chain 118

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1696656917302&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1696656917302&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4053396%26time%3D1696656917302%26url%3Dhttps%253A%252F%252Fcyble.com%252Fblog%252Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1696656917302&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1696656917302&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&cookiesTest=true&liSync=true&e_ipv6=AQIzcaW4RyfF6AAAAYsIogX38ITVkCwBqrolnUl0jrIScIzQsPhWxpESRUSA4AIJ

Request Chain 168

• https://c.clarity.ms/c.gif HTTP 302
• https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=6F746E70C2DD47198DE6BC08755EFE25&RedC=c.clarity.ms&MXFR=0B7A8543662261D214F196E062226FA8 HTTP 302
• https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=6F746E70C2DD47198DE6BC08755EFE25&MUID=066B6FFBECE0621A1F9F7C58ED6B6369

174 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/	429 KB 82 KB	1435ms 1378ms	Document text/html	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 05f6cb1ed8ca43cf1ec63612546abd070db6f7f8ea06aee8ec0e420ff7814d3c Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control max-age=300, must-revalidate cf-edge-cache cache,platform=wordpress content-encoding br content-type text/html; charset=UTF-8 date Sat, 07 Oct 2023 05:35:16 GMT host-header WordPress.com last-modified Sat, 07 Oct 2023 05:35:16 GMT link <https://cyble.com/wp-json/>; rel="https://api.w.org/" <https://cyble.com/wp-json/wp/v2/posts/22860>; rel="alternate"; type="application/json" <https://wp.me/pf01Lu-5WI>; rel=shortlink referrer-policy no-referrer-when-downgrade server nginx strict-transport-security max-age=31536000 vary Accept-Encoding Cookie x-ac 2.hhn _atomic_ams EXPIRED x-content-type-options nosniff x-frame-options SAMEORIGIN x-hacker Want root? Visit join.a8c.com and mention this header. x-nananana Batcache-Set x-xss-protection 1; mode=block
GET H2	200	frontend.min.css cyble.com/wp-content/themes/astra/assets/css/minified/	46 KB 9 KB	11ms 10ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/themes/astra/assets/css/minified/frontend.min.css?ver=4.3.1 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 044ef4f8ed43bfa59c9793d62975bc7ff747731bb1d97bbf0e1c0c6db95cca31 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Mon, 04 Sep 2023 18:11:24 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"64f61dcc-b8a0" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET BLOB	200 OK	44f6d935-4518-4d44-9854-fd005e23158c https://cyble.com/	1 KB 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://cyble.com/44f6d935-4518-4d44-9854-fd005e23158c Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Length 1245 Content-Type text/javascript
GET H2	200	css fonts-api.wp.com/	8 KB 882 B	69ms 29ms	Stylesheet text/css	192.0.77.32 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://fonts-api.wp.com/css?family=Poppins%3A400%2C700%2C500%7CRoboto%3A500%2C400&display=fallback&ver=4.3.1 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS wordpress.com Software nginx / Resource Hash a61adcba5535446226b967547c5a240a0c58588d868a17890e04c990b67c5f82 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff content-encoding gzip cross-origin-resource-policy cross-origin x-xss-protection 0 x-nc BYPASS hhn 1 last-modified Sat, 07 Oct 2023 05:35:16 GMT server nginx cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin
GET H2	200	style.css cyble.com/wp-content/plugins/gutenberg/build/block-library/	102 KB 14 KB	10ms 8ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/gutenberg/build/block-library/style.css?ver=16.6.0 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 16a16ece56b8c8c0d4b0a03b33fec826cef1b9431fa19e7e45ff9ce1c9e5f37e Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Wed, 06 Sep 2023 21:26:06 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"64f8ee6e-199b9" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	style.css cyble.com/wp-content/plugins/layout-grid/	58 KB 2 KB	10ms 9ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/layout-grid/style.css?ver=1643201242 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 4ff079893cbfe8eebd0d49b7c8bcbeba131173b3e0da0e13210ad611869e0e36 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Wed, 26 Jan 2022 12:47:22 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"61f142da-e64d" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	mediaelementplayer-legacy.min.css cyble.com/wp-includes/js/mediaelement/	11 KB 3 KB	11ms 9ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Tue, 29 Sep 2020 15:53:06 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"5f735862-2bf8" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	wp-mediaelement.min.css cyble.com/wp-includes/js/mediaelement/	4 KB 1 KB	13ms 10ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.3.1 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Fri, 07 Jun 2019 20:45:02 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"5cfaccce-105a" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	header-footer-elementor.css cyble.com/wp-content/plugins/header-footer-elementor/assets/css/	776 B 346 B	14ms 11ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/header-footer-elementor/assets/css/header-footer-elementor.css?ver=1.6.16 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 25825611ade7ceaed7df3862ec56dc91ad1d2be539966ef7bbe84306e51cfb08 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Mon, 11 Sep 2023 18:11:18 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"64ff5846-308" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	elementor-icons.min.css cyble.com/wp-content/plugins/elementor/assets/lib/eicons/css/	19 KB 4 KB	14ms 11ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=5.23.0 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 941b1493157dfb7316bcb3c7357a94e9ba173607d80559408620f4ab4c39c88d Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 14 Sep 2023 16:57:35 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"65033b7f-4c4d" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	frontend.min.css cyble.com/wp-content/plugins/elementor/assets/css/	166 KB 20 KB	14ms 11ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.16.4 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash e73a9bf5feab697897e1f66af3259e5418aacec3208a65607fbc614acb248bdc Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Wed, 20 Sep 2023 18:11:06 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"650b35ba-296e1" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	swiper.min.css cyble.com/wp-content/plugins/elementor/assets/lib/swiper/css/	13 KB 2 KB	14ms 12ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/elementor/assets/lib/swiper/css/swiper.min.css?ver=5.3.6 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash d622534d53d3ac1095af275f0b30274fcd835785577df2dde6d9398e6f7a2c8f Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 14 Sep 2023 16:57:35 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"65033b7f-324c" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	post-5708.css cyble.com/wp-content/uploads/elementor/css/	1 KB 443 B	14ms 12ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/uploads/elementor/css/post-5708.css?ver=1696478702 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 643e25e0578e3d2e745757c65b11d043c665e044f327cd189d45a651a9eb7702 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 05 Oct 2023 04:05:02 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"651e35ee-49c" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	frontend.min.css cyble.com/wp-content/plugins/elementor-pro/assets/css/	441 KB 44 KB	15ms 12ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=3.16.2 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash c961c7b4e1209a5c2e42bd847772dc0ffea208ce937cfcf05ba4b15d33888b87 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 21 Sep 2023 06:11:06 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"650bde7a-6e4ad" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	uael-frontend.min.css cyble.com/wp-content/plugins/ultimate-elementor/assets/min-css/	617 KB 68 KB	28ms 26ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/ultimate-elementor/assets/min-css/uael-frontend.min.css?ver=1.36.22 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f6a3810b8143fe8a4322a7887bca2c3adf7e2854a1d8863b58d3d4ca814db1ef Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 28 Sep 2023 18:11:57 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"6515c1ed-9a267" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	post-9211.css cyble.com/wp-content/uploads/elementor/css/	18 KB 2 KB	28ms 26ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/uploads/elementor/css/post-9211.css?ver=1696478703 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 71fe46ddacbba5688018b343cfd2555fd139d5353f41fc33bd000073a59af200 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 05 Oct 2023 04:05:03 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"651e35ef-460d" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	frontend.css cyble.com/wp-content/plugins/header-footer-elementor/inc/widgets-css/	74 KB 8 KB	29ms 27ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/header-footer-elementor/inc/widgets-css/frontend.css?ver=1.6.16 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash ea14d1b1233e6cbc9b1a156ac532f076f7adafc309726fca7bf8833f882ac872 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Mon, 11 Sep 2023 18:11:18 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"64ff5846-127a4" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	astra-addon-65131ec305b8b1-64975292.css cyble.com/wp-content/uploads/astra-addon/	49 KB 7 KB	29ms 27ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/uploads/astra-addon/astra-addon-65131ec305b8b1-64975292.css?ver=4.3.3 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 8842cc86ae90bbf7389742fdc461dadcc97fb0b6f7591bf00e2efb8be83fdba3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Tue, 26 Sep 2023 18:11:15 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"65131ec3-c530" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	front.min.css cyble.com/wp-content/plugins/cookie-notice/css/	5 KB 1 KB	28ms 27ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/cookie-notice/css/front.min.css?ver=2.4.11 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f158b8591a08b6c02bb345ae96dd62f0c632f7f635bb4a5f449fce24bdc11789 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Wed, 04 Oct 2023 18:11:14 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"651daac2-14d6" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	css fonts-api.wp.com/	76 KB 3 KB	65ms 28ms	Stylesheet text/css	192.0.77.32 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://fonts-api.wp.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.3.1 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS wordpress.com Software nginx / Resource Hash c440cd94ef26c768cd61bc78fc65a13903debe9b36f4bf704359183bb437d103 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff content-encoding gzip cross-origin-resource-policy cross-origin x-xss-protection 0 x-nc BYPASS hhn 1 last-modified Sat, 07 Oct 2023 05:31:41 GMT server nginx cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin
GET H2	200	fontawesome.min.css cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/	57 KB 12 KB	28ms 27ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?ver=5.15.3 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash d01a2ba2805c78957e15a2958135de0f3cb88e95159dd0f6c0a032bd76b1b0e9 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 14 Sep 2023 16:57:35 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"65033b7f-e238" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	brands.min.css cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/	675 B 347 B	28ms 27ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver=5.15.3 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 9cd63b8cea25045c14623c538d26752518a58c0c682795ce6ad3078976c65a37 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 14 Sep 2023 16:57:35 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"65033b7f-2a3" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	jetpack.css cyble.com/wp-content/plugins/jetpack/css/	98 KB 18 KB	28ms 28ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/jetpack/css/jetpack.css?ver=12.7-a.7 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 7a67b20e98fc01c0f5e287c31424661c463fabfd9131f4352b198985f60458b7 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Tue, 03 Oct 2023 21:01:18 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"651c811e-188c6" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	related-posts.min.js Show response cyble.com/wp-content/plugins/jetpack/_inc/build/related-posts/	6 KB 2 KB	26ms 25ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/jetpack/_inc/build/related-posts/related-posts.min.js?ver=20211209 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash a68827190bc01a61ee0a62ec59efa74497a6bc5aa8586f1fac50a58d0cf42d88 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Mon, 19 Jun 2023 19:16:28 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"6490a98c-1661" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	jquery.min.js Show response cyble.com/wp-includes/js/jquery/	85 KB 31 KB	26ms 25ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.0 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 5c93f77799d122fb5255ee24da285f9f228cc118cba11e6ceb2b6bda8cdf4164 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Fri, 26 May 2023 11:33:35 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"6470990f-155ba" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	jquery-migrate.min.js Show response cyble.com/wp-includes/js/jquery/	13 KB 5 KB	26ms 26ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Fri, 09 Jun 2023 05:49:24 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"6482bd64-3509" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	front.min.js Show response cyble.com/wp-content/plugins/cookie-notice/js/	8 KB 2 KB	24ms 17ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/cookie-notice/js/front.min.js?ver=2.4.11 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 08756c47213d461baa3b01f42448a76d11f524470c7a34f9018733889bd4f49c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Wed, 04 Oct 2023 18:11:14 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"651daac2-21fc" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	322 KB 105 KB	58ms 24ms	Script application/javascript	2a00:1450:4001:806::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=GT-WKTZW36 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash ce39f913e69837839f61c9a08b29210250dd4298d38f6c3bf9d96de5081ef379 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 107237 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Sat, 07 Oct 2023 05:35:16 GMT
GET H2	200	Cyble-Logo-150x42-1.webp cyble.com/wp-content/uploads/2023/07/	3 KB 3 KB	24ms 18ms	Image image/webp	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://cyble.com/wp-content/uploads/2023/07/Cyble-Logo-150x42-1.webp Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 594e58a370b6219afb761152e616c06147e70e8c8d040ef51058f238025633a1 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-ac 2.hhn _atomic_ams HIT last-modified Wed, 26 Jul 2023 09:51:45 GMT server nginx etag "64c0ecb1-c16" access-control-allow-methods GET, HEAD content-type image/webp access-control-allow-origin * cache-control max-age=604800 accept-ranges bytes content-length 3094 expires Thu, 21 Sep 2023 18:18:57 GMT
GET H2	200	visioncyble.png cyble.com/wp-content/uploads/2023/08/	6 KB 7 KB	24ms 18ms	Image image/png	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://cyble.com/wp-content/uploads/2023/08/visioncyble.png Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash b674ae72e31570fbfba5dd723788233676575b3d5ae6ca6f08846f1af6cd951c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-ac 2.hhn _atomic_ams HIT last-modified Thu, 31 Aug 2023 04:03:56 GMT server nginx etag "64f0112c-19b2" access-control-allow-methods GET, HEAD content-type image/png access-control-allow-origin * cache-control max-age=604800 accept-ranges bytes content-length 6578 expires Thu, 21 Sep 2023 18:18:57 GMT
GET H2	200	hawkbycyble.png cyble.com/wp-content/uploads/2023/08/	4 KB 4 KB	24ms 18ms	Image image/png	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://cyble.com/wp-content/uploads/2023/08/hawkbycyble.png Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 50609579a0013a9543bdf2f3b69b484dafea8e313a2ce1a65f5ae93a930991d6 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-ac 2.hhn _atomic_ams HIT last-modified Thu, 31 Aug 2023 06:39:32 GMT server nginx etag "64f035a4-e06" access-control-allow-methods GET, HEAD content-type image/png access-control-allow-origin * cache-control max-age=604800 accept-ranges bytes content-length 3590 expires Thu, 21 Sep 2023 18:18:57 GMT
GET H2	200	Ami-Breached.png cyble.com/wp-content/uploads/2023/08/	5 KB 5 KB	24ms 18ms	Image image/png	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://cyble.com/wp-content/uploads/2023/08/Ami-Breached.png Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 39badaa7254daebaccbfc900a8ab3e619aaa048a7306b182ecf19655fdaf3976 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-ac 2.hhn _atomic_ams HIT last-modified Mon, 04 Sep 2023 07:06:50 GMT server nginx etag "64f5820a-1282" access-control-allow-methods GET, HEAD content-type image/png access-control-allow-origin * cache-control max-age=604800 accept-ranges bytes content-length 4738 expires Thu, 21 Sep 2023 18:18:57 GMT
GET H2	200	cybleodin.png cyble.com/wp-content/uploads/2023/08/	7 KB 7 KB	24ms 19ms	Image image/png	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://cyble.com/wp-content/uploads/2023/08/cybleodin.png Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 02691c38db1b70e6897e594025a6080e91d8ff8e6af11d3c76d922af318cdc69 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-ac 2.hhn _atomic_ams HIT last-modified Mon, 04 Sep 2023 07:06:50 GMT server nginx etag "64f5820a-1a66" access-control-allow-methods GET, HEAD content-type image/png access-control-allow-origin * cache-control max-age=604800 accept-ranges bytes content-length 6758 expires Thu, 21 Sep 2023 18:18:57 GMT
GET H2	200	tce-logo.png cyble.com/wp-content/uploads/2023/08/	10 KB 10 KB	24ms 19ms	Image image/png	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://cyble.com/wp-content/uploads/2023/08/tce-logo.png Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f650518059b9901bbf0175fde4089bda6ac93efef083514d37c3245a7f50abdf Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-ac 2.hhn _atomic_ams HIT last-modified Thu, 31 Aug 2023 06:41:34 GMT server nginx etag "64f0361e-271a" access-control-allow-methods GET, HEAD content-type image/png access-control-allow-origin * cache-control max-age=604800 accept-ranges bytes content-length 10010 expires Thu, 21 Sep 2023 18:18:57 GMT
