hotforsecurity.bitdefender.com Open in urlscan Pro
2606:4700::6812:a9de Public Scan

Go To Rescan
Add Verdict Report

URL:
https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Submission: On September 18 via api (September 18th 2020, 2:54:15 am UTC) from FR

Summary HTTP 73 Redirects Links 31 Behaviour Indicators

Summary

This website contacted 22 IPs in 7 countries across 17 domains to perform 73 HTTP transactions. The main IP is 2606:4700::6812:a9de, located in United States and belongs to CLOUDFLARENET, US. The main domain is hotforsecurity.bitdefender.com.
TLS certificate: Issued by Thawte RSA CA 2018 on October 23rd 2019. Valid for: a year.

This is the only time hotforsecurity.bitdefender.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
39	2606:4700::68... 2606:4700::6812:a9de	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:819::200a	15169 (GOOGLE) (GOOGLE)
5	2a02:26f0:6c0... 2a02:26f0:6c00:28a::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 4	52.209.239.68 52.209.239.68	16509 (AMAZON-02) (AMAZON-02)
1	99.84.144.124 99.84.144.124	16509 (AMAZON-02) (AMAZON-02)
2	99.84.144.62 99.84.144.62	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:1901:0:2... 2600:1901:0:2470::	15169 (GOOGLE) (GOOGLE)
1	35.201.112.186 35.201.112.186	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:821::200e	15169 (GOOGLE) (GOOGLE)
1	192.229.220.142 192.229.220.142	15133 (EDGECAST) (EDGECAST)
2	2a00:1450:400... 2a00:1450:4001:81d::2003	15169 (GOOGLE) (GOOGLE)
2	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a02:26f0:6c0... 2a02:26f0:6c00:296::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	15.236.9.100 15.236.9.100	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
1	54.76.99.142 54.76.99.142	16509 (AMAZON-02) (AMAZON-02)
1 2	2a05:f500:10:... 2a05:f500:10:101::b93f:9105	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	147.75.84.91 147.75.84.91	54825 (PACKET) (PACKET)
1	2a00:1450:400... 2a00:1450:400c:c0c::9d	15169 (GOOGLE) (GOOGLE)
1	143.204.201.40 143.204.201.40	16509 (AMAZON-02) (AMAZON-02)
1	216.58.212.134 216.58.212.134	15169 (GOOGLE) (GOOGLE)
1	35.186.194.58 35.186.194.58	15169 (GOOGLE) (GOOGLE)
2	147.75.32.125 147.75.32.125	54825 (PACKET) (PACKET)
2 2	52.212.22.61 52.212.22.61	16509 (AMAZON-02) (AMAZON-02)
1 2	143.204.201.2 143.204.201.2	16509 (AMAZON-02) (AMAZON-02)
73	22

39 2606:4700::6812:a9de (United States)

ASN13335 (CLOUDFLARENET, US)

hotforsecurity.bitdefender.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.bitdefender.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:6c00:28a::1e80 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.209.239.68 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-209-239-68.eu-west-1.compute.amazonaws.com

bitdefender.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.84.144.124 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-144-124.txl52.r.cloudfront.net

scripts.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.84.144.62 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-144-62.txl52.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:2470:: (United States) 1 redirects

ASN15169 (GOOGLE, US)

fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.112.186 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 186.112.201.35.bc.googleusercontent.com

edge.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.229.220.142 (United States)

ASN15133 (EDGECAST, US)

download.bitdefender.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00:296::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.236.9.100 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-236-9-100.eu-west-3.compute.amazonaws.com

sstats.bitdefender.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.76.99.142 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-76-99-142.eu-west-1.compute.amazonaws.com

bitdefender.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:10:101::b93f:9105 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.84.91 (Parsippany, United States)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress13

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.201.40 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-201-40.fra53.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.134 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f134.1e100.net

fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.194.58 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 58.194.186.35.bc.googleusercontent.com

rs.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 147.75.32.125 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress4