GET H2	200	63e0e74f21fa4757c3a4f79f_products.png uploads-ssl.webflow.com/63dd0ddca5abb1b5aff27e38/	277 KB 278 KB	66ms 15ms	Image image/png	18.66.112.117 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://uploads-ssl.webflow.com/63dd0ddca5abb1b5aff27e38/63e0e74f21fa4757c3a4f79f_products.png Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.117 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-117.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash e5c524e3e761e7f83d82d0713c43a707f52e9d2bac9d3705a09857714e094fac Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 31 Aug 2023 07:12:54 GMT x-amz-version-id 8j9.sXtilP1QVSLFuZIMlcthaYrBO2bI via 1.1 0a624670dff351af866d2f19bde4a312.cloudfront.net (CloudFront) age 3190943 x-amz-cf-pop FRA56-P5 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 283614 last-modified Mon, 06 Feb 2023 11:41:05 GMT server AmazonS3 etag "c9ae576c481235e660203b28916cb3fc" content-type image/png access-control-allow-origin * cache-control max-age=31536000, must-revalidate accept-ranges bytes x-amz-cf-id apEDYJg7S0xw1ERo-VkkmtvwzvLrvdBR_xFZQrfTiQr7Y-ScwZ1u9A==
GET H2	200	Cyble-blogs-WinRAR-1024x512.png cyble.com/wp-content/uploads/2023/10/	259 KB 259 KB	24ms 19ms	Image image/webp	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://cyble.com/wp-content/uploads/2023/10/Cyble-blogs-WinRAR-1024x512.png Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash e6260d7816778c0b2c05b66cbcb569bb9b5bca50c9fd8f6fa8974764e7c971c5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff x-ac 2.hhn _atomic_ams HIT content-length 265086 x-nc HIT dca 1 last-modified Fri, 06 Oct 2023 12:51:44 GMT server nginx etag "8d1b2ba052692e95" vary Accept access-control-allow-methods GET, HEAD content-type image/webp access-control-allow-origin * cache-control public, max-age=63115200 timing-allow-origin * expires Mon, 06 Oct 2025 00:51:44 GMT
GET H2	200	Figure-1-Overall-Infection-Chain-1024x397.jpg cyble.com/wp-content/uploads/2023/10/	23 KB 23 KB	24ms 19ms	Image image/webp	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://cyble.com/wp-content/uploads/2023/10/Figure-1-Overall-Infection-Chain-1024x397.jpg Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash cf1eb5e1a45d5ecfcc9744974d6065361fe14f93c4b2947fdec99b9cec8746ac Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff x-ac 2.hhn _atomic_ams HIT content-length 23744 x-nc HIT dca 3 last-modified Fri, 06 Oct 2023 12:30:58 GMT server nginx etag "6d3beb61fe5199fb" vary Accept access-control-allow-methods GET, HEAD content-type image/webp access-control-allow-origin * cache-control public, max-age=63115200 timing-allow-origin * expires Mon, 06 Oct 2025 00:30:58 GMT
GET H2	200	subscribe-to-CRIL.jpg i0.wp.com/blog.cyble.com//srv/htdocs/wp-content/uploads/2021/11/	16 KB 16 KB	50ms 16ms	Image image/webp	192.0.77.2 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://i0.wp.com/blog.cyble.com//srv/htdocs/wp-content/uploads/2021/11/subscribe-to-CRIL.jpg Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS i1.wp.com Software nginx / Resource Hash 382e9768b5578d5ad05e51e37670a3cf93d4593a49bcbee1f5e8b66d0d8c1c53 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers x-nc HIT hhn 1 date Sat, 07 Oct 2023 05:35:16 GMT x-content-type-options nosniff last-modified Wed, 26 Jul 2023 23:15:01 GMT server nginx etag "27ade7d444618f64" vary Accept access-control-allow-methods GET, HEAD content-type image/webp access-control-allow-origin * cache-control public, max-age=63115200 timing-allow-origin * link <http://blog.cyble.com//srv/htdocs/wp-content/uploads/2021/11/subscribe-to-CRIL.jpg>; rel="canonical" content-length 16232 expires Sat, 26 Jul 2025 11:15:01 GMT
GET H2	200	v2.js Show response js.hsforms.net/forms/	549 KB 175 KB	62ms 23ms	Script application/javascript	2606:4700::6810:88ce CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hsforms.net/forms/v2.js Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:88ce , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a24e66d830ef814bbcc4553b662e0c2afe733f8f30fb4a86be6df577d146bec2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-encoding br age 478 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3812/bundles/project-v2.js&cfRay=8123bbf34b3c3a5e-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"84d6c03b19ba72ee08ca8c27dee147c2" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset forms-embed/static-1.3812/bundles/project-v2.js date Sat, 07 Oct 2023 05:35:16 GMT x-amz-version-id 4b09e6_AhU37WJHx62r2StyRWH0KMlOF via 1.1 3d4bfc42e9575ee1f9559241c9e3f464.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop IAD12-P3 x-hubspot-correlation-id 6b062665-6ec9-4582-9879-cf683abbf363 x-cache Hit from cloudfront cache-tag staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod x-envoy-upstream-service-time 2 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-request-id 6b062665-6ec9-4582-9879-cf683abbf363 last-modified Fri, 22 Sep 2023 08:13:06 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f237sXKRLY9n0MCZiPWled%2Fo9p6BvP7kYpct7i%2FZ40oEE9NDKGjdH%2F1WVw%2B0NNOl9fxvBO31nk6wp8zGiEX57GdwzSqHXwYoo7iKEilJz3u7hquZwG8HCwY%2BKhOCkCu1dkrjtU%2FMgHI1G604"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-7c89bb96b9-hjsqm cf-ray 8123c7a12ea31999-FRA x-amz-cf-id q8dUdqKCa4KY-gdQV9r8qW-CFIygnwMwlN2dnj7Aq2bnpniioZBxXg==
GET H2	200	bilmur.min.js Show response s0.wp.com/wp-content/js/	7 KB 3 KB	25ms 11ms	Script application/javascript	192.0.77.32 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://s0.wp.com/wp-content/js/bilmur.min.js?m=202340 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS wordpress.com Software nginx / Resource Hash e0f724e7902c0b2186d8395984c312696dc8be9ae0c187792f032fb0955fcf9a Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers x-nc HIT hhn 1 date Sat, 07 Oct 2023 05:35:16 GMT content-encoding br x-ac 2.hhn _dca MISS last-modified Fri, 22 Sep 2023 22:33:41 GMT server nginx etag W/"650e1645-1bf2" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 timing-allow-origin * expires Tue, 01 Oct 2024 00:00:02 GMT
GET H2	200	magamenu-frontend.min.css cyble.com/wp-content/plugins/astra-addon/addons/nav-menu/assets/css/minified/	0 67 B	8ms 8ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/astra-addon/addons/nav-menu/assets/css/minified/magamenu-frontend.min.css?ver=4.3.3 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-ac 2.hhn _atomic_ams HIT last-modified Tue, 26 Sep 2023 18:11:08 GMT server nginx etag "65131ebc-0" access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 accept-ranges bytes content-length 0 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	rs6.css cyble.com/wp-content/plugins/revslider/public/assets/css/	58 KB 13 KB	16ms 6ms	Stylesheet text/css	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.6.15 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 4e0444e1833b39198b3f37d6f556b0443dabff58bcd8e8b16530b0f980ea2b1b Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Tue, 01 Aug 2023 18:57:53 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"64c955b1-e96a" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	frontend.min.js Show response cyble.com/wp-content/themes/astra/assets/js/minified/	20 KB 5 KB	16ms 7ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=4.3.1 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 4949400420298d43ab430c5caf706e848af8fff7db19c0031542b02e71c26b89 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Mon, 04 Sep 2023 18:11:24 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"64f61dcc-509e" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	21289959.js Show response js.hs-scripts.com/	2 KB 1 KB	153ms 120ms	Script application/javascript	2606:4700::6810:bb59 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.2.5 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:bb59 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b3dd790b9f3a8ef959922031438195387911cb88a8b592c75d182e0dc333566b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT content-encoding br x-content-type-options nosniff cf-cache-status EXPIRED x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id e2055659-9559-42a1-a0e4-a7e5e27037c6 x-envoy-upstream-service-time 5 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id e2055659-9559-42a1-a0e4-a7e5e27037c6 last-modified Sat, 07 Oct 2023 04:09:08 GMT server cloudflare x-trace 2B271529A5A6A1E81E2418508695FDB2E7008E3F9B000000000000000000 vary origin, Accept-Encoding access-control-max-age 3600 content-type application/javascript;charset=utf-8 access-control-allow-origin https://cyble.com x-evy-trace-virtual-host all cache-control public, max-age=60 access-control-allow-credentials true x-evy-trace-served-by-pod iad02/hubapi-td/envoy-proxy-5b5c96c966-fjg5s cf-ray 8123c7a15d8a9207-FRA expires Sat, 07 Oct 2023 05:36:16 GMT
GET H2	200	rbtools.min.js Show response cyble.com/wp-content/plugins/revslider/public/assets/js/	162 KB 62 KB	24ms 19ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/revslider/public/assets/js/rbtools.min.js?ver=6.6.15 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 52984e532d02a87a060764ff400626a1b81cc316284a8ba1feab5d94697119a0 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Tue, 01 Aug 2023 18:57:53 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"64c955b1-28681" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	rs6.min.js Show response cyble.com/wp-content/plugins/revslider/public/assets/js/	406 KB 106 KB	24ms 20ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/revslider/public/assets/js/rs6.min.js?ver=6.6.15 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash d83aec48544d062dde1996c25831b736a6262a98fc15a037ee5c72b1f9f0aeb2 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Tue, 01 Aug 2023 18:57:53 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"64c955b1-659a8" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	astra-addon-65131ec3112423-18383972.js Show response cyble.com/wp-content/uploads/astra-addon/	37 KB 7 KB	17ms 7ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/uploads/astra-addon/astra-addon-65131ec3112423-18383972.js?ver=4.3.3 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash a088ce338dd2db9cbe80967afca1c0add423674ec3dee267f538b4e3ea05799c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Tue, 26 Sep 2023 18:11:15 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"65131ec3-924f" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	e-202340.js Show response stats.wp.com/	7 KB 3 KB	50ms 15ms	Script application/javascript	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://stats.wp.com/e-202340.js Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers x-minify-cache hit x-nc HIT hhn date Sat, 07 Oct 2023 05:35:16 GMT content-encoding br server nginx x-minify t etag W/13576-1684460848292.3706 vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 expires Mon, 30 Sep 2024 06:30:14 GMT
GET H2	200	jetpack-carousel.min.js Show response cyble.com/wp-content/plugins/jetpack/_inc/build/carousel/	24 KB 7 KB	17ms 7ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/jetpack/_inc/build/carousel/jetpack-carousel.min.js?ver=12.7-a.7 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 0200bc38d986631f9cc4680084d7d263ccf17fa4a3c627b26ff347e0cfcf1d47 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Tue, 30 May 2023 17:03:32 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"64762c64-5e2d" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	helper.min.js Show response cyble.com/wp-content/plugins/optinmonster/assets/dist/js/	3 KB 1 KB	17ms 8ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/optinmonster/assets/dist/js/helper.min.js?ver=2.14.0 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash ab2893642fc3a295af460bb6c27d6c0c425becfef2e1a90ebf25507a04b2fda7 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 28 Sep 2023 18:11:15 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"6515c1c3-bb9" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	uael-nav-menu.min.js Show response cyble.com/wp-content/plugins/ultimate-elementor/assets/min-js/	20 KB 3 KB	19ms 9ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/ultimate-elementor/assets/min-js/uael-nav-menu.min.js?ver=1.36.22 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 53c709abec93270bef6fa3c5c4290d4ce120582152fe692e6be582f544a89ae8 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 28 Sep 2023 18:11:18 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"6515c1c6-500a" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	jquery_resize.min.js Show response cyble.com/wp-content/plugins/ultimate-elementor/assets/lib/jquery-element-resize/	3 KB 1 KB	19ms 9ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/ultimate-elementor/assets/lib/jquery-element-resize/jquery_resize.min.js?ver=1.36.22 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 54c8ea0d64c3d52573359befbd4e5fab7ff3d18abedf40759fba7d500832177a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 28 Sep 2023 18:11:18 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"6515c1c6-d5e" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	js_cookie.min.js Show response cyble.com/wp-content/plugins/ultimate-elementor/assets/lib/js-cookie/	2 KB 1 KB	19ms 10ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/ultimate-elementor/assets/lib/js-cookie/js_cookie.min.js?ver=1.36.22 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 945f333ee61c0da7432df2210a10e3670b38ac2949abe8599a969c00c5db8965 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 28 Sep 2023 18:11:18 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"6515c1c6-7a4" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	webpack-pro.runtime.min.js Show response cyble.com/wp-content/plugins/elementor-pro/assets/js/	6 KB 2 KB	19ms 10ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.16.2 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 4030d0913b43f85cc5f54944e834ba01e0111b642e9e6c1978cefbda687e7dcf Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 21 Sep 2023 06:11:06 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"650bde7a-166c" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	webpack.runtime.min.js Show response cyble.com/wp-content/plugins/elementor/assets/js/	5 KB 2 KB	19ms 10ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.16.4 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash ff7dc3fe6d7b901d715ef747c92d3ad3727883dad6e3ac0e6fbc2eab73991b58 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Wed, 20 Sep 2023 18:11:06 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"650b35ba-1385" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	frontend-modules.min.js Show response cyble.com/wp-content/plugins/elementor/assets/js/	57 KB 17 KB	19ms 10ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.16.4 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 54bf58f6b534a750c255cd1d3f0d394e64c614c7df443ef5308722b20ae0c778 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Wed, 20 Sep 2023 18:11:06 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"650b35ba-e5ec" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	wp-polyfill-inert.min.js Show response cyble.com/wp-includes/js/dist/vendor/	8 KB 3 KB	18ms 11ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Wed, 18 Jan 2023 11:16:33 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"63c7d511-1feb" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	regenerator-runtime.min.js Show response cyble.com/wp-includes/js/dist/vendor/	6 KB 3 KB	18ms 11ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.11 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 6974bfd8fa06b7831f05cb4b25860c851a5ad3f02a6699ebe688987dd7a6ebe6 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Tue, 07 Feb 2023 15:56:37 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"63e274b5-19cf" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	inert-polyfill.min.js Show response cyble.com/wp-content/plugins/gutenberg/build/vendors/	8 KB 3 KB	18ms 11ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/gutenberg/build/vendors/inert-polyfill.min.js?ver=6.3.1 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash af8a8cd98214ed3d7760402ffa8b8804b073b4bf95d887ed7e81a50f826b523b Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Wed, 26 Oct 2022 11:46:48 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"63591e28-1fe9" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	wp-polyfill.min.js Show response cyble.com/wp-includes/js/dist/vendor/	16 KB 6 KB	18ms 11ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 4c0ced2cb3830d045cdd74f745fd4d6dcb082d8edd3a9fe46e39295e30cb8032 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Tue, 27 Jun 2023 14:24:19 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"649af113-3f12" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	index.min.js Show response cyble.com/wp-content/plugins/gutenberg/build/hooks/	4 KB 2 KB	18ms 11ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/gutenberg/build/hooks/index.min.js?ver=3aee234ea7807d8d70bc Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 24004b1763b0275d5a1d9f66f08616a54b95aeec1f0034766bbb479679a82fc3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Wed, 14 Jun 2023 12:06:14 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"6489ad36-10a6" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	index.min.js Show response cyble.com/wp-content/plugins/gutenberg/build/i18n/	9 KB 4 KB	19ms 12ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/gutenberg/build/i18n/index.min.js?ver=5baa98e4345eccc97e24 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash d743ad07240fdc75d2e2a357b4ff44b334f6d4c53683e31e824aaf61d3bad0c9 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Wed, 14 Jun 2023 12:06:14 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"6489ad36-227d" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	frontend.min.js Show response cyble.com/wp-content/plugins/elementor-pro/assets/js/	24 KB 7 KB	19ms 12ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.16.2 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 0fee2c84f4e4a94f2b2e99a7f73d82203d1c72e7290f9738d897d1418a6a2545 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 21 Sep 2023 06:11:06 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"650bde7a-6062" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	waypoints.min.js Show response cyble.com/wp-content/plugins/elementor/assets/lib/waypoints/	12 KB 3 KB	19ms 12ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 214674cc77aba35ab3567b88e2739fd08e8e96c61d279559ad61874069683ea0 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 14 Sep 2023 16:57:35 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"65033b7f-2fa6" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	core.min.js Show response cyble.com/wp-includes/js/jquery/ui/	21 KB 7 KB	19ms 12ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.2 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash ca7dce2391845e8aec7da135f33fabd10f74eed28a532ac66fd01f761fcfb42f Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 02 Feb 2023 16:36:32 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"63dbe690-53be" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	frontend.min.js Show response cyble.com/wp-content/plugins/elementor/assets/js/	39 KB 13 KB	23ms 17ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.16.4 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash c6fe813db64c5ccae7d4c89067546910910b2316862218ce553a19cf23dae7e7 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Wed, 20 Sep 2023 18:11:06 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"650b35ba-9df4" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	elements-handlers.min.js Show response cyble.com/wp-content/plugins/elementor-pro/assets/js/	35 KB 9 KB	24ms 17ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.16.2 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 499508bc917f97fb2d5355f304d796948866d1a1d72e0977e0bb06d16fd43fc1 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 21 Sep 2023 06:11:06 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"650bde7a-8a69" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	roundtrip.js Show response s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/	99 KB 29 KB	72ms 12ms	Script text/javascript	2600:9000:225e:f600:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/roundtrip.js Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225e:f600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 22d5de83e3e7e14a9bda527244747422138f3ccb9510600aa85631ca2625f2f5 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers X-Amz-Version-Id L3TTqDyr6DijrLwwu6cAH.1YpW6ESsnK Content-Encoding gzip Via 1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront) Date Sat, 07 Oct 2023 05:35:16 GMT Age 935 X-Amz-Cf-Pop FRA60-P4 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Last-Modified Fri, 06 Oct 2023 12:24:52 GMT Server AmazonS3 Etag W/"6be8849d59031df8b9807d51efd36219" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type text/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Access-Control-Max-Age 600 Access-Control-Allow-Headers * X-Amz-Cf-Id yRQPYjuXfhS3HmQqf60KzLo5ARilnbYrKtGqYkupqV7l-3IUfl085g==
GET H2	200	gtm.js Show response www.googletagmanager.com/	234 KB 83 KB	66ms 33ms	Script application/javascript	2a00:1450:4001:806::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PMWT557 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 72f2cc5a3113a5fd9b4d7e059903bfe52bb431c1246dfdff4afe683ca2125f0b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 85334 x-xss-protection 0 last-modified Sat, 07 Oct 2023 03:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Sat, 07 Oct 2023 05:35:16 GMT
GET H2	200	pxiEyp8kv8JHgFVrJJfecg.woff2 fonts.wp.com/s/poppins/v20/	8 KB 8 KB	61ms 11ms	Font font/woff2	192.0.77.32 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://fonts.wp.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2 Requested by Host: fonts-api.wp.com URL: https://fonts-api.wp.com/css?family=Poppins%3A400%2C700%2C500%7CRoboto%3A500%2C400&display=fallback&ver=4.3.1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS wordpress.com Software nginx / Resource Hash 7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts-api.wp.com/ Origin https://cyble.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers x-nc HIT hhn 1 date Sat, 07 Oct 2023 05:35:16 GMT x-content-type-options nosniff last-modified Wed, 27 Apr 2022 17:03:52 GMT server nginx age 440753 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * content-length 7884 x-xss-protection 0
GET H2	200	api.min.js Show response a.omappapi.com/app/js/	51 KB 18 KB	54ms 8ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/api.min.js Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash 97f42f589e8dc951e4e08d648f931eb0bd8d91bef1f595eb6126d0b82bcaf9fd Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT content-encoding br cdn-edgestorageid 1080 perma-cache HIT cdn-storageserver DE-663 cdn-cachedat 10/06/2023 17:45:32 cdn-pullzone 293267 last-modified Mon, 25 Sep 2023 16:44:37 GMT server BunnyCDN-DE1-1080 cdn-fileserver 599 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"6511b8f5-cb6f" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 239c041c5f8c9601fa29ada096a72cfc cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2 fonts.wp.com/s/poppins/v20/	8 KB 8 KB	13ms 13ms	Font font/woff2	192.0.77.32 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://fonts.wp.com/s/poppins/v20/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2 Requested by Host: fonts-api.wp.com URL: https://fonts-api.wp.com/css?family=Poppins%3A400%2C700%2C500%7CRoboto%3A500%2C400&display=fallback&ver=4.3.1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS wordpress.com Software nginx / Resource Hash 9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts-api.wp.com/ Origin https://cyble.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers x-nc HIT hhn 1 date Sat, 07 Oct 2023 05:35:16 GMT x-content-type-options nosniff last-modified Wed, 27 Apr 2022 16:11:40 GMT server nginx age 440761 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * content-length 7816 x-xss-protection 0
GET H2	200	astra.woff cyble.com/wp-content/themes/astra/assets/fonts/	3 KB 3 KB	13ms 11ms	Font application/font-woff	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/themes/astra/assets/fonts/astra.woff Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash ec7ef7aa5fd1e019f1c26193e95e46d481d4983673936a9dda086705ada6e3d5 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Origin https://cyble.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-ac 2.hhn _atomic_ams HIT last-modified Mon, 04 Sep 2023 18:11:24 GMT server nginx etag "64f61dcc-ce8" access-control-allow-methods GET, HEAD content-type application/font-woff access-control-allow-origin * cache-control max-age=604800 accept-ranges bytes content-length 3304 expires Thu, 21 Sep 2023 18:20:57 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4.woff2 fonts.wp.com/s/roboto/v30/	15 KB 16 KB	13ms 11ms	Font font/woff2	192.0.77.32 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://fonts.wp.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 Requested by Host: fonts-api.wp.com URL: https://fonts-api.wp.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.3.1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS wordpress.com Software nginx / Resource Hash f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts-api.wp.com/ Origin https://cyble.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers x-nc HIT hhn 1 date Sat, 07 Oct 2023 05:35:16 GMT x-content-type-options nosniff last-modified Wed, 11 May 2022 19:24:42 GMT server nginx age 319280 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * content-length 15860 x-xss-protection 0
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.wp.com/s/roboto/v30/	15 KB 15 KB	14ms 12ms	Font font/woff2	192.0.77.32 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://fonts.wp.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts-api.wp.com URL: https://fonts-api.wp.com/css?family=Poppins%3A400%2C700%2C500%7CRoboto%3A500%2C400&display=fallback&ver=4.3.1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS wordpress.com Software nginx / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts-api.wp.com/ Origin https://cyble.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers x-nc HIT hhn 1 date Sat, 07 Oct 2023 05:35:16 GMT x-content-type-options nosniff last-modified Wed, 11 May 2022 19:24:48 GMT server nginx age 290156 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * content-length 15744 x-xss-protection 0
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.wp.com/s/roboto/v30/	16 KB 16 KB	14ms 12ms	Font font/woff2	192.0.77.32 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://fonts.wp.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: fonts-api.wp.com URL: https://fonts-api.wp.com/css?family=Poppins%3A400%2C700%2C500%7CRoboto%3A500%2C400&display=fallback&ver=4.3.1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS wordpress.com Software nginx / Resource Hash b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts-api.wp.com/ Origin https://cyble.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers x-nc HIT hhn 1 date Sat, 07 Oct 2023 05:35:16 GMT x-content-type-options nosniff last-modified Wed, 11 May 2022 19:24:45 GMT server nginx age 438546 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * content-length 15920 x-xss-protection 0
GET H2	200	Figure-2-%E2%80%93-JPG-file-folder-with-similar-name-inside-RAR-archive.jpg cyble.com/wp-content/uploads/2023/10/	65 KB 65 KB	9ms 9ms	Image image/jpeg	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://cyble.com/wp-content/uploads/2023/10/Figure-2-%E2%80%93-JPG-file-folder-with-similar-name-inside-RAR-archive.jpg Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 23947f8193b03ac3f8ea1731cb0a421eadb7b60c52c158405806e649fed10e80 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-ac 2.hhn _atomic_ams HIT last-modified Fri, 06 Oct 2023 12:31:05 GMT server nginx etag "651ffe09-104c3" access-control-allow-methods GET, HEAD content-type image/jpeg access-control-allow-origin * cache-control max-age=604800 accept-ranges bytes content-length 66755 expires Fri, 13 Oct 2023 13:05:58 GMT
GET H2	200	Figure-3-Image-Video-files-inside-the-subfolder.png cyble.com/wp-content/uploads/2023/10/	97 KB 98 KB	10ms 9ms	Image image/png	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://cyble.com/wp-content/uploads/2023/10/Figure-3-Image-Video-files-inside-the-subfolder.png Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 29ba3c201c45eef0705257357eee0eece20e8aa6324120db4b6cc25ffc1adeea Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-ac 2.hhn _atomic_ams HIT last-modified Fri, 06 Oct 2023 12:41:40 GMT server nginx etag "65200084-18587" access-control-allow-methods GET, HEAD content-type image/png access-control-allow-origin * cache-control max-age=604800 accept-ranges bytes content-length 99719 expires Fri, 13 Oct 2023 13:05:58 GMT
GET H2	200	Figure-4-Content-of-CMD-file-inside-subfolder-1024x87.jpg cyble.com/wp-content/uploads/2023/10/	8 KB 8 KB	10ms 10ms	Image image/webp	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://cyble.com/wp-content/uploads/2023/10/Figure-4-Content-of-CMD-file-inside-subfolder-1024x87.jpg Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash ed9a4ea270e7f8d34156c9920830375113ae569e630be215cc745425974289cc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff x-ac 2.hhn _atomic_ams HIT content-length 8476 x-nc HIT dca 2 last-modified Fri, 06 Oct 2023 12:31:23 GMT server nginx etag "3b2b38d276c2ce75" vary Accept access-control-allow-methods GET, HEAD content-type image/webp access-control-allow-origin * cache-control public, max-age=63115200 timing-allow-origin * expires Mon, 06 Oct 2025 00:31:23 GMT
GET H2	200	Cyble-Demo.png cyble.com/wp-content/uploads/2023/06/	84 KB 84 KB	10ms 10ms	Image image/png	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://cyble.com/wp-content/uploads/2023/06/Cyble-Demo.png Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 0427349d2020319a07c730eb5c5cb8ee988339b37ea834a0e0e19463d7ff324d Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-ac 2.hhn _atomic_ams HIT last-modified Mon, 26 Jun 2023 08:04:44 GMT server nginx etag "6499469c-14f03" access-control-allow-methods GET, HEAD content-type image/png access-control-allow-origin * cache-control max-age=604800 accept-ranges bytes content-length 85763 expires Thu, 21 Sep 2023 18:18:57 GMT
GET H/1.1	200 OK	json Show response forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/	38 KB 7 KB	178ms 143ms	XHR application/json	2606:4700::6811:cff9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/json?hs_static_app=forms-embed&hs_static_app_version=1.3812&X-HubSpot-Static-App-Info=forms-embed-1.3812 Requested by Host: js.hsforms.net URL: https://js.hsforms.net/forms/v2.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:cff9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 821f248f0fd9905737432763d9243ba8fb8a3822f7774b0e59ec3356562b431d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/plain, */* Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers X-Origin-Hublet na1 Date Sat, 07 Oct 2023 05:35:17 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC Content-Encoding br x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 945d77a1-f8b9-42d6-8dc1-b29908835fe2 Transfer-Encoding chunked x-envoy-upstream-service-time 27 Connection keep-alive alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 945d77a1-f8b9-42d6-8dc1-b29908835fe2 Server cloudflare X-Trace 2B5F81F9D76EC5316B60E643B8004E9CA3881BBFF0000000000000000000 Vary origin Access-Control-Allow-Methods OPTIONS, GET Content-Type application/json;charset=utf-8 Access-Control-Allow-Origin https://cyble.com x-evy-trace-virtual-host all Access-Control-Expose-Headers X-Origin-Hublet Access-Control-Max-Age 180 Access-Control-Allow-Credentials false Cache-Control max-age=0, no-cache, no-store X-Robots-Tag none Access-Control-Allow-Headers * CF-RAY 8123c7a288023a90-FRA x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-79986f96f-swd7n
GET H2	200	pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 fonts.wp.com/s/poppins/v20/	8 KB 8 KB	6ms 6ms	Font font/woff2	192.0.77.32 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://fonts.wp.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 Requested by Host: fonts-api.wp.com URL: https://fonts-api.wp.com/css?family=Poppins%3A400%2C700%2C500%7CRoboto%3A500%2C400&display=fallback&ver=4.3.1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS wordpress.com Software nginx / Resource Hash cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts-api.wp.com/ Origin https://cyble.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers x-nc HIT hhn 1 date Sat, 07 Oct 2023 05:35:16 GMT x-content-type-options nosniff last-modified Wed, 27 Apr 2022 16:21:30 GMT server nginx age 519357 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * content-length 7748 x-xss-protection 0
GET H2	200	fa-brands-400.woff2 cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/	75 KB 75 KB	8ms 8ms	Font application/font-woff2	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-brands-400.woff2 Requested by Host: cyble.com URL: https://cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver=5.15.3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver=5.15.3 Origin https://cyble.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT strict-transport-security max-age=31536000 x-ac 2.hhn _atomic_ams HIT last-modified Wed, 20 Sep 2023 18:11:07 GMT server nginx etag "650b35bb-12bdc" access-control-allow-methods GET, HEAD content-type application/font-woff2 access-control-allow-origin * cache-control max-age=604800 accept-ranges bytes content-length 76764 expires Thu, 28 Sep 2023 18:30:42 GMT
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/exp/ Redirect Chain https://s.adroll.com/j/exp/ELNAF2EZDFHJRAP3ODLCUU/index.js https://s.adroll.com/j/exp/index.js	28 B 784 B	8ms 8ms	Script application/javascript	2600:9000:225e:f600:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/exp/index.js Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol HTTP/1.1 Server 2600:9000:225e:f600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers X-Amz-Version-Id e6mCeG7.PAM9gYrIJBIXJohubS3UVCEK Date Sat, 07 Oct 2023 03:14:41 GMT Via 1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront) Age 8462 X-Amz-Cf-Pop FRA60-P4 X-Amz-Server-Side-Encryption AES256 X-Cache Hit from cloudfront Connection keep-alive Content-Length 28 Last-Modified Thu, 03 Aug 2023 18:30:18 GMT Server AmazonS3 Etag "5816cced8568d223aa09d889f300692b" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type application/javascript Access-Control-Allow-Origin * Access-Control-Max-Age 600 Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers * X-Amz-Cf-Id cwlRyYV2YuSDr-m9MH0ghO-YEq_d3zps04CjpGzsxf250mFdl8EUaw== Redirect headers Date Fri, 06 Oct 2023 14:41:31 GMT Via 1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront) Age 53624 X-Amz-Cf-Pop FRA60-P4 X-Cache Hit from cloudfront Connection keep-alive Content-Length 0 Server AmazonS3 Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type application/xml Location https://s.adroll.com/j/exp/index.js Access-Control-Allow-Origin * Access-Control-Allow-Credentials false Access-Control-Allow-Headers * X-Amz-Cf-Id kCP5CasrHV4A7F5pT4deWyasuAKeEBwyftJuWA6o96hk2JABR5mU5A==
GET H2	200	api.min.css a.omappapi.com/app/js/	10 KB 3 KB	7ms 7ms	Stylesheet text/css	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/api.min.css Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash 7516f9aff006dced658ced4b577da1425b72add3677466abd9dca6fa4cb10d0b Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT content-encoding br cdn-edgestorageid 1082 perma-cache HIT cdn-storageserver DE-167 cdn-cachedat 10/06/2023 17:45:31 cdn-pullzone 293267 last-modified Mon, 25 Sep 2023 16:46:01 GMT server BunnyCDN-DE1-1080 cdn-fileserver 588 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"6511b949-2644" vary Accept-Encoding, Accept-Encoding content-type text/css access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid e9d757954de3722c6ee24be22bf73653 cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	r0hediyvvmvme9sqc9m4 Show response api.omappapi.com/v2/embed/239265/	4 KB 2 KB	151ms 106ms	XHR application/json	18.66.112.19 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.omappapi.com/v2/embed/239265/r0hediyvvmvme9sqc9m4 Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.19 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-19.fra56.r.cloudfront.net Software Pagely Gateway/1.5.1 / Resource Hash 283547740fcb77b2440b432515bfb0437fcbcb49dae73c5835d0087dcfd54a31 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding gzip via 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront) x-cache-config 0 0 x-amz-cf-pop FRA56-P5 x-cache-status HIT x-cache Miss from cloudfront x-optinmonster-campaign r0hediyvvmvme9sqc9m4 x-user-agent standard-- last-modified Mon, 21 Aug 2023 11:57:48 GMT server Pagely Gateway/1.5.1 etag W/"b68a1a774bac47ced8f1623f6053bc08" vary Accept-Encoding, User-Agent content-type application/json access-control-allow-origin * access-control-expose-headers X-OptinMonster-Campaign, X-User-Agent cache-control public, max-age=30, stale-while-revalidate=1800 access-control-allow-headers X-CSRF-Token x-amz-cf-id 6XG43f3KS5uGO22UHe7zPzrvmHkA1hcy67l9BsjdKWr5wupTdAPoyQ== expires Sat, 07 Oct 2023 05:12:42 GMT