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.212.22.61 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-212-22-61.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.201.2 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-143-204-201-2.fra53.r.cloudfront.net

segments.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
42	bitdefender.com hotforsecurity.bitdefender.com www.bitdefender.com download.bitdefender.com sstats.bitdefender.com	1 MB
5	adobedtm.com assets.adobedtm.com	116 KB
4	company-target.com 1 redirects api.company-target.com segments.company-target.com	3 KB
4	demdex.net 1 redirects bitdefender.demdex.net dpm.demdex.net	3 KB
3	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com	78 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
3	fullstory.com 1 redirects fullstory.com edge.fullstory.com rs.fullstory.com	61 KB
2	bidr.io 2 redirects match.prod.bidr.io	1019 B
2	doubleclick.net stats.g.doubleclick.net fls.doubleclick.net	817 B
2	licdn.com snap.licdn.com	3 KB
2	gravatar.com secure.gravatar.com	10 KB
2	gstatic.com fonts.gstatic.com	22 KB
2	google-analytics.com www.google-analytics.com	18 KB
2	demandbase.com scripts.demandbase.com tag.demandbase.com	60 KB
1	omtrdc.net bitdefender.tt.omtrdc.net	476 B
1	everesttech.net 1 redirects cm.everesttech.net	554 B
1	googleapis.com fonts.googleapis.com	821 B
73	17

	Domain	Requested by
37	hotforsecurity.bitdefender.com	hotforsecurity.bitdefender.com
5	assets.adobedtm.com	hotforsecurity.bitdefender.com assets.adobedtm.com
3	bitdefender.demdex.net	1 redirects hotforsecurity.bitdefender.com assets.adobedtm.com
2	segments.company-target.com	1 redirects hotforsecurity.bitdefender.com
2	match.prod.bidr.io	2 redirects
2	px.ads.linkedin.com	1 redirects hotforsecurity.bitdefender.com
2	sstats.bitdefender.com	assets.adobedtm.com
2	snap.licdn.com	assets.adobedtm.com snap.licdn.com
2	secure.gravatar.com	hotforsecurity.bitdefender.com
2	fonts.gstatic.com	fonts.googleapis.com
2	www.google-analytics.com	hotforsecurity.bitdefender.com www.google-analytics.com
2	api.company-target.com	assets.adobedtm.com tag.demandbase.com
2	www.bitdefender.com	hotforsecurity.bitdefender.com
1	vars.hotjar.com	static.hotjar.com
1	script.hotjar.com	static.hotjar.com
1	rs.fullstory.com	fullstory.com
1	fls.doubleclick.net	assets.adobedtm.com
1	tag.demandbase.com	assets.adobedtm.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	static.hotjar.com	hotforsecurity.bitdefender.com
1	www.linkedin.com	1 redirects
1	bitdefender.tt.omtrdc.net	assets.adobedtm.com
1	dpm.demdex.net	hotforsecurity.bitdefender.com
1	cm.everesttech.net	1 redirects
1	download.bitdefender.com	hotforsecurity.bitdefender.com
1	edge.fullstory.com	hotforsecurity.bitdefender.com
1	fullstory.com	1 redirects
1	scripts.demandbase.com	assets.adobedtm.com
1	fonts.googleapis.com	hotforsecurity.bitdefender.com
73	29

This site contains links to these domains. Also see Links.

Domain
twitter.com
seravo.com
blog.nintechnet.com
www.wordfence.com
wordpress.org
facebook.com
www.linkedin.com
www.facebook.com
www.twitter.com
feedly.com
www.bitdefender.com