POST H2	204	collect region1.google-analytics.com/g/	0 250 B	63ms 14ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-N9ZXY95EM4&gtm=45Pe3a40&_p=383422086&gdid=dZTNiMT&cid=1094680696.1696656917&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1696656916&sct=1&seg=0&dl=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&dt=WinRAR%20Vulnerability%20Puts%20Illicit%20Content%20Consumers%20at%20Risk%20of%20Apanyan%20Stealer%2C%20Murk-Stealer%20%26%20AsyncRAT%20%E2%80%94%20Cyble&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=GT-WKTZW36 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Sat, 07 Oct 2023 05:35:17 GMT server Golfe2 content-type text/plain access-control-allow-origin https://cyble.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10996750928/	3 KB 2 KB	44ms 22ms	Script text/javascript	2a00:1450:4001:828::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10996750928/?random=1696656917004&cv=11&fst=1696656917004&bg=ffffff&guid=ON&async=1&gtm=45Pe3a40&u_w=1600&u_h=1200&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&hn=www.googleadservices.com&frm=0&tiba=WinRAR%20Vulnerability%20Puts%20Illicit%20Content%20Consumers%20at%20Risk%20of%20Apanyan%20Stealer%2C%20Murk-Stealer%20%26%20AsyncRAT%20%E2%80%94%20Cyble&did=dZTNiMT&gdid=dZTNiMT&auid=1308203316.1696656917&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=GT-WKTZW36 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash b5e79c70da833ad5f7c61444ebc73863a701194dc9c3db18d1f3a0585bcefa74 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1454 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	12 KB 4 KB	47ms 7ms	Script application/x-javascript	2a02:26f0:3500:16::215:148d AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMWT557 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:148d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 28a26321734fb5f8c8fe42b5503f162fdf1469bf97e2d9c503a83cc2b3c534cd Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 05 Sep 2023 13:41:52 GMT x-cdn AKAM x-amz-server-side-encryption AES256 vary Accept-Encoding content-type application/x-javascript;charset=utf-8 cache-control max-age=80955 accept-ranges bytes content-length 3822
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	29ms 7ms	Script text/javascript	2a00:1450:4001:808::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMWT557 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Sat, 07 Oct 2023 03:49:42 GMT last-modified Mon, 12 Jun 2023 18:23:07 GMT server Golfe2 age 6335 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Sat, 07 Oct 2023 05:49:42 GMT
GET H2	200	21289959.js Show response js.hs-scripts.com/	2 KB 856 B	383ms 382ms	Script application/javascript	2606:4700::6810:bb59 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-scripts.com/21289959.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMWT557 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:bb59 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 75023cd4d9a144062c8239de5ce4c524c0372b38c4c20eb8a0d0a9a69fed07d4 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br x-content-type-options nosniff cf-cache-status EXPIRED x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id dff264ae-0da1-4d1e-836d-8590817cf95c x-envoy-upstream-service-time 5 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id dff264ae-0da1-4d1e-836d-8590817cf95c last-modified Sat, 07 Oct 2023 05:07:20 GMT server cloudflare x-trace 2B7BA02B8AD184B73E99336154F87CB16694E33616000000000000000000 vary origin, Accept-Encoding access-control-max-age 3600 content-type application/javascript;charset=utf-8 access-control-allow-origin https://cyble.com x-evy-trace-virtual-host all cache-control public, max-age=60 access-control-allow-credentials true x-evy-trace-served-by-pod iad02/hubapi-td/envoy-proxy-5b5c96c966-hm6sp cf-ray 8123c7a36e879207-FRA expires Sat, 07 Oct 2023 05:36:17 GMT
GET H2	200	hf2o0cm7gp Show response www.clarity.ms/tag/	650 B 1013 B	166ms 103ms	Script application/x-javascript	2620:1ec:46::45 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.clarity.ms/tag/hf2o0cm7gp?ref=gtm2 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 98b96676a4b14c4ad19c12b6d213babcfb822d7e654f48866bf9eb179a8f5bc3 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers expires -1 date Sat, 07 Oct 2023 05:35:17 GMT x-azure-ref 20231007T053517Z-tp87db0a650dded7xbe66b72w000000002hg000000000z07 x-cache CONFIG_NOCACHE content-type application/x-javascript cache-control no-cache, no-store accept-ranges bytes content-length 650 request-context appId=cid-v1:e55edbbe-e22b-46b4-8313-9ee2a4e71d12
GET H2	200	js Show response www.googletagmanager.com/gtag/	192 KB 71 KB	21ms 21ms	Script application/javascript	2a00:1450:4001:806::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-361856552&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMWT557 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 299f98fa42329c52dffeec7311e9f545ce3f3efada32a37d8c76e8876f2aedab Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 72885 x-xss-protection 0 last-modified Sat, 07 Oct 2023 03:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Sat, 07 Oct 2023 05:35:17 GMT
GET H2	200	21289959.js Show response js.hs-analytics.net/analytics/1696656900000/	66 KB 21 KB	563ms 543ms	Script text/javascript	2606:4700::6810:4fba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-analytics.net/analytics/1696656900000/21289959.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.2.5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:4fba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cac0a2640002afaa7042fbbd84fc1ee1b00df136b311e25cac9dabf9f483c3a8 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT x-amz-version-id null content-encoding br cf-cache-status MISS x-amz-request-id NB48DCATV98X8MH2 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 182f3315-2746-431c-b775-ea97c6a97e1a x-envoy-upstream-service-time 43 x-amz-id-2 4DXmymR8TWqy8JS/G69wfu7lFIJq3Gc+rRgnxELg4ZjnYkvfXEKErs95TfosTLfikrkSLnhHg6A= x-evy-trace-listener listener_https x-request-id 182f3315-2746-431c-b775-ea97c6a97e1a x-evy-trace-route-configuration listener_https/all last-modified Fri, 15 Sep 2023 18:37:16 GMT server cloudflare etag W/"e34c20781d72c76ea68d1cdecd0a76b4" vary origin, Accept-Encoding content-type text/javascript x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-85c95667b4-8ghtd cache-control max-age=300,public access-control-allow-credentials false cf-ray 8123c7a3ba5e372e-FRA expires Sat, 07 Oct 2023 05:40:17 GMT
GET H2	200	web-interactives-embed.js Show response js.hubspot.com/	75 KB 23 KB	152ms 118ms	Script application/javascript	2606:4700::6813:9a53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hubspot.com/web-interactives-embed.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.2.5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash abb73112c646c0cfca5313dce411270cee90340454a51c3ee1218834774ddd5c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Origin https://cyble.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-encoding br x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.579/bundles/project.js&cfRay=8123c7a3d9b06955-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"61cf09f2840246c03b083d2b2aaedbaf" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control max-age=600 x-hs-target-asset web-interactives-embed/static-2.579/bundles/project.js date Sat, 07 Oct 2023 05:35:17 GMT x-amz-version-id ZH1lXdEo36sSD12T68pVuRktbLMj6Y_H via 1.1 f01dafb3bec9893b47152910d47900a4.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status EXPIRED nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop IAD12-P3 x-hubspot-correlation-id 7317723e-ecc6-433f-bdc2-c4d15cee0b2d x-cache Hit from cloudfront cache-tag staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod x-envoy-upstream-service-time 3 x-evy-trace-route-configuration listener_https/all x-request-id 7317723e-ecc6-433f-bdc2-c4d15cee0b2d last-modified Wed, 04 Oct 2023 10:21:17 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F%2FL%2Bmphe%2BTg2riB71LUcPIG9RHDe2gXo1GaA%2F2XBMHnJ1oGhSMCa%2Feirlky1RDgi0paJKXpxMHAeh0%2FI%2FK5Sxr%2FDtdsF65JfQuZ6WH4re6FYYqrcIOEgfz5BvaZLrOFPlow3cvCi0LoIAgPy"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-7c89bb96b9-q9rvq cf-ray 8123c7a3d9b06955-FRA x-amz-cf-id aAvXaAoBjhVHSBsT6nNhWXGiS9uR_YIzWbJdIES1laYkAiEuxy__TQ==
GET H2	200	banner.js Show response js.hs-banner.com/v2/21289959/	67 KB 20 KB	399ms 380ms	Script text/javascript	2606:4700:4400::6812:22e5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/v2/21289959/banner.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.2.5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:22e5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bc992ac697275fb26c1638c176cee54c1aebae3ee2be24974ed0d6ec73ce34f2 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT x-amz-version-id DQiemF3tmvdiDI8Q4FbXc4Is0Sk.lRpy content-encoding br cf-cache-status REVALIDATED x-amz-request-id FREA2FNKFH6N541E x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id 7d2ad8b5-a012-40ad-9ff5-f362ac3d3c2c x-envoy-upstream-service-time 20 x-amz-id-2 Oc2a5rIO+SyXQwQMfRLZY+t5u2b+cHzcIPHjWK8zragmrHR86Zrnk5YTvGNXMuvt+pkqNjTpUBiDiNp7uctJfQ== x-evy-trace-listener listener_https x-request-id 7d2ad8b5-a012-40ad-9ff5-f362ac3d3c2c x-evy-trace-route-configuration listener_https/all last-modified Tue, 26 Sep 2023 21:58:23 GMT server cloudflare etag W/"41a0fc192fcdeba78bb36b60f0a347cd" access-control-max-age 604800 access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type text/javascript; charset=UTF-8 access-control-allow-origin https://cyble.com x-evy-trace-virtual-host all access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300,public access-control-allow-credentials true x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-c5f7fd779-fzzvz vary origin, Accept-Encoding timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 8123c7a3bca0bc04-FRA expires Sat, 07 Oct 2023 05:40:17 GMT
GET H2	200	leadflows.js Show response js.hsleadflows.net/	540 KB 86 KB	42ms 14ms	Script application/javascript	2606:4700::6812:7c0c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hsleadflows.net/leadflows.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.2.5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:7c0c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b399c5e2375b9f5d108af3cc74f7d665747a5d1955f5fde2db7f110b30a1f65e Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Origin https://cyble.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-encoding br age 74908 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1250/bundle/main/lead-flows-release.js&cfRay=811ca2d3e9a19195-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"b41828c438dcec976b93ddee1edebd6d" vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods GET content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=86400, max-age=0 x-hs-target-asset lead-flows-js/static-1.1250/bundle/main/lead-flows-release.js date Sat, 07 Oct 2023 05:35:17 GMT x-amz-version-id w9qtR_oGTBab1H9Wt5L5qiHDqxRKIaLE via 1.1 2a3aa853116c0a37d6c7762eca54d208.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT x-amz-cf-pop IAD12-P3 x-hubspot-correlation-id b20308ff-7563-483c-a8dd-b830fa3f8a6e x-cache Hit from cloudfront cache-tag staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod x-envoy-upstream-service-time 15 x-evy-trace-route-configuration listener_https/all x-request-id b20308ff-7563-483c-a8dd-b830fa3f8a6e last-modified Mon, 04 Sep 2023 12:55:59 UTC server cloudflare access-control-max-age 3000 x-hs-cache-status MISS x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-7c89bb96b9-x2c4p cf-ray 8123c7a3cbee90e6-FRA x-amz-cf-id dZH_EbR9gluo9tDam--DyqyufJ92n0X1U4qLhTXy2QUMOsdZN1AiFg==
GET H2	200	conversations-embed.js Show response js.usemessages.com/	76 KB 22 KB	52ms 17ms	Script application/javascript	2606:4700::6811:f7a8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.usemessages.com/conversations-embed.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.2.5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:f7a8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 375fab8cd866ba618630e49036f0373b7693dbff589140c489017185d4092fd4 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT x-amz-version-id ox9i7AJUcGNeHtamA4MecCiw7bDVoEmE via 1.1 2a3aa853116c0a37d6c7762eca54d208.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT x-amz-cf-pop IAD12-P3 age 211 x-amz-server-side-encryption AES256 x-evy-trace-route-service-name envoyset-translator content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.14347/bundles/project.js&cfRay=8123c2818fa52d04-FRA x-cache Hit from cloudfront x-hubspot-correlation-id 0cf1d8c0-533e-4794-b9aa-9521081f0a43 cache-tag staticjsapp-conversations-embed-web-prod,staticjsapp-prod content-encoding br x-envoy-upstream-service-time 3 x-amz-replication-status COMPLETED x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 0cf1d8c0-533e-4794-b9aa-9521081f0a43 last-modified Thu, 05 Oct 2023 02:05:19 UTC server cloudflare etag W/"c45075af7860f89c815bfe1becd1495f" vary Accept-Encoding content-type application/javascript; charset=utf-8 x-hs-cache-status HIT x-evy-trace-virtual-host all cache-control max-age=600 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-7c89bb96b9-mlg6m cf-ray 8123c7a3d8442c3d-FRA x-amz-cf-id 06qIW8HhZooeSz2SBWbpsm5d6iKw8rL6KaEr9cWw0MR7T2fpNXwZ2g== x-hs-target-asset conversations-embed/static-1.14347/bundles/project.js
GET H2	200	ELNAF2EZDFHJRAP3ODLCUU Show response d.adroll.com/consent/check/	482 B 575 B	123ms 31ms	Script application/javascript	2a05:d018:cc3:fe05:e313:d0df:a3f0:b5dc AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d.adroll.com/consent/check/ELNAF2EZDFHJRAP3ODLCUU?pv=36484538261.503174&arrfrr=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&_s=10775cfa8001d771ec8d6f2d34a486d0&_b=2 Requested by Host: s.adroll.com URL: https://s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/roundtrip.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:d018:cc3:fe05:e313:d0df:a3f0:b5dc Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx/1.22.1 / Resource Hash 2db42f12b070f135689bb618006b73e3e90df04bc085f0baa3e1457a5f36ebcc Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT server nginx/1.22.1 content-length 482 content-type application/javascript
GET H2	200	g.gif pixel.wp.com/	50 B 116 B	12ms 7ms	Image image/gif	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.wp.com/g.gif?v=ext&blog=221651828&post=22860&tz=-4&srv=cyble.com&hp=atomic&ac=2&amp=0&j=1%3A12.7-a.7&host=cyble.com&ref=&fcp=1622&rand=0.9391081112462716 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers access-control-allow-origin * date Sat, 07 Oct 2023 05:35:17 GMT cache-control no-cache server nginx content-length 50 content-type image/gif
GET H2	200	wp-emoji-release.min.js Show response cyble.com/wp-includes/js/	18 KB 5 KB	8ms 7ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-includes/js/wp-emoji-release.min.js?ver=6.3.1 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Thu, 02 Feb 2023 00:53:25 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"63db0985-4904" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=315360000 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	/ Show response cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/	4 KB 1 KB	612ms 612ms	XHR application/json	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/?relatedposts=1 Requested by Host: cyble.com URL: https://cyble.com/wp-content/plugins/jetpack/_inc/build/related-posts/related-posts.min.js?ver=20211209 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 36f76db4bd897d3e00c13c4c021038c385603b7bc8a3a65b8e290f69fd13e646 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ x-requested-with XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers cf-edge-cache cache,platform=wordpress x-hacker Want root? Visit join.a8c.com and mention this header. date Sat, 07 Oct 2023 05:35:17 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff content-encoding br x-nananana Batcache-Set x-ac 2.hhn _atomic_ams EXPIRED host-header WordPress.com x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Sat, 07 Oct 2023 05:35:17 GMT server nginx vary Accept-Encoding, Cookie x-frame-options SAMEORIGIN content-type application/json; charset=utf-8 cache-control max-age=300, must-revalidate
GET H2	200	v2.js Show response js.hsforms.net/forms/ Frame 93AF	549 KB 174 KB	17ms 16ms	Script application/javascript	2606:4700::6810:88ce CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hsforms.net/forms/v2.js Requested by Host: js.hsforms.net URL: https://js.hsforms.net/forms/v2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:88ce , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a24e66d830ef814bbcc4553b662e0c2afe733f8f30fb4a86be6df577d146bec2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers content-encoding br age 479 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.3812/bundles/project-v2.js&cfRay=8123bbf34b3c3a5e-FRA x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"84d6c03b19ba72ee08ca8c27dee147c2" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=600, max-age=300 x-hs-target-asset forms-embed/static-1.3812/bundles/project-v2.js date Sat, 07 Oct 2023 05:35:17 GMT x-amz-version-id 4b09e6_AhU37WJHx62r2StyRWH0KMlOF via 1.1 3d4bfc42e9575ee1f9559241c9e3f464.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop IAD12-P3 x-hubspot-correlation-id 6b062665-6ec9-4582-9879-cf683abbf363 x-cache Hit from cloudfront cache-tag staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod x-envoy-upstream-service-time 2 alt-svc h3=":443"; ma=86400 x-evy-trace-route-configuration listener_https/all x-request-id 6b062665-6ec9-4582-9879-cf683abbf363 last-modified Fri, 22 Sep 2023 08:13:06 UTC server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bI%2BNomVVGBaHZ0joC996Eo%2Bq9OuU4%2BWn27BA0LryPIzupwheDg5hqXAdfWb84WKrN5jEsdMYz32SHhpiVPyAU0BS8xBezNnrnFqJxQ5yE4zf940UIqYUQmgWlNZYThwSkeGqky41q6ydr2fe"}],"group":"cf-nel","max_age":604800} x-hs-cache-status HIT x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-7c89bb96b9-hjsqm cf-ray 8123c7a3d8fd1999-FRA x-amz-cf-id q8dUdqKCa4KY-gdQV9r8qW-CFIygnwMwlN2dnj7Aq2bnpniioZBxXg==
POST H2	204	collect region1.google-analytics.com/g/	0 54 B	21ms 21ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-361856552&gtm=45je3a40&_p=383422086&cid=1094680696.1696656917&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1696656917&sct=1&seg=0&dl=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&dt=WinRAR%20Vulnerability%20Puts%20Illicit%20Content%20Consumers%20at%20Risk%20of%20Apanyan%20Stealer%2C%20Murk-Stealer%20%26%20AsyncRAT%20%E2%80%94%20Cyble&en=page_view&_fv=1&_ss=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-361856552&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Sat, 07 Oct 2023 05:35:17 GMT server Golfe2 content-type text/plain access-control-allow-origin https://cyble.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	roundtrip.js Show response s.adroll.com/j/	75 KB 24 KB	8ms 8ms	Script text/javascript	2600:9000:225e:f600:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/roundtrip.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMWT557 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225e:f600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 0e7ad47a4bc6ddbb17cb8cbe6167dae4717d0b5962a1d63de2e93e6dc201b9e8 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers X-Amz-Version-Id 2W0nFhLgp3U9gUvvEzXT9GuNEpd6A6yg Content-Encoding gzip Via 1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront) Date Sat, 07 Oct 2023 05:33:14 GMT Age 123 X-Amz-Cf-Pop FRA60-P4 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Last-Modified Thu, 03 Aug 2023 19:17:31 GMT Server AmazonS3 Etag W/"67e54a60303cfbf4c3b977aa390ad408" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Access-Control-Max-Age 600 Access-Control-Allow-Headers * X-Amz-Cf-Id eT6m8EJyFdKCyAcTS2zguDobG2T4H8JKjsngZPiS1iXw6PYHBXGPfg==