Subject Issuer	Validity	Valid
*.bitdefender.com Thawte RSA CA 2018	`2019-10-23` - `2020-11-04`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
assets.adobedtm.com DigiCert SHA2 High Assurance Server CA	`2019-10-22` - `2021-10-01`	2 years	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
*.demandbase.com Go Daddy Secure Certificate Authority - G2	`2018-09-20` - `2020-11-19`	2 years	crt.sh
*.company-target.com Go Daddy Secure Certificate Authority - G2	`2019-06-19` - `2021-08-18`	2 years	crt.sh
edge.fullstory.com GTS CA 1D2	`2020-08-29` - `2020-11-27`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
download.bitdefender.com DigiCert SHA2 Secure Server CA	`2020-04-23` - `2022-05-26`	2 years	crt.sh
*.gstatic.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
sstats.bitdefender.com DigiCert SHA2 High Assurance Server CA	`2019-12-30` - `2021-04-01`	a year	crt.sh
*.tt.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2017-10-19` - `2020-11-25`	3 years	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-08-05` - `2021-02-05`	6 months	crt.sh
static.hotjar.com Let's Encrypt Authority X3	`2020-08-16` - `2020-11-14`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.fullstory.com Let's Encrypt Authority X3	`2020-08-01` - `2020-10-30`	3 months	crt.sh
script.hotjar.com Let's Encrypt Authority X3	`2020-08-17` - `2020-11-15`	3 months	crt.sh
vars.hotjar.com Let's Encrypt Authority X3	`2020-08-15` - `2020-11-13`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Frame ID: 8D31771FBB4B40315A5DC66BDDE0B250
Requests: 71 HTTP requests in this frame

Frame: https://bitdefender.demdex.net/dest5.html?d_nsid=0
Frame ID: F6D763128752EF12D2B25894FA464A34
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Frame ID: 65C1EA9B4C10DEFD4EAC400799CA6CE3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

73
Requests

100 %
HTTPS

42 %
IPv6

17
Domains

29
Subdomains

22
IPs

7
Countries

1581 kB
Transfer

3807 kB
Size

24
Cookies

31 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/@gcluley
Title: @gcluley

Search URL Search Domain Scan URL

URL: https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/
Title: discovered

Search URL Search Domain Scan URL

URL: https://blog.nintechnet.com/critical-zero-day-vulnerability-fixed-in-wordpress-file-manager-700000-installations/
Title: describe

Search URL Search Domain Scan URL

URL: https://www.wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/
Title: says

Search URL Search Domain Scan URL

URL: https://wordpress.org/plugins/wp-file-manager/
Title: issued an update

Search URL Search Domain Scan URL

URL: https://facebook.com/grahamcluleycom

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/in/grahamcluley

Search URL Search Domain Scan URL

URL: http://www.facebook.com/bitdefender
Title: 1.3m Fans

Search URL Search Domain Scan URL

URL: http://www.twitter.com/bitdefender
Title: 103.9k Followers

Search URL Search Domain Scan URL

URL: https://feedly.com/i/subscription/feed/https://hotforsecurity.bitdefender.com/feed
Title: 2.7k Subscribers

Search URL Search Domain Scan URL

URL: http://feedly.com/i/subscription/feed%2Fhttps%3A%2F%2Ffeeds.feedburner.com%2FHOTforSecurity
Title: 16 Subscribers

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/box/
Title: Bitdefender Cybersecurity for Smart Home

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/solutions/total-security.html
Title: Bitdefender Complete Protection

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/solutions/internet-security.html
Title: Bitdefender PC Protection

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/solutions/antivirus-for-mac.html
Title: Bitdefender Antivirus for Mac

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/solutions/mobile-security-android.html
Title: Bitdefender Mobile Security for Android

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/solutions/antivirus-comparison.html
Title: Bitdefender Product Comparison

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/business/security.html
Title: Bitdefender GravityZone Business Security

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/business/advanced-security.html
Title: Bitdefender GravityZone Advanced Business Security

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/business/enterprise-security.html
Title: Bitdefender GravityZone Enterprise Security

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/business/hypervisor-introspection.html
Title: Bitdefender Hypervisor Introspection

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/business/renew/?icid=NA_quickrenew2015_hotforsecurity_footer
Title: Renewal for Business Customers

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/Downloads/
Title: Trial Downloads

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/solutions/free.html
Title: Free Antivirus