GET H2	200	tags.js Show response tag.clearbitscripts.com/v1/pk_43e7489448ea26212d2c648f4818c8b5/	16 KB 5 KB	247ms 184ms	Script application/javascript	2600:9000:214f:2600:7:d7d6:3c40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tag.clearbitscripts.com/v1/pk_43e7489448ea26212d2c648f4818c8b5/tags.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PMWT557 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:214f:2600:7:d7d6:3c40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software envoy / Resource Hash 9e907e949bce3cec0efeaf4b707c2d5b1363467b174fced0e54fae1d501c36ed Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:16 GMT content-encoding gzip x-content-type-options nosniff x-envoy-response-flags - via 1.1 7549433a09d06354ea864d169b689e50.cloudfront.net (CloudFront) server envoy strict-transport-security max-age=63072000; includeSubDomains; preload x-amz-cf-pop FRA53-C1 etag W/"9bd0e6149c66576fdc7ae464697b7327" vary Accept-Encoding x-cache Miss from cloudfront content-type application/javascript;charset=utf-8 cache-control private, max-age=600 x-amz-cf-id aYTdXzoTasevD1sBAAerbp8GhFMCvtm6TkJe32epqSgPzpnXLN4xbg==
POST H2	200	collect Show response www.google-analytics.com/j/	4 B 205 B	20ms 19ms	XHR text/plain	2a00:1450:4001:808::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&a=383422086&t=pageview&_s=1&dl=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&ul=en-us&de=UTF-8&dt=WinRAR%20Vulnerability%20Puts%20Illicit%20Content%20Consumers%20at%20Risk%20of%20Apanyan%20Stealer%2C%20Murk-Stealer%20%26%20AsyncRAT%20%E2%80%94%20Cyble&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAAABAAAAAC~&jid=70142414&gjid=1958556237&cid=1094680696.1696656917&tid=UA-201575643-1&_gid=1403304288.1696656917&_r=1&_slc=1&gtm=45He3a40n81PMWT557&z=1955674395 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Sat, 07 Oct 2023 05:35:17 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://cyble.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/10996750928/	42 B 455 B	43ms 20ms	Image image/gif	2a00:1450:4001:810::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10996750928/?random=1696656917004&cv=11&fst=1696654800000&bg=ffffff&guid=ON&async=1&gtm=45Pe3a40&u_w=1600&u_h=1200&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&frm=0&tiba=WinRAR%20Vulnerability%20Puts%20Illicit%20Content%20Consumers%20at%20Risk%20of%20Apanyan%20Stealer%2C%20Murk-Stealer%20%26%20AsyncRAT%20%E2%80%94%20Cyble&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1555511413&rmt_tld=0&ipr=y Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Sat, 07 Oct 2023 05:35:17 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/10996750928/	42 B 455 B	44ms 21ms	Image image/gif	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/10996750928/?random=1696656917004&cv=11&fst=1696654800000&bg=ffffff&guid=ON&async=1&gtm=45Pe3a40&u_w=1600&u_h=1200&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&frm=0&tiba=WinRAR%20Vulnerability%20Puts%20Illicit%20Content%20Consumers%20at%20Risk%20of%20Apanyan%20Stealer%2C%20Murk-Stealer%20%26%20AsyncRAT%20%E2%80%94%20Cyble&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1555511413&rmt_tld=1&ipr=y Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Sat, 07 Oct 2023 05:35:17 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	insight.old.min.js Show response snap.licdn.com/li.lms-analytics/	13 KB 5 KB	7ms 7ms	Script application/x-javascript	2a02:26f0:3500:16::215:148d AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.old.min.js Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:148d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 28 Aug 2023 12:14:15 GMT x-cdn AKAM x-amz-server-side-encryption AES256 vary Accept-Encoding content-type application/x-javascript;charset=utf-8 cache-control max-age=27022 accept-ranges bytes content-length 4862
GET H2	200	5.77298452.min.js Show response a.omappapi.com/app/js/	16 KB 6 KB	17ms 17ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/5.77298452.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash 283ce4fc2baa0dfd2324b05b14d0530fc385ee92fea03e1bd0891aa8593bdff2 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1082 perma-cache HIT cdn-storageserver DE-661 cdn-cachedat 10/06/2023 17:45:31 cdn-pullzone 293267 last-modified Mon, 18 Sep 2023 16:47:42 GMT server BunnyCDN-DE1-1080 cdn-fileserver 599 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"65087f2e-4140" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 9d96435f89111d7c298240940ae661cf cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	text-editor.2c35aafbe5bf0e127950.bundle.min.js Show response cyble.com/wp-content/plugins/elementor/assets/js/	1 KB 751 B	7ms 7ms	Script application/javascript	192.0.78.152 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://cyble.com/wp-content/plugins/elementor/assets/js/text-editor.2c35aafbe5bf0e127950.bundle.min.js Requested by Host: cyble.com URL: https://cyble.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.16.4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.78.152 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 46ade2015c8f9b9cabbf67dfde5da6664f4690725cd94ee6215eeacfe9b19b3f Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT strict-transport-security max-age=31536000 content-encoding br last-modified Wed, 20 Sep 2023 18:11:06 GMT server nginx x-ac 2.hhn _atomic_ams HIT etag W/"650b35ba-550" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type application/javascript access-control-allow-origin * cache-control max-age=604800 expires Thu, 28 Sep 2023 18:19:47 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	1 B 342 B	62ms 20ms	XHR text/plain	2a00:1450:400c:c0c::9a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-201575643-1&cid=1094680696.1696656917&jid=70142414&gjid=1958556237&_gid=1403304288.1696656917&_u=YADAAAAAAAAAAC~&z=1909502722 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0c::9a Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Sat, 07 Oct 2023 05:35:17 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://cyble.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	public Show response api.hubspot.com/livechat-public/v1/message/	3 KB 2 KB	212ms 210ms	XHR application/json	2606:4700::6813:9a53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.hubspot.com/livechat-public/v1/message/public?portalId=21289959&conversations-embed=static-1.14347&mobile=false&messagesUtk=352e1ccc86314306abca41808258c8ff&traceId=352e1ccc86314306abca41808258c8ff Requested by Host: js.usemessages.com URL: https://js.usemessages.com/conversations-embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f2ba94d7b4e614df62f21a53e1c4eb17b9b7cdcece79caedf191e63e30a6f38e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ accept-language de-DE,de;q=0.9 X-HubSpot-Messages-Uri https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id b9e339d9-cf4f-4437-b9d0-6be1b9234426 x-envoy-upstream-service-time 85 content-length 1334 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id b9e339d9-cf4f-4437-b9d0-6be1b9234426 server cloudflare x-trace 2BF16C16ED3F5D2D39C30706B2092F1587D485A9B3000000000000000000 vary origin, Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://cyble.com x-evy-trace-served-by-pod iad02/hubapi-td/envoy-proxy-5b5c96c966-mflmx cache-control no-cache, no-store, no-transform, must-revalidate, max-age=0 access-control-allow-credentials false x-evy-trace-virtual-host all report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A5ZzNwyZWr4oj8s1xVJ7RMEIGnD2mxdWrcDS8OVhGv6rwq92%2FJ0dGFVa%2B7XCi4nFbvuixfsaNwc4PdpyT2L1rx50uzkdqE5US5f3Ermew7YIPM9idXHHUzJx4taeLv5DH3pkRiPAyTZ42ZZZnw%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8123c7a56aaa6955-FRA access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
OPTIONS H2	200	public api.hubspot.com/livechat-public/v1/message/ Frame	0 0	137ms 122ms	Preflight text/plain	2606:4700::6813:9a53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.hubspot.com/livechat-public/v1/message/public?portalId=21289959&conversations-embed=static-1.14347&mobile=false&messagesUtk=352e1ccc86314306abca41808258c8ff&traceId=352e1ccc86314306abca41808258c8ff Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Headers x-hubspot-messages-uri Access-Control-Request-Method GET Origin https://cyble.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers access-control-allow-credentials false access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD access-control-allow-origin https://cyble.com allow HEAD,GET,OPTIONS cf-cache-status DYNAMIC cf-ray 8123c7a49a276955-FRA content-length 18 content-type text/plain; charset=utf-8 date Sat, 07 Oct 2023 05:35:17 GMT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5UagKQsodm1hxezuzDvlTgOhEtIkyy17BDeJXKMWUHBgpw0QZkACovlILlcO3%2BEy%2Bqth2I67UaLmgaxBqam5Zk%2BbN79zXSeIL%2BSearZKZAYu9dMmPcveHNt87Yl1Ch7MwPZUg14Fd0kMie9U%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary origin, Accept-Encoding x-content-type-options nosniff x-envoy-upstream-service-time 2 x-evy-trace-listener listener_https x-evy-trace-route-configuration listener_https/all x-evy-trace-route-service-name envoyset-translator x-evy-trace-served-by-pod iad02/hubapi-td/envoy-proxy-5b5c96c966-dmm4c x-evy-trace-virtual-host all x-hubspot-correlation-id 83457daa-ee9e-4627-8fbf-2a1cf80925d7 x-request-id 83457daa-ee9e-4627-8fbf-2a1cf80925d7 x-trace 2B64B23E6FC9AD5A633081C003555E7FCE68227C9B000000000000000000
GET H3	200	counters.gif forms.hsforms.com/embed/v3/	35 B 625 B	141ms 128ms	Image image/gif	2606:4700::6811:cff9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:cff9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 897bc4a1-c894-4eaa-aab2-3300879ad887 x-envoy-upstream-service-time 1 alt-svc h3=":443"; ma=86400 content-length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 897bc4a1-c894-4eaa-aab2-3300879ad887 server cloudflare x-trace 2B9508DD7676F945CDA26A5A1CB6EFC4A200D4C197000000000000000000 vary origin content-type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-79986f96f-97dlb access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store access-control-allow-credentials false x-robots-tag none cf-ray 8123c7a4c91b30e2-FRA
GET H/1.1	200 OK	counters.gif forms-na1.hsforms.com/embed/v3/	35 B 1015 B	161ms 124ms	Image image/gif	2606:4700::6812:a07d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:a07d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Date Sat, 07 Oct 2023 05:35:17 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status DYNAMIC x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 40fc72ce-856a-4446-9ca0-79d87e9f0d11 x-envoy-upstream-service-time 1 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 40fc72ce-856a-4446-9ca0-79d87e9f0d11 Server cloudflare X-Trace 2B78E57ECFC191FA8892B22F02D33099A977D5AAAE000000000000000000 Vary origin Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-79986f96f-rwf2n Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false X-Robots-Tag none CF-RAY 8123c7a55a529bee-FRA
GET H/1.1	200 OK	consent_tcfv2.js Show response s.adroll.com/j/	418 KB 56 KB	8ms 8ms	Script text/javascript	2600:9000:225e:f600:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/consent_tcfv2.js Requested by Host: s.adroll.com URL: https://s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/roundtrip.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225e:f600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 47e5ff66931402cb5755d7eed98a6d23ee556a7f8e9c1dd340d351c27f669a0f Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers X-Amz-Version-Id wD7IUQmRA9PUuld8lU58FBeuMlOqC6p6 Content-Encoding gzip Via 1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront) Date Sat, 07 Oct 2023 05:33:44 GMT Age 97 X-Amz-Cf-Pop FRA60-P4 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Last-Modified Wed, 05 Jul 2023 21:39:27 GMT Server AmazonS3 Etag W/"3306a47faf7223d93fb356e8a73d1942" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=300, must-revalidate Access-Control-Allow-Credentials false Access-Control-Max-Age 600 Access-Control-Allow-Headers * X-Amz-Cf-Id TTvxCECHjnO5KtAVlYVewuAmz2nMGPrchPVvRw0cU0qvYuk7sMENcQ==
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/4053396/domain/cyble.com/	36 B 356 B	71ms 8ms	XHR application/json	2600:9000:206f:a00:2:53b2:240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/4053396/domain/cyble.com/token Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206f:a00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software awselb/2.0 / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 02 Oct 2023 10:59:02 GMT via 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront) server awselb/2.0 x-amz-cf-pop FRA56-C1 age 412575 x-cache Hit from cloudfront content-type application/json; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control max-age=86400 content-length 36 x-amz-cf-id 2tK-9erGQVxd3zYtXOrecEWrN-PhUGlDJ8YP6Zh6BJ4R6FBSuxa8Wg==
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1696656917302&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-mur... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1696656917302&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-mur... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4053396%26time%3D1696656917302%26url%3Dhttps%253A%252F%252Fcyble.com%252Fblog%252... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1696656917302&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-mur... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1696656917302&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-mu...	0 265 B	263ms 184ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1696656917302&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&cookiesTest=true&liSync=true&e_ipv6=AQIzcaW4RyfF6AAAAYsIogX38ITVkCwBqrolnUl0jrIScIzQsPhWxpESRUSA4AIJ Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: D24D89BC3FEF481EAF010983E48A9B63 Ref B: FRAEDGE1310 Ref C: 2023-10-07T05:35:18Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lor1 x-li-proto http/2 content-length 0 x-li-uuid AAYHGbjsGtwCpQaUIrTPQw== Redirect headers date Sat, 07 Oct 2023 05:35:17 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 646F3F3440D14A4EB285FBE502732C7B Ref B: FRAEDGE2017 Ref C: 2023-10-07T05:35:17Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-lor1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1696656917302&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&cookiesTest=true&liSync=true&e_ipv6=AQIzcaW4RyfF6AAAAYsIogX38ITVkCwBqrolnUl0jrIScIzQsPhWxpESRUSA4AIJ x-li-proto http/2 content-length 0 x-li-uuid AAYHGbjnNzhQpDvw2Xe7Fw==
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/4053396/domain/cyble.com/	36 B 358 B	69ms 7ms	XHR application/json	2600:9000:206f:a00:2:53b2:240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/4053396/domain/cyble.com/token Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206f:a00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software awselb/2.0 / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Mon, 02 Oct 2023 10:59:02 GMT via 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront) server awselb/2.0 x-amz-cf-pop FRA56-C1 age 412575 x-cache Hit from cloudfront content-type application/json; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control max-age=86400 content-length 36 x-amz-cf-id cgqSPLEdZfTjmDmre0hn4cGilx-CNJWl63yZYmRMfK5TLRB-9-jS7w==
GET H2	200	4.62cc77b7.min.js Show response a.omappapi.com/app/js/	48 KB 14 KB	9ms 8ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/4.62cc77b7.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash e36a1932a305173bf65172ee69f7ef2b715316deff15f8a023c7872b5a6184fc Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1081 perma-cache HIT cdn-storageserver DE-677 cdn-cachedat 10/06/2023 17:45:32 cdn-pullzone 293267 last-modified Mon, 18 Sep 2023 16:47:35 GMT server BunnyCDN-DE1-1080 cdn-fileserver 587 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"65087f27-bf88" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid b41982b6b63c1c7fb5fd56902099b9a7 cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	clarity.js Show response www.clarity.ms/s/0.7.12/	58 KB 25 KB	16ms 16ms	Script application/javascript	2620:1ec:46::45 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.clarity.ms/s/0.7.12/clarity.js Requested by Host: www.clarity.ms URL: https://www.clarity.ms/tag/hf2o0cm7gp?ref=gtm2 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 977a886e5d9068b3ed8dde6e511ca22ccf44cbed7fb881d0b8b74619fe462e21 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br last-modified Wed, 04 Oct 2023 21:58:30 GMT etag W/"0x8DBC5250B8892E9" vary Accept-Encoding x-azure-ref 20231007T053517Z-tp87db0a650dded7xbe66b72w000000002hg000000000z2k content-type application/javascript;charset=utf-8 access-control-allow-origin * x-ms-request-id ef621914-501e-0016-309d-f7d80c000000 cache-control public, max-age=86400 x-cache TCP_HIT x-ms-version 2018-03-28
GET H2	200	combinedConfigs Show response cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/	207 B 1 KB	153ms 135ms	Fetch application/json	2606:4700::6813:9a53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=21289959&currentUrl=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F Requested by Host: js.hubspot.com URL: https://js.hubspot.com/web-interactives-embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4e1f5dae1f231a3e6c42993418f2c2b7670e62db5b3ffee9afe0afa6657504f5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id fc9a0bed-82cd-4280-b01a-dfc07c64a95b content-encoding br x-envoy-upstream-service-time 11 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id fc9a0bed-82cd-4280-b01a-dfc07c64a95b server cloudflare vary origin access-control-allow-methods OPTIONS, GET content-type application/json;charset=utf-8 access-control-allow-origin https://cyble.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials true cache-control max-age=0, no-cache, no-store report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LXRV7lojxq%2FWqcw2a7DGoE3GEd840l0M4jm2QBkkqXdBHXQVMLOmnPA1jBPtkhip7HBwhF5yBnOwolzVEiVGkGJHkF270jpAWOrPZlsblk%2FEsbZKUJVfHxORT4eJGFEGQn0usqKl4rWuYzbARb%2Bx4Z8eJoI%2BK7awqok%3D"}],"group":"cf-nel","max_age":604800} x-robots-tag noindex, follow access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent cf-ray 8123c7a55aa36955-FRA x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-79986f96f-lmntd
GET H2	200	17.24171f7e.min.js Show response a.omappapi.com/app/js/	975 B 1 KB	7ms 6ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/17.24171f7e.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash 228739c5660b9818a95c3b2c13f6c65cf4364f871c0cde499446c985be07a682 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1080 perma-cache HIT cdn-storageserver DE-382 cdn-cachedat 10/06/2023 17:45:32 cdn-pullzone 293267 last-modified Tue, 12 Sep 2023 04:06:13 GMT server BunnyCDN-DE1-1080 cdn-fileserver 599 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"64ffe3b5-3cf" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 118d47ee05b27dbfc8dd91fd0737fac0 cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	19.b93023b7.min.js Show response a.omappapi.com/app/js/	4 KB 3 KB	7ms 6ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/19.b93023b7.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash 263c3a799ea39e2db3c3347bab23a9f98990d9d9633d2d8b833d8766c3dc2b36 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1080 perma-cache HIT cdn-storageserver DE-51 cdn-cachedat 10/06/2023 17:45:31 cdn-pullzone 293267 last-modified Mon, 18 Sep 2023 16:47:40 GMT server BunnyCDN-DE1-1080 cdn-fileserver 587 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"65087f2c-10b0" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 47485dfde491b284c5e4a8206a1b8d41 cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	27.78393e5b.min.js Show response a.omappapi.com/app/js/	6 KB 3 KB	20ms 18ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/27.78393e5b.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash 5405f21fd05a73a76a85b2021b366df4dcd00dd93ad956d671776622ea5e1ffc Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1081 perma-cache HIT cdn-storageserver DE-165 cdn-cachedat 10/06/2023 17:45:31 cdn-pullzone 293267 last-modified Mon, 18 Sep 2023 16:47:43 GMT server BunnyCDN-DE1-1080 cdn-fileserver 587 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"65087f2f-1973" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 044bb6303819baeae1cac848a055cbe9 cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	32.b9065693.min.js Show response a.omappapi.com/app/js/	11 KB 5 KB	8ms 6ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/32.b9065693.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash 978277c7385002bbd8eca4f51d7bdac7424ef8c6d267066e36b018b25bf88f7a Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1080 perma-cache HIT cdn-storageserver DE-382 cdn-cachedat 10/06/2023 17:45:32 cdn-pullzone 293267 last-modified Mon, 18 Sep 2023 16:47:33 GMT server BunnyCDN-DE1-1080 cdn-fileserver 587 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"65087f25-2c41" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 678b12043e57801e298e0bdb050befb8 cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	10.60d422ac.min.js Show response a.omappapi.com/app/js/	33 KB 10 KB	10ms 7ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/10.60d422ac.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash 79daab4e83a4f5e90a968e225b13c924d174ff804fcccdee5164c1530d68c755 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1080 perma-cache HIT cdn-storageserver DE-164 cdn-cachedat 10/06/2023 17:45:31 cdn-pullzone 293267 last-modified Mon, 25 Sep 2023 16:44:38 GMT server BunnyCDN-DE1-1080 cdn-fileserver 599 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"6511b8f6-82ca" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 4499e14f1b15d4904386472cf4a70ee3 cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	0.514c5def.min.js Show response a.omappapi.com/app/js/	7 KB 3 KB	10ms 8ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/0.514c5def.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash a0746aee5a2b0032d3d664b8383d97bb3e1f0dce11ececfa1258072a704b1a72 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1081 perma-cache HIT cdn-storageserver DE-167 cdn-cachedat 10/06/2023 17:45:31 cdn-pullzone 293267 last-modified Mon, 18 Sep 2023 16:47:37 GMT server BunnyCDN-DE1-1080 cdn-fileserver 383 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"65087f29-1d49" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 192642e603b512bc920f176c66a430ab cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	9.c66ab701.min.js Show response a.omappapi.com/app/js/	2 KB 2 KB	11ms 9ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/9.c66ab701.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash 8ad9a6bcdc20b0bb29576b861332e7b11719bd11af68024d7676724574070f05 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1080 perma-cache HIT cdn-storageserver DE-168 cdn-cachedat 10/06/2023 17:45:31 cdn-pullzone 293267 last-modified Mon, 18 Sep 2023 18:28:00 GMT server BunnyCDN-DE1-1080 cdn-fileserver 599 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"650896b0-879" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 81c624fb1f7e75e0a2da1f8d35582157 cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	11.38e902ad.min.js Show response a.omappapi.com/app/js/	3 KB 2 KB	11ms 9ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/11.38e902ad.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash c110d3e795d9bcb956d5c9ef500d23c7e480a259519d383d5c626293ee413815 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1081 perma-cache HIT cdn-storageserver DE-680 cdn-cachedat 10/06/2023 17:45:31 cdn-pullzone 293267 last-modified Mon, 18 Sep 2023 16:47:37 GMT server BunnyCDN-DE1-1080 cdn-fileserver 383 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"65087f29-a40" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid af7d67eadb37c91827400458a73ddee2 cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	28.377be946.min.js Show response a.omappapi.com/app/js/	3 KB 2 KB	11ms 9ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/28.377be946.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash 8f927cd54d7ef0ffd667f6537f9a9f3ef56fd8f86b32c8dfd534c29da2f2242a Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1082 perma-cache HIT cdn-storageserver DE-676 cdn-cachedat 10/06/2023 17:45:31 cdn-pullzone 293267 last-modified Mon, 18 Sep 2023 16:47:51 GMT server BunnyCDN-DE1-1080 cdn-fileserver 383 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"65087f37-d7b" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid ff83c8d602923070804c46feeef76874 cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	26.1898e425.min.js Show response a.omappapi.com/app/js/	2 KB 1 KB	11ms 10ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/26.1898e425.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash c6fd60d4ecfcac36ecdcb7456ecf170d8eef75c883a1e34a4dd7855d23966cd2 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1081 perma-cache HIT cdn-storageserver DE-51 cdn-cachedat 10/06/2023 17:45:31 cdn-pullzone 293267 last-modified Mon, 18 Sep 2023 16:47:40 GMT server BunnyCDN-DE1-1080 cdn-fileserver 588 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"65087f2c-6b6" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid de31e698cc8dacce075ef5bbe7e3beec cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	16.0e435a6f.min.js Show response a.omappapi.com/app/js/	1 KB 1 KB	12ms 10ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/16.0e435a6f.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash c4fbf61bcc8a017d5d9cd2d95105bf88005bc0a3b6c18be6bfee8fc94d0adf52 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1080 perma-cache HIT cdn-storageserver DE-676 cdn-cachedat 10/06/2023 17:45:32 cdn-pullzone 293267 last-modified Mon, 18 Sep 2023 16:47:35 GMT server BunnyCDN-DE1-1080 cdn-fileserver 383 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"65087f27-51f" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 782db6a7bd2198d155311911441e5c97 cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	1.ea963399.min.js Show response a.omappapi.com/app/js/	11 KB 3 KB	12ms 10ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/1.ea963399.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash 6507a044d207a767ec2971e891b149b58d6d32a6ee1b18068a6d6dd36bc5fa9a Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1080 perma-cache HIT cdn-storageserver DE-664 cdn-cachedat 10/06/2023 17:45:31 cdn-pullzone 293267 last-modified Mon, 18 Sep 2023 16:47:50 GMT server BunnyCDN-DE1-1080 cdn-fileserver 587 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"65087f36-2abc" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 3b2c2437c7c2188ca3fd1b7557f1e0f2 cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	21.5aa698b1.min.js Show response a.omappapi.com/app/js/	2 KB 2 KB	13ms 12ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/21.5aa698b1.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash 5c756ba00bc22ff5690e08fc74aa2c70cde9b692a4acb7ca813a9dc7168c27d5 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1082 perma-cache HIT cdn-storageserver DE-167 cdn-cachedat 10/06/2023 17:45:32 cdn-pullzone 293267 last-modified Mon, 18 Sep 2023 16:47:35 GMT server BunnyCDN-DE1-1080 cdn-fileserver 599 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"65087f27-81f" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 9cb90511439f93d4980ffca1360b78bd cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	22.9757d45d.min.js Show response a.omappapi.com/app/js/	1 KB 1 KB	13ms 12ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/22.9757d45d.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash eef6905a10fc006637486692b9f493a373aabd7ec439fa81a99204ee389b2716 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1082 perma-cache HIT cdn-storageserver DE-679 cdn-cachedat 10/06/2023 17:45:33 cdn-pullzone 293267 last-modified Mon, 18 Sep 2023 16:48:13 GMT server BunnyCDN-DE1-1080 cdn-fileserver 587 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"65087f4d-5a1" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 71db03f193414ed15efa444d977c0c96 cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	18.ca86437f.min.js Show response a.omappapi.com/app/js/	2 KB 2 KB	13ms 13ms	Script application/javascript	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/js/18.ca86437f.min.js Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash 220b328b851303eea8cf0c0bff31365783e87438e803e6d02bec6a5e0492f907 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1082 perma-cache HIT cdn-storageserver DE-663 cdn-cachedat 10/06/2023 17:45:34 cdn-pullzone 293267 last-modified Mon, 18 Sep 2023 16:47:50 GMT server BunnyCDN-DE1-1080 cdn-fileserver 588 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"65087f36-7a4" vary Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid 1689631cfa19c3b6a13c13f8fd855b54 cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H/1.1	200 OK	nextroll-32x32.png s.adroll.com/i/favicon/	2 KB 2 KB	11ms 11ms	Image image/png	2600:9000:225e:f600:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://s.adroll.com/i/favicon/nextroll-32x32.png Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225e:f600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers X-Amz-Version-Id eTpwxbAIDHDUN.4tfrROIgU_pzKN9Xh0 Date Fri, 06 Oct 2023 23:11:04 GMT Via 1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront) Age 23170 X-Amz-Cf-Pop FRA60-P4 X-Amz-Server-Side-Encryption AES256 X-Cache Hit from cloudfront Connection keep-alive Content-Length 1615 Last-Modified Mon, 28 Jun 2021 18:19:21 GMT Server AmazonS3 Etag "403a0a7dcf2d617e7ea852bfb9d11945" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type image/png Access-Control-Allow-Origin * Access-Control-Max-Age 600 Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers * X-Amz-Cf-Id ZKYMXc9mmNpq-F8Zvpb9NlbxzbszBIoBIdk4f_8GZruLrtVpHmwWKw==
GET H2	200	css2 fonts.googleapis.com/	3 KB 1 KB	40ms 17ms	Stylesheet text/css	2a00:1450:4001:801::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Open+Sans%3Aital%2Cwght%400%2C400&display=swap Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/4.62cc77b7.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash fa1af1cbf201b91b7b02cc4531ded17078f035ca5daec87e9767ca7edb4b3328 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Sat, 07 Oct 2023 05:35:17 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Sat, 07 Oct 2023 05:13:35 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Sat, 07 Oct 2023 05:35:17 GMT
GET H2	200	destinations.min.js Show response x.clearbitjs.com/v2/pk_43e7489448ea26212d2c648f4818c8b5/	0 21 B	254ms 199ms	Script application/javascript	3.127.196.46 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_43e7489448ea26212d2c648f4818c8b5/destinations.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_43e7489448ea26212d2c648f4818c8b5/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.196.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-196-46.eu-central-1.compute.amazonaws.com Software envoy / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-envoy-response-flags - server envoy content-type application/javascript;charset=utf-8 cache-control private, max-age=600 content-length 0
GET H2	200	tracking.min.js Show response x.clearbitjs.com/v2/pk_43e7489448ea26212d2c648f4818c8b5/	168 KB 45 KB	232ms 177ms	Script application/javascript	3.127.196.46 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_43e7489448ea26212d2c648f4818c8b5/tracking.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_43e7489448ea26212d2c648f4818c8b5/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.196.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-196-46.eu-central-1.compute.amazonaws.com Software envoy / Resource Hash e5f578c050d7a40cfb1cdbc4482159b5177deb5a5cf606cc28cd4a2b42a97734 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding gzip x-content-type-options nosniff x-envoy-response-flags - server envoy strict-transport-security max-age=63072000; includeSubDomains; preload vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control private, max-age=600
POST H/1.1	204 No Content	collect Show response o.clarity.ms/	0 289 B	311ms 98ms	XHR text/plain	52.152.143.207 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://o.clarity.ms/collect Requested by Host: www.clarity.ms URL: https://www.clarity.ms/s/0.7.12/clarity.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.152.143.207 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/x-clarity-gzip Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Access-Control-Allow-Origin https://cyble.com Date Sat, 07 Oct 2023 05:35:17 GMT Access-Control-Allow-Credentials true Server nginx/1.18.0 (Ubuntu) Connection keep-alive Vary Origin Request-Context appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.wp.com/s/opensans/v36/	47 KB 47 KB	20ms 20ms	Font font/woff2	192.0.77.32 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://fonts.wp.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts-api.wp.com URL: https://fonts-api.wp.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.3.1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS wordpress.com Software nginx / Resource Hash 9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts-api.wp.com/ Origin https://cyble.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers x-nc HIT hhn 1 date Sat, 07 Oct 2023 05:35:17 GMT x-content-type-options nosniff last-modified Thu, 14 Sep 2023 00:40:31 GMT server nginx age 1866 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * content-length 48432 x-xss-protection 0
GET H2	200	memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2 fonts.gstatic.com/s/opensans/v36/	18 KB 19 KB	51ms 9ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v36/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Open+Sans%3Aital%2Cwght%400%2C400&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 441e23601fe7525a142857c98cbb2784997579d51a17f736d7964dceee609709 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://cyble.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 18:18:21 GMT x-content-type-options nosniff age 127016 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 18664 x-xss-protection 0 last-modified Thu, 14 Sep 2023 01:36:18 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 04 Oct 2024 18:18:21 GMT
GET H/1.1	200 OK	counters.gif perf-na1.hsforms.com/embed/v3/	35 B 1 KB	167ms 127ms	Image image/gif	2606:4700::6812:c07d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:c07d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Date Sat, 07 Oct 2023 05:35:17 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff CF-Cache-Status MISS x-evy-trace-route-service-name envoyset-translator X-HubSpot-Correlation-Id 185820ab-9d18-464f-a49f-a5ffdf315471 x-envoy-upstream-service-time 6 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 185820ab-9d18-464f-a49f-a5ffdf315471 Last-Modified Sat, 07 Oct 2023 05:35:17 GMT Server cloudflare X-Trace 2B023824FA862461CF891BB732BFCB611BDE098362000000000000000000 Vary origin, Accept-Encoding Content-Type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-79986f96f-swd7n Access-Control-Expose-Headers X-Origin-Hublet Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials false Accept-Ranges bytes X-Robots-Tag none CF-RAY 8123c7a69d6c3667-FRA
GET H2	200	352e1ccc86314306abca41808258c8ff Show response app.hubspot.com/conversations-visitor/21289959/threads/utk/ Frame 3613	53 KB 20 KB	222ms 180ms	Document text/html	2606:4700::6813:9b53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.hubspot.com/conversations-visitor/21289959/threads/utk/352e1ccc86314306abca41808258c8ff?uuid=422e19ef24b3493288d9d958e317fc1a&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cyble.com&inApp53=false&messagesUtk=352e1ccc86314306abca41808258c8ff&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=true&isInitialInputFocusDisabled=false&enableWidgetCookieBanner=false&isInCMS=false Requested by Host: js.usemessages.com URL: https://js.usemessages.com/conversations-embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ee8991bb2d51e68d466823517d0374ac41b3656a12a4867820c03a7897aa9483 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options no-sniff Request headers Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials false age 1140 cache-control max-age=600 cache-tag staticjsapp-conversations-visitor-ui-web-prod,staticjsapp-prod cf-cache-status DYNAMIC cf-ray 8123c7a70f2f9b39-FRA content-encoding br content-security-policy-report-only script-src 'self' www.hubspot.com *.hsappstatic.net *.hs-analytics.net *.hs-banner.com *.hsforms.net *.hsleadflows.net *.hs-scripts.com *.hubspotfeedback.com *.usemessages.com js.hubspot.com *.hsadspixel.net *.hscollectedforms.net js-agent.newrelic.com bam.nr-data.net bam-cell.nr-data.net *.google-analytics.com www.googletagmanager.com data: 'unsafe-inline' 'unsafe-eval' blob: connect.facebook.net www.gstatic.cn www.gstatic.com www.google.com www.recaptcha.net *.fullstory.com fullstory.com apis.google.com snap.licdn.com; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-visitor-ui/static-1.16813/html/index.html&cfRay=8123c7a70f2f9b39&reqUrl=https%3A%2F%2Fapp.hubspot.com%2Fconversations-visitor%2F21289959%2Fthreads%2Futk%2F352e1ccc86314306abca41808258c8ff%3Fuuid%3D422e19ef24b3493288d9d958e317fc1a%26mobile%3Dfalse%26mobileSafari%3Dfalse%26hideWelcomeMessage%3Dfalse%26hstc%3Dnull%26domain%3Dcyble.com%26inApp53%3Dfalse%26messagesUtk%3D352e1ccc86314306abca41808258c8ff%26url%3Dhttps%253A%252F%252Fcyble.com%252Fblog%252Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%252F%26inline%3Dfalse%26isFullscreen%3Dfalse%26globalCookieOptOut%3Dnull%26isFirstVisitorSession%3Dtrue%26isAttachmentDisabled%3Dtrue%26isInitialInputFocusDisabled%3Dfalse%26enableWidgetCookieBanner%3Dfalse%26isInCMS%3Dfalse&referrer=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&cfenv=prod&pdt=2023-10-07&csp=ro content-type text/html; charset=utf-8 date Sat, 07 Oct 2023 05:35:17 GMT etag W/"f444163e017c1e7882b788e56649514f" last-modified Thu, 05 Oct 2023 02:05:19 UTC report-to {"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]} reporting-endpoints default="https://send.hsbrowserreports.com/csp/reports?cfRay=8123c7a70f2f9b39&resource=conversations-visitor-ui/static-1.16813/html/index.html" server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary origin, Accept-Encoding via 1.1 d0d53eedec01ac540f737b5fafb16436.cloudfront.net (CloudFront) x-amz-cf-id vcG3sIY41IgAPbO9IOp-y_09oniCZ9DOf28y05oOaZau9pPW7XZNlg== x-amz-cf-pop IAD12-P3 x-amz-replication-status COMPLETED x-amz-server-side-encryption AES256 x-amz-version-id QkY7G24SufWmvXDp_sHGNTzZWgZBD11A x-cache Hit from cloudfront x-content-type-options no-sniff x-envoy-upstream-service-time 11 x-evy-trace-listener listener_https x-evy-trace-route-configuration listener_https/all x-evy-trace-route-service-name envoyset-translator x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-7c89bb96b9-27cn8 x-evy-trace-virtual-host all x-hs-cache-status MISS x-hs-target-asset conversations-visitor-ui/static-1.16813/html/index.html x-hs-worker-debug-mode false x-hubspot-correlation-id 9742359e-187d-4156-bb39-f73562bcd2c5 x-request-id 9742359e-187d-4156-bb39-f73562bcd2c5