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/scanner/online/free.html
Title: Free Online Virus Scanner

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/free-virus-removal/
Title: Free Virus Removal Tools

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/remote/
Title: Live Remote Assistance

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/toolbox/
Title: Free Tools

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/site/view/bug-bounty.html
Title: Bug Bounty

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/news/
Title: Press Center

Search URL Search Domain Scan URL

URL: https://www.bitdefender.com/
Title: Bitdefender - a leading cyber security technology provider

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 33

https://bitdefender.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&d_coop_safe=1&ts=1600397636726 HTTP 302
https://bitdefender.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&d_coop_safe=1&ts=1600397636726

Request Chain 38

https://fullstory.com/s/fs.js HTTP 301
https://edge.fullstory.com/s/fs.js

Request Chain 56

https://cm.everesttech.net/cm/dd?d_uuid=61013499430593030802490060580551072979 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X2QhRQAABMuNOS3-

Request Chain 59

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&url=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&time=1600397637283 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D359890%26url%3Dhttps%253A%252F%252Fhotforsecurity.bitdefender.com%252Fblog%252Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html%26time%3D1600397637283%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&url=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&time=1600397637283&liSync=true

Request Chain 71

https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
https://segments.company-target.com/log?vendor=choca&user_id=AARMX06-yEMAAA-D3icOFw HTTP 303
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AARMX06-yEMAAA-D3icOFw&verifyHash=4e78f503d31b295a1c50f49638b40a4a404c63a4

73 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html Show response
hotforsecurity.bitdefender.com/blog/ 97 KB
20 KB 1288ms
1265ms Document
text/html 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 131ea672276e17b2cbdc4536f44a2d873b98905ea9081f6d0e3c9a64eb465b69

Request headers

:method: GET
:authority: hotforsecurity.bitdefender.com
:scheme: https
:path: /blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Fri, 18 Sep 2020 02:53:56 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=dfc3af3c4af4403ad5d38161b610e84111600397635; expires=Sun, 18-Oct-20 02:53:55 GMT; path=/; domain=.bitdefender.com; HttpOnly; SameSite=Lax
link: <https://hotforsecurity.bitdefender.com/wp-json/>; rel="https://api.w.org/" <https://hotforsecurity.bitdefender.com/wp-json/wp/v2/posts/24048>; rel="alternate"; type="application/json" <https://hotforsecurity.bitdefender.com/?p=24048>; rel=shortlink
cf-cache-status: DYNAMIC
cf-request-id: 0540bb06da000097b4ecbf7200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d47c7849bf897b4-FRA
content-encoding: gzip

GET
H2 200 wp-emoji-release.min.js Show response
hotforsecurity.bitdefender.com/wp-includes/js/ 14 KB
5 KB 30ms
26ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-includes/js/wp-emoji-release.min.js?ver=5.5.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8cb438bd4d1961f80ade4f1a295ca7de253630adcdd10473932908e638908c5e

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 07 Sep 2020 12:09:49 GMT
server: cloudflare
age: 2858
etag: W/"60bba-37a6-5aeb81857c3f3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d47c78cbd5397b4-FRA
cf-request-id: 0540bb0bf0000097b4ec806200000001

GET
H2 200 style.min.css
hotforsecurity.bitdefender.com/wp-includes/css/dist/block-library/ 53 KB
8 KB 26ms
21ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-includes/css/dist/block-library/style.min.css?ver=5.5.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 07 Sep 2020 12:09:50 GMT
server: cloudflare
age: 2858
etag: W/"140eb8-d293-5aeb8186c45f3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-ray: 5d47c78cbd5597b4-FRA
cf-request-id: 0540bb0bf1000097b4ec807200000001

GET
H2 200 styles.css
hotforsecurity.bitdefender.com/wp-content/plugins/contact-form-7/includes/css/ 1 KB
795 B 24ms
19ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.1.3
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 382fe3dd880202e9e2971b7ae531720bc1bf2bb68decbc507d04e64b62531f44