POST H2	200	p Show response app.clearbit.com/v1/	16 B 1 KB	256ms 204ms	XHR application/json	3.127.196.46 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.clearbit.com/v1/p Requested by Host: x.clearbitjs.com URL: https://x.clearbitjs.com/v2/pk_43e7489448ea26212d2c648f4818c8b5/tracking.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.196.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-196-46.eu-central-1.compute.amazonaws.com Software envoy / Resource Hash c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Content-Type text/plain Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding gzip x-content-type-options nosniff x-envoy-response-flags - server envoy strict-transport-security max-age=63072000; includeSubDomains; preload vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS content-type application/json access-control-allow-origin https://cyble.com content-security-policy-report-only default-src 'self'; script-src 'unsafe-inline' 'report-sample' 'self' https://browser.sentry-cdn.com https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js https://cdn.clearbit.com https://cdn.segment.com/analytics.js/v1/auzWlbWIBrAsKnGQIiT0X3IjfZyepgW5/analytics.min.js https://checkout.stripe.com https://connect.facebook.net https://edge.fullstory.com/s/fs.js https://fast.appcues.com https://www.google-analytics.com/analytics.js https://x.clearbitjs.com https://cdn.clearbit.com https://*.commandbar.com; style-src 'unsafe-inline' 'report-sample' 'self' https://cdn.clearbit.com https://*.commandbar.com https://fast.appcues.com https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://api.amplitude.com https://*.commandbar.com https://api.segment.io https://checkout.stripe.com https://rs.fullstory.com https://www.google-analytics.com wss://api.appcues.net https://stats.g.doubleclick.net https://sentry.io https://logo.clearbit.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://*.commandbar.com https://checkout.stripe.com; img-src 'self' https://*.commandbar.com https://*.stripe.com data: https://cdn.clearbit.com https://images.ctfassets.net https://logo.clearbit.com https://www.facebook.com https://connect.facebook.net https://www.google.com https://unpkg.com/react-flag-kit https://cloudfront.net/v1/avatars https://*.googleusercontent.com; manifest-src 'self'; media-src 'self'; worker-src 'none'; access-control-allow-credentials true access-control-allow-headers Authorization, API-Version, Content-Type
POST H/1.1	204 No Content	collect Show response o.clarity.ms/	0 289 B	790ms 377ms	XHR text/plain	52.152.143.207 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://o.clarity.ms/collect Requested by Host: www.clarity.ms URL: https://www.clarity.ms/s/0.7.12/clarity.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.152.143.207 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/x-clarity-gzip Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Access-Control-Allow-Origin https://cyble.com Date Sat, 07 Oct 2023 05:35:18 GMT Access-Control-Allow-Credentials true Server nginx/1.18.0 (Ubuntu) Connection keep-alive Vary Origin Request-Context appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111
GET H2	200	6ad65309edc539a4600440865bf6676d-yesno.json Show response a.omappapi.com/app/campaign-views/b584497dcf5c/r0hediyvvmvme9sqc9m4/	36 KB 10 KB	26ms 10ms	XHR application/json	2400:52e0:1e00::1080:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://a.omappapi.com/app/campaign-views/b584497dcf5c/r0hediyvvmvme9sqc9m4/6ad65309edc539a4600440865bf6676d-yesno.json Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-1080 / Resource Hash 55054ee1484536892852a636c238f8364ce6a89e525f52605d67cb2bfe8f7f5a Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding br cdn-edgestorageid 1080 perma-cache HIT cdn-storageserver DE-661 cdn-cachedat 10/06/2023 18:29:17 cdn-pullzone 293267 last-modified Thu, 10 Aug 2023 07:43:29 GMT server BunnyCDN-DE1-1080 cdn-fileserver 599 cdn-requestpullcode 200 cdn-proxyver 1.04 etag W/"64d49521-91a0" vary Accept-Encoding content-type application/json access-control-allow-origin * cdn-cache HIT cdn-uid efcab737-66db-4b75-ab55-ed485d5a01dd access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid bc09d9aa964c1a665c71eb5b19a083f3 cdn-requestcountrycode DE access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	api.js Show response www.google.com/recaptcha/	1 KB 1 KB	25ms 24ms	Script text/javascript	2a00:1450:4001:810::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js?render=6Ld852MnAAAAAFzgX2FpHqe1Ic4SAQOJBd3NkMga Requested by Host: a.omappapi.com URL: https://a.omappapi.com/app/js/api.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash bf0c59610cf980f4b40893298af62f55f2e6f4bd13b504011bd8c9edd051c0f2 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:17 GMT content-encoding gzip x-content-type-options nosniff content-security-policy frame-ancestors 'self' server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 cache-control private, max-age=300 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 1; mode=block expires Sat, 07 Oct 2023 05:35:17 GMT
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e5f47aaf7eabcee1ce2772f4fd77c75c252c80f9c48e4424e2f08b022aa0fa84 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Content-Type image/png
GET H2	200	bundle.production.js Show response static.hsappstatic.net/head-dlb/static-1.368/ Frame 3613	44 KB 17 KB	59ms 19ms	Script application/javascript	2606:4700::6812:b05d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.hsappstatic.net/head-dlb/static-1.368/bundle.production.js Requested by Host: app.hubspot.com URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/352e1ccc86314306abca41808258c8ff?uuid=422e19ef24b3493288d9d958e317fc1a&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cyble.com&inApp53=false&messagesUtk=352e1ccc86314306abca41808258c8ff&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=true&isInitialInputFocusDisabled=false&enableWidgetCookieBanner=false&isInCMS=false Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:b05d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 15da0333da024365f065c44b1861355fac0211292dd57a0bb5f482ebcd166f4b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://app.hubspot.com/ Origin https://app.hubspot.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:18 GMT x-amz-version-id wWLMJ6qW0lXJfco2m026CzodYMop32jV via 1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront) cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA56-P2 age 295401 x-amz-server-side-encryption AES256 content-encoding br x-cache Hit from cloudfront x-amz-replication-status COMPLETED server-timing cfr;desc=8123c7a99f49bbe6-FRA alt-svc h3=":443"; ma=86400 last-modified Tue, 11 Jul 2023 18:31:41 GMT server cloudflare etag W/"63ec2a77119dfb2ddcae56ab3a029230" access-control-max-age 3000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin https://app.hubspot.com report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vk02h%2Bcyk3afUCqhhq0I9L6qKb31gP3zQvxDfyrJDYBdnSm1r6jjPYNnQtRESsp4YW7HsVcgp%2BWxFR8I6%2FCW9zLc5QFJBXh22cFtvdHQAeSQGmaSoWc89QZ4lhd4JSNHiaspcPrAvM%2B3HDgllvPFf9IiUws%3D"}],"group":"cf-nel","max_age":604800} vary Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-credentials true cache-control public, max-age=31536000 timing-allow-origin * cf-ray 8123c7a99f49bbe6-FRA x-amz-cf-id xEaqg5KAtuSyLjMFTa6Zc8RqlRvTY3Ioxy5ezGY5KFcb4l8RfHShCQ== expires Sun, 06 Oct 2024 05:35:18 GMT
GET H2	200	visitor.css static.hsappstatic.net/conversations-visitor-ui/static-1.16739/sass/ Frame 3613	19 KB 4 KB	69ms 30ms	Stylesheet text/css	2606:4700::6812:b05d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.hsappstatic.net/conversations-visitor-ui/static-1.16739/sass/visitor.css Requested by Host: app.hubspot.com URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/352e1ccc86314306abca41808258c8ff?uuid=422e19ef24b3493288d9d958e317fc1a&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cyble.com&inApp53=false&messagesUtk=352e1ccc86314306abca41808258c8ff&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=true&isInitialInputFocusDisabled=false&enableWidgetCookieBanner=false&isInCMS=false Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:b05d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5378554e87e3ca5bf5814c807c57c8b5b03769cb252de7a36523f0ccb3de6417 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://app.hubspot.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:18 GMT x-amz-version-id KvYReuCP2inqlK_SBKZk5q5oqXwYV.Wh via 1.1 5d5481cfa85227a3fdd5ff0b03093c62.cloudfront.net (CloudFront) cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA56-P2 age 404177 x-amz-server-side-encryption AES256 content-encoding br x-cache Hit from cloudfront x-amz-replication-status COMPLETED server-timing cfr;desc=8123c7a99f1e18d4-FRA alt-svc h3=":443"; ma=86400 last-modified Mon, 02 Oct 2023 13:13:59 GMT server cloudflare etag W/"605f1152f9ec93a0118808b7cec5f7e6" vary Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h4Sm3wvb%2FSg3pJ9V0QqZavei4DrFMTTLbPf579pitIDVTKiCyhHC8jl%2F7Rvu5DLI6lTQL3KN%2F6%2FE%2FulY3d0aGxp%2FBTzI%2B3SnjGiIeiSo%2B4H%2FWgW9OCbHGxez9ZIwg2OTkOCRjgdfZuhAHnRmoqdTZn4tJmw%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control public, max-age=31536000 timing-allow-origin * cf-ray 8123c7a99f1e18d4-FRA x-amz-cf-id 9CAdgi0HnbQg1Lh24KSVaNjPw4J_imrVnHmkXKLeUeB3H4toata6LA== expires Sun, 06 Oct 2024 05:35:18 GMT
GET H2	200	bundle.production.js Show response static.hsappstatic.net/hubspot-dlb/static-1.438/ Frame 3613	295 KB 94 KB	58ms 19ms	Script application/javascript	2606:4700::6812:b05d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.hsappstatic.net/hubspot-dlb/static-1.438/bundle.production.js Requested by Host: app.hubspot.com URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/352e1ccc86314306abca41808258c8ff?uuid=422e19ef24b3493288d9d958e317fc1a&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cyble.com&inApp53=false&messagesUtk=352e1ccc86314306abca41808258c8ff&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=true&isInitialInputFocusDisabled=false&enableWidgetCookieBanner=false&isInCMS=false Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:b05d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash abb67ec9baf00b771641b3e783f5511c58621d346ee890fe8b82139b9d7c1005 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://app.hubspot.com/ Origin https://app.hubspot.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:18 GMT x-amz-version-id QR.7BVVxWRX648zgagdsk0.3qbRZHX6u via 1.1 f4137273db9ae377298b8f8daf5b93f0.cloudfront.net (CloudFront) cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop FRA56-P2 age 1417556 x-amz-server-side-encryption AES256 content-encoding br x-cache Hit from cloudfront x-amz-replication-status COMPLETED server-timing cfr;desc=8123c7a99f4cbbe6-FRA alt-svc h3=":443"; ma=86400 last-modified Tue, 25 Jul 2023 10:27:02 GMT server cloudflare etag W/"e1432fc848986a403838f2466a71736c" access-control-max-age 3000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin https://app.hubspot.com report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BsxDns%2Fg1bR7dE8cMnHo9XzqOvs19KAOiwYzV7QAb4yVRGfBaRwoSDFODoDWS1LuRJDc5y89t5hHnNCPrprszg4JbLYpXz9a4j92WA7k1kKFdeuDfx2w5T3XASI3JeFrq5EsdEJdu%2Fw75kHOyaE6BxO%2By8U%3D"}],"group":"cf-nel","max_age":604800} vary Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-credentials true cache-control public, max-age=31536000 timing-allow-origin * cf-ray 8123c7a99f4cbbe6-FRA x-amz-cf-id Q-DIeGOBFXSEer0tuh-bv2-2K52mWV0P8tHuGYmcGiHFoB1ebL4nCg== expires Sun, 06 Oct 2024 05:35:18 GMT
GET H2	200	visitor.js Show response static.hsappstatic.net/conversations-visitor-ui/static-1.16813/bundles/ Frame 3613	639 KB 190 KB	62ms 23ms	Script application/javascript	2606:4700::6812:b05d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.hsappstatic.net/conversations-visitor-ui/static-1.16813/bundles/visitor.js Requested by Host: app.hubspot.com URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/352e1ccc86314306abca41808258c8ff?uuid=422e19ef24b3493288d9d958e317fc1a&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cyble.com&inApp53=false&messagesUtk=352e1ccc86314306abca41808258c8ff&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=true&isInitialInputFocusDisabled=false&enableWidgetCookieBanner=false&isInCMS=false Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:b05d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44f9885f24781199f83cfab795c900cc61a86dde56ee807f3578ed4e110a3acf Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://app.hubspot.com/ Origin https://app.hubspot.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:18 GMT x-amz-version-id QnuSHabyjcF5bQTG4JPayAhgMBUMj1LK via 1.1 0d3372129d548b57c62777e24b79e514.cloudfront.net (CloudFront) cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop AMS58-P5 age 142190 x-amz-server-side-encryption AES256 content-encoding br x-cache Hit from cloudfront x-amz-replication-status COMPLETED server-timing cfr;desc=8123c7a99f4dbbe6-FRA alt-svc h3=":443"; ma=86400 last-modified Thu, 05 Oct 2023 10:58:15 GMT server cloudflare etag W/"2446d6e8264c6bca36e98d096f39b6a7" access-control-max-age 3000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin https://app.hubspot.com report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CWVdYdpP9trxXQf0fazPrjHKs6Vgzc9XN%2BrkWReQbL0Jsq9H0BR3lXNHmlLRFFKHpRta4s57ejmvAvNrA1k3Cs31xntllPY0L4vtqcm89jiwkM%2F7XqJi7ehe0mz%2FTH1zjtWRKT8qfxP5K2ZreIzH5kwOr2Q%3D"}],"group":"cf-nel","max_age":604800} vary Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-credentials true cache-control public, max-age=31536000 timing-allow-origin * cf-ray 8123c7a99f4dbbe6-FRA x-amz-cf-id ws4aXL1xuhTW_ONsiS8facW05EaO8R6pFFzt2mqdJqiGEfUbUCvg3w== expires Sun, 06 Oct 2024 05:35:18 GMT
GET H2	200	recaptcha__de.js Show response www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/	466 KB 187 KB	31ms 7ms	Script text/javascript	2a00:1450:4001:827::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js?render=6Ld852MnAAAAAFzgX2FpHqe1Ic4SAQOJBd3NkMga Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e57ecbca07885a20fc56dbae51642fe0e95b58c96dba6ea1c5cbb15417b9a0df Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Origin https://cyble.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Fri, 06 Oct 2023 06:36:34 GMT content-encoding gzip x-content-type-options nosniff age 82724 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 190978 x-xss-protection 0 last-modified Mon, 02 Oct 2023 04:05:03 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Sat, 05 Oct 2024 06:36:34 GMT
GET H2	200	i18n-data-data-locales-en-us.js Show response static.hsappstatic.net/conversations-visitor-ui/static-1.16718/ Frame 3613	776 B 1 KB	17ms 16ms	Script application/javascript	2606:4700::6812:b05d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.hsappstatic.net/conversations-visitor-ui/static-1.16718/i18n-data-data-locales-en-us.js Requested by Host: static.hsappstatic.net URL: https://static.hsappstatic.net/conversations-visitor-ui/static-1.16813/bundles/visitor.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:b05d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2ad8c6b622ccdbde3d288a83c36673b0a56bec168ae53a79f14041f2a7f6e663 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://app.hubspot.com/ Origin https://app.hubspot.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:18 GMT x-amz-version-id aadNUcaz4d.P8zmjGD5JBZ75HBEgQACL via 1.1 b361826db8fe26bb15e77b0e0bcfb382.cloudfront.net (CloudFront) cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop VIE50-P2 age 384263 x-amz-server-side-encryption AES256 content-encoding br x-cache Hit from cloudfront x-amz-replication-status COMPLETED server-timing cfr;desc=8123c7aa780ebbe6-FRA alt-svc h3=":443"; ma=86400 last-modified Thu, 28 Sep 2023 18:31:43 GMT server cloudflare etag W/"8d32d8aec067cf3d9de8ed8ebba41cba" access-control-max-age 3000 access-control-allow-methods GET content-type application/javascript access-control-allow-origin https://app.hubspot.com report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=avaTmpb%2FoIzqnWAzGANpz81igzYJuVuzWjf79V2gZOdEGPPg9J8QSZXKkaym2xpywNpYVYiddJCfG%2Bd10MEqOaZkv5RZnYsjuQJI2tUd9X6t0itn5cFVj8fsWu7ghhOCdgIMwy2guPKLJYGYTv73kESOtlU%3D"}],"group":"cf-nel","max_age":604800} vary Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-credentials true cache-control public, max-age=31536000 timing-allow-origin * cf-ray 8123c7aa780ebbe6-FRA x-amz-cf-id yu51vwiy6NhQlouWwZ5Mw3ZwU9TEzSi9ifoHnGK29lPKvow4IA4g_g== expires Sun, 06 Oct 2024 05:35:18 GMT
GET H3	200	anchor Show response www.google.com/recaptcha/api2/ Frame 841D	57 KB 32 KB	39ms 32ms	Document text/html	2a00:1450:4001:810::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld852MnAAAAAFzgX2FpHqe1Ic4SAQOJBd3NkMga&co=aHR0cHM6Ly9jeWJsZS5jb206NDQz&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=invisible&cb=8wjt3bs6cx Requested by Host: www.gstatic.com URL: https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash 9798bf11cc001943c44a98464dbe4118a22a51ec6bb32be5e7fb0328ac8dd250 Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-04o4w7syFwY9ATM4WpYe6w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding gzip content-security-policy script-src 'report-sample' 'nonce-04o4w7syFwY9ATM4WpYe6w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-type text/html; charset=utf-8 cross-origin-embedder-policy require-corp cross-origin-resource-policy cross-origin date Sat, 07 Oct 2023 05:35:18 GMT expires Mon, 01 Jan 1990 00:00:00 GMT pragma no-cache report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} server GSE x-content-type-options nosniff x-xss-protection 1; mode=block
GET H3	200	styles__ltr.css www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/ Frame 841D	55 KB 24 KB	27ms 8ms	Stylesheet text/css	2a00:1450:4001:827::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/styles__ltr.css Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld852MnAAAAAFzgX2FpHqe1Ic4SAQOJBd3NkMga&co=aHR0cHM6Ly9jeWJsZS5jb206NDQz&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=invisible&cb=8wjt3bs6cx Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 02:07:21 GMT content-encoding gzip x-content-type-options nosniff age 12477 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 24606 x-xss-protection 0 last-modified Mon, 02 Oct 2023 04:05:03 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/css cache-control public, max-age=31536000 accept-ranges bytes expires Sun, 06 Oct 2024 02:07:21 GMT
GET H3	200	recaptcha__de.js Show response www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/ Frame 841D	466 KB 187 KB	33ms 14ms	Script text/javascript	2a00:1450:4001:827::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__de.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld852MnAAAAAFzgX2FpHqe1Ic4SAQOJBd3NkMga&co=aHR0cHM6Ly9jeWJsZS5jb206NDQz&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=invisible&cb=8wjt3bs6cx Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e57ecbca07885a20fc56dbae51642fe0e95b58c96dba6ea1c5cbb15417b9a0df Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Fri, 06 Oct 2023 06:36:34 GMT content-encoding gzip x-content-type-options nosniff age 82724 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 190978 x-xss-protection 0 last-modified Mon, 02 Oct 2023 04:05:03 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Sat, 05 Oct 2024 06:36:34 GMT
GET H2	200	hawk.png labs.cyble.com/hs-fs/hubfs/ Frame 3613	4 KB 5 KB	101ms 38ms	Image image/webp	2606:2c40::c73c:671e CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://labs.cyble.com/hs-fs/hubfs/hawk.png?width=108&height=108 Requested by Host: cyble.com URL: https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:2c40::c73c:671e , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 079ceaa0981ce7f89ad67f2b125a26b02d93a4b400b0d01c1095d9d03b24c738 Security Headers Name Value Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://app.hubspot.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:18 GMT strict-transport-security max-age=31536000 via 1.1 e6ef76f348359a0bc64c007ab009ebd2.cloudfront.net (CloudFront) cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-content-type-options nosniff content-security-policy default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests cache-tag F-83412232556,P-21289959,FLS-ALL x-hs-https-only worker alt-svc h3=":443"; ma=86400 content-length 4194 cf-resized internal=ok/m q=0 n=895+0 c=55+45 v=2023.9.8 l=4194 last-modified Tue, 30 Aug 2022 08:53:18 GMT cf-bgj imgq:86,h2pri server cloudflare etag "cfLv25S9_RZ9mVF-YFCFUfZcZkUn9Bg2vL7Sxl6y2PDQ:ac94ce2bd2684e2d18ebb6c3988701dd" vary Accept, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3DrUIfNtPKxkp5OzMtV3l%2FTvMMiafSTOKYG3pTSK2XN2Bx4mJU690eIF2eNRUSIw55kCiCto98GJBIyc1ZPHb9nynGLHny%2FJqFlDRZuVyiMJs3f%2B%2FG5SC3FeoNea6l4LOOntvtxJFoQ4lK1Y"}],"group":"cf-nel","max_age":604800} content-type image/webp access-control-allow-origin * cache-control s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 accept-ranges bytes cf-ray 8123c7ac7d0bbbf2-FRA
POST H2	204	rhumb app.hubspot.com/api/cartographer/v1/ Frame 3613	0 1 KB	160ms 160ms	Ping text/plain	2606:4700::6813:9b53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.hubspot.com/api/cartographer/v1/rhumb?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.16813 Requested by Host: static.hsappstatic.net URL: https://static.hsappstatic.net/conversations-visitor-ui/static-1.16813/bundles/visitor.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://app.hubspot.com/conversations-visitor/21289959/threads/utk/352e1ccc86314306abca41808258c8ff?uuid=422e19ef24b3493288d9d958e317fc1a&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cyble.com&inApp53=false&messagesUtk=352e1ccc86314306abca41808258c8ff&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=true&isInitialInputFocusDisabled=false&enableWidgetCookieBanner=false&isInCMS=false accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Sat, 07 Oct 2023 05:35:18 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id d0e6f7d2-f4a2-4378-8949-f68445b4fe63 x-envoy-upstream-service-time 28 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id d0e6f7d2-f4a2-4378-8949-f68445b4fe63 server cloudflare vary origin, Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z5Iy5xLVI1XSbNC6TepAMSdMWaxoxgm597gS%2BNb%2FR67F%2F9vAEZ9fTi2n3D0CDary7F6GmBmiaJYVhhLriSc%2Flpswcivr1sJo1yGFUBPkof7wt0XrBZzxH1m53JqZ7B7H6rzCBZF90ir2G%2Fzm%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-origin https://app.hubspot.com x-evy-trace-served-by-pod iad02/hubapi-td/envoy-proxy-5b5c96c966-2mvs8 access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet, X-HubSpot-Auth-Failure access-control-max-age 604800 access-control-allow-credentials true x-evy-trace-virtual-host all cf-ray 8123c7ac1ab89b39-FRA access-control-allow-headers Authorization, Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer timing-allow-origin *
GET H2	200	welcomeMessages Show response app.hubspot.com/api/livechat-public/v1/bots/public/bot/2122156/ Frame 3613	982 B 1 KB	164ms 164ms	XHR application/json	2606:4700::6813:9b53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.hubspot.com/api/livechat-public/v1/bots/public/bot/2122156/welcomeMessages?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.16813&conversations-visitor-ui=static-1.16813&traceId=352e1ccc86314306abca41808258c8ff&sessionId=AMOaWbKQZOl6uDIzuw0T2QWIdtNXuLl6T5Xd5pFE4EvN_RsKUO-_fOurgHdZXgEGrrhXEv_yvq3E1HtDRLIMs8u7H5PWXPHNX-Q4jI5-WVpZjKvsDhd0M6Q5diA6QGAmlFIC4FzS5ZGI7yF3AAtpb29paBB_5sEahsDH-GE0sdWe4Ujn3ILRm4g Requested by Host: static.hsappstatic.net URL: https://static.hsappstatic.net/head-dlb/static-1.368/bundle.production.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5379053ac13fc7ba717296922e4ca5d3c2b9b09d52b2b284f652aca96f47f7a8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://app.hubspot.com/conversations-visitor/21289959/threads/utk/352e1ccc86314306abca41808258c8ff?uuid=422e19ef24b3493288d9d958e317fc1a&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=cyble.com&inApp53=false&messagesUtk=352e1ccc86314306abca41808258c8ff&url=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=true&isInitialInputFocusDisabled=false&enableWidgetCookieBanner=false&isInCMS=false accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:18 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id fe18fe3d-3e25-44dc-8ee1-e27b1fb71a02 content-encoding br x-envoy-upstream-service-time 26 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id fe18fe3d-3e25-44dc-8ee1-e27b1fb71a02 server cloudflare x-trace 2B8DD5472C08C32FDF1949A71172A43D5F20165436000000000000000000 vary origin, Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 x-evy-trace-served-by-pod iad02/hubapi-td/envoy-proxy-5b5c96c966-fvfc4 x-evy-trace-virtual-host all access-control-allow-credentials false report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RDt3cKYZKHxvBw%2FLUlVMKQXFJvXqhyV%2BGKa%2BDnnntdBg4VQBdzdQwfhRR5If6Dw%2FMqQP5Mup8TRcjBDdYqnOec4jGEzcb4lAJMGFZpQRz2T3qJY%2BRuC43lMGuiW5%2BgMoBXgoMIX%2FFy94GSedlA%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8123c7ac1ac09b39-FRA access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
GET H3	200	logo_48.png www.gstatic.com/recaptcha/api2/ Frame 841D	2 KB 2 KB	7ms 7ms	Image image/png	2a00:1450:4001:827::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.gstatic.com/recaptcha/api2/logo_48.png Requested by Host: www.gstatic.com URL: https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/styles__ltr.css Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/styles__ltr.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 15:15:26 GMT x-content-type-options nosniff age 137992 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 2228 x-xss-protection 0 last-modified Tue, 03 Mar 2020 20:15:00 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type image/png cache-control public, max-age=604800 accept-ranges bytes expires Thu, 12 Oct 2023 15:15:26 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v18/ Frame 841D	15 KB 15 KB	8ms 7ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld852MnAAAAAFzgX2FpHqe1Ic4SAQOJBd3NkMga&co=aHR0cHM6Ly9jeWJsZS5jb206NDQz&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=invisible&cb=8wjt3bs6cx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.google.com/ Origin https://www.google.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 30 Sep 2023 06:47:09 GMT x-content-type-options nosniff age 600489 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15344 x-xss-protection 0 last-modified Mon, 16 Oct 2017 17:32:55 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 29 Sep 2024 06:47:09 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v18/ Frame 841D	15 KB 15 KB	10ms 10ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld852MnAAAAAFzgX2FpHqe1Ic4SAQOJBd3NkMga&co=aHR0cHM6Ly9jeWJsZS5jb206NDQz&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=invisible&cb=8wjt3bs6cx Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.google.com/ Origin https://www.google.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Thu, 05 Oct 2023 21:26:35 GMT x-content-type-options nosniff age 115723 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15552 x-xss-protection 0 last-modified Mon, 16 Oct 2017 17:33:02 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 04 Oct 2024 21:26:35 GMT
GET H3	200	webworker.js www.google.com/recaptcha/api2/ Frame 841D	102 B 135 B	19ms 19ms	Other text/javascript	2a00:1450:4001:810::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=lLirU0na9roYU3wDDisGJEVT Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld852MnAAAAAFzgX2FpHqe1Ic4SAQOJBd3NkMga&co=aHR0cHM6Ly9jeWJsZS5jb206NDQz&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=invisible&cb=8wjt3bs6cx Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash fc8116624ca13ea4125db423b0f4bf7cd676ec017003da5be04f40b83e1b2cb6 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld852MnAAAAAFzgX2FpHqe1Ic4SAQOJBd3NkMga&co=aHR0cHM6Ly9jeWJsZS5jb206NDQz&hl=de&v=lLirU0na9roYU3wDDisGJEVT&size=invisible&cb=8wjt3bs6cx User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:18 GMT content-encoding gzip x-content-type-options nosniff content-security-policy frame-ancestors 'self' server GSE cross-origin-embedder-policy require-corp x-frame-options SAMEORIGIN report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript; charset=UTF-8 cache-control private, max-age=300 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 1; mode=block expires Sat, 07 Oct 2023 05:35:18 GMT
GET H2	200	c.gif c.clarity.ms/ Redirect Chain https://c.clarity.ms/c.gif https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=6F746E70C2DD47198DE6BC08755EFE25&RedC=c.clarity.ms&MXFR=0B7A8543662261D214F196E062226FA8 https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=6F746E70C2DD47198DE6BC08755EFE25&MUID=066B6FFBECE0621A1F9F7C58ED6B6369	42 B 445 B	32ms 31ms	Image image/gif	68.219.88.97 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=6F746E70C2DD47198DE6BC08755EFE25&MUID=066B6FFBECE0621A1F9F7C58ED6B6369 Protocol H2 Server 68.219.88.97 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers pragma no-cache date Sat, 07 Oct 2023 05:35:18 GMT last-modified Wed, 30 Aug 2023 19:01:41 GMT server Microsoft-IIS/10.0 etag "8d59566974dbd91:0" x-powered-by ASP.NET content-type image/gif p3p CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" cache-control private, no-cache, proxy-revalidate, no-store accept-ranges bytes content-length 42 Redirect headers pragma no-cache date Sat, 07 Oct 2023 05:35:18 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: E56775DF3D704B8183FC62FE30E8279D Ref B: FRA31EDGE0607 Ref C: 2023-10-07T05:35:18Z x-powered-by ASP.NET x-cache CONFIG_NOCACHE p3p CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" location https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=6F746E70C2DD47198DE6BC08755EFE25&MUID=066B6FFBECE0621A1F9F7C58ED6B6369 cache-control private, no-cache, proxy-revalidate, no-store content-length 0
GET H2	200	__ptq.gif track.hubspot.com/	45 B 483 B	143ms 142ms	Image image/gif	2606:4700::6813:9b53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3335903367&v=1.1&a=21289959&ct=blog-post&rcu=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&pu=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&t=WinRAR+Vulnerability+Puts+Illicit+Content+Consumers+at+Risk+of+Apanyan+Stealer%2C+Murk-Stealer+%26+AsyncRAT+%E2%80%94+Cyble&cts=1696656918556&vi=4d9bf7258979c93bb1789dd94caf3a04&nc=true&u=27441379.4d9bf7258979c93bb1789dd94caf3a04.1696656918552.1696656918552.1696656918552.1&b=27441379.1.1696656918553&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:18 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 72ca8aeb-bedf-409d-85ae-4f83d166eba9 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 12 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 72ca8aeb-bedf-409d-85ae-4f83d166eba9 server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3n7l88l2HK902vei8rGjbRVuJnMN5CPs%2BshWcli5s8puJoZA1jnbCijmfgTSkuoeuLelkh1D5gpLZyxOZfEmhAv46fdeJLFX%2FiTGnJXJLxLiaaLOV0fMQWARdNRmGwAs5iOlb6cEoYYJ7AUMZmhk"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-674b9fb979-p49q2 x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 8123c7ad0b599b39-FRA x-robots-tag none
GET H2	200	__ptq.gif track.hubspot.com/	45 B 658 B	131ms 131ms	Image image/gif	2606:4700::6813:9b53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=15&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=b7e1e634-93b7-4978-b23c-f7a823a89448&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3335903367&v=1.1&a=21289959&ct=blog-post&rcu=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&pu=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&t=WinRAR+Vulnerability+Puts+Illicit+Content+Consumers+at+Risk+of+Apanyan+Stealer%2C+Murk-Stealer+%26+AsyncRAT+%E2%80%94+Cyble&cts=1696656918558&vi=4d9bf7258979c93bb1789dd94caf3a04&nc=true&u=27441379.4d9bf7258979c93bb1789dd94caf3a04.1696656918552.1696656918552.1696656918552.1&b=27441379.1.1696656918553&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:18 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 10e286f4-003a-401d-bf3a-9ff5d9708ec3 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 4 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 10e286f4-003a-401d-bf3a-9ff5d9708ec3 server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Nre0NFgWj8UprGln%2Bx7dN6hYFJz9oepsHSLj047mwnCI%2BWKW%2ByaDWGu1q%2B3kyMvVB28OQ%2BoEiHXEc1k0vOFtQCvzRiyS3nKAzKVIEVX%2BT2A12CPJrFuxGtK%2Bq2rWtAKthWjNbs%2F17e0ftKmkTvzA"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-674b9fb979-p49q2 x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 8123c7ad0b5d9b39-FRA x-robots-tag none
GET H2	200	json Show response forms.hubspot.com/lead-flows-config/v1/config/	178 B 845 B	162ms 150ms	XHR application/json	2606:4700::6813:9a53 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=21289959&utk=4d9bf7258979c93bb1789dd94caf3a04&__hstc=27441379.4d9bf7258979c93bb1789dd94caf3a04.1696656918552.1696656918552.1696656918552.1&__hssc=27441379.1.1696656918553&currentUrl=https%3A%2F%2Fcyble.com%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F Requested by Host: js.hsleadflows.net URL: https://js.hsleadflows.net/leadflows.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 249057618625fe6716c63fc857b8bee741dcaca9e18a7efa7e26107069a84df9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers date Sat, 07 Oct 2023 05:35:18 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id c7908bb7-7f82-4ce2-b0f2-4403f9efd39d content-encoding br x-envoy-upstream-service-time 32 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id c7908bb7-7f82-4ce2-b0f2-4403f9efd39d server cloudflare vary origin access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://cyble.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials false cache-control max-age=0, no-cache, no-store report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fMmLPgRZIN9wX%2FgLXlCSXrG%2F%2BOOx3MV77BtbSXsk2Qh%2BLumtiGg0XLLfBVVvrUBsoNl1F6QmK5gzDse%2B0ORCeCY00pvOCHomZEvX3C99PH1zofCGaPV9vaNcVdqLbaIsUZxRUI3S6Xkl4r4p883H"}],"group":"cf-nel","max_age":604800} x-robots-tag none access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent cf-ray 8123c7ad689d6955-FRA x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-79986f96f-t2vvv
POST H/1.1	204 No Content	collect Show response o.clarity.ms/	0 289 B	186ms 185ms	XHR text/plain	52.152.143.207 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://o.clarity.ms/collect Requested by Host: www.clarity.ms URL: https://www.clarity.ms/s/0.7.12/clarity.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.152.143.207 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx/1.18.0 (Ubuntu) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/x-clarity-gzip Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers Access-Control-Allow-Origin https://cyble.com Date Sat, 07 Oct 2023 05:35:19 GMT Access-Control-Allow-Credentials true Server nginx/1.18.0 (Ubuntu) Connection keep-alive Vary Origin Request-Context appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111
GET H2	204	boom.gif pixel.wp.com/	0 37 B	7ms 6ms	Image text/plain	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.wp.com/boom.gif?bilmur=1&cumulative_layout_shift=0.009&largest_contentful_paint=1707&batcache_hit=0&provider=wordpress.com&service=atomic&custom_properties=%7B%22devicepx%22%3A%220%22%7D&effective_connection_type=4g&rtt=0&downlink=10000&host_name=cyble.com&url_path=%2Fblog%2Fwinrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat%2F&nt_fetchStart=0&nt_domainLookupStart=1&nt_domainLookupEnd=35&nt_connectStart=35&nt_connectEnd=58&nt_secureConnectionStart=41&nt_requestStart=58&nt_responseStart=1436&nt_responseEnd=1453&nt_domLoading=1438&nt_domInteractive=1991&nt_domContentLoadedEventStart=1993&nt_domContentLoadedEventEnd=2007&nt_domComplete=3444&nt_loadEventStart=3444&nt_loadEventEnd=3485&nt_redirectCount=0&nt_nextHopProtocol=h2&nt_api_level=2&start_render=1622&first_contentful_paint=1622&resource_size=3722626&resource_transferred=1260715&js_size=1074572&js_transferred=331170&resource_cache_percent=0&js_cache_percent=0&last_resource_end=4864 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36 Response headers access-control-allow-origin * date Sat, 07 Oct 2023 05:35:22 GMT cache-control no-cache server nginx