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 10 Jun 2019 12:23:43 GMT
server: cloudflare
age: 2858
etag: W/"91943-695-58af74046da4e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=1685
cf-ray: 5d47c78cbd5697b4-FRA
cf-request-id: 0540bb0bf2000097b4ec808200000001
cf-bgj: minify

GET
H2 200 front.min.css
hotforsecurity.bitdefender.com/wp-content/plugins/cookie-notice/css/ 3 KB
1 KB 25ms
21ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/cookie-notice/css/front.min.css?ver=5.5.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db7e27157a918cd3ebf833e1544924cab8837dbcaebe9e00989020ad3e43283d

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 30 Jan 2019 09:26:41 GMT
server: cloudflare
age: 2858
etag: W/"16003d-c04-580a981f1b6ab"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-ray: 5d47c78cbd5797b4-FRA
cf-request-id: 0540bb0bf2000097b4ec809200000001

GET
H2 200 simple-line-icons.css
hotforsecurity.bitdefender.com/wp-content/plugins/meks-flexible-shortcodes/css/simple-line/ 9 KB
2 KB 30ms
25ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/meks-flexible-shortcodes/css/simple-line/simple-line-icons.css?ver=1.3.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ddb5f37e49e5bb129115dc56bf737c89b3a27770107d3c24abe60b2cec84460e

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 27 Sep 2017 12:29:25 GMT
server: cloudflare
age: 2858
etag: W/"140269-2d25-55a2af13b3885"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=11557
cf-ray: 5d47c78cbd5897b4-FRA
cf-request-id: 0540bb0bf2000097b4ec80a200000001
cf-bgj: minify

GET
H2 200 style.css
hotforsecurity.bitdefender.com/wp-content/plugins/meks-flexible-shortcodes/css/ 11 KB
2 KB 25ms
20ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/meks-flexible-shortcodes/css/style.css?ver=1.3.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8ee6a829478761f158d239ceb4dd636ae4e703dc1970057c71628549d1de6d14

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 27 Sep 2017 12:29:25 GMT
server: cloudflare
age: 2858
etag: W/"140261-3c15-55a2af13b2ccd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=15381
cf-ray: 5d47c78cbd5997b4-FRA
cf-request-id: 0540bb0bf2000097b4ec80b200000001
cf-bgj: minify

GET
H2 200 socialfans-style.css
hotforsecurity.bitdefender.com/wp-content/plugins/socialfans-counter/assets/css/ 114 KB
13 KB 31ms
27ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/socialfans-counter/assets/css/socialfans-style.css?ver=4.5
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e4e3e93e78b70bc6e4a01cd3669047ccc88f0c8df0383ade180909c0f2870580

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2017 22:44:30 GMT
server: cloudflare
age: 2858
etag: W/"160123-1ffd4-548996c6f8f80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=131028
cf-ray: 5d47c78cbd5a97b4-FRA
cf-request-id: 0540bb0bf2000097b4ec80c200000001
cf-bgj: minify

GET
H2 200 font-awesome.min.css
hotforsecurity.bitdefender.com/wp-content/plugins/socialfans-counter/assets/css/ 28 KB
6 KB 32ms
28ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/socialfans-counter/assets/css/font-awesome.min.css?ver=4.5
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e07021158049cd2c874f0aa3c3eb60c126414affb59e7185838dcc62531406a0

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 23 Jun 2016 01:20:54 GMT
server: cloudflare
age: 2858
etag: W/"160112-7152-535e7dd88c980"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-ray: 5d47c78cbd5b97b4-FRA
cf-request-id: 0540bb0bf2000097b4ec80d200000001

GET
H2 200 wen-call-to-action-public.min.css
hotforsecurity.bitdefender.com/wp-content/plugins/wen-call-to-action/public/css/ 950 B
453 B 30ms
26ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/wen-call-to-action/public/css/wen-call-to-action-public.min.css?ver=1.2.0
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e1ae4fa36b6ad8f568dd6e04e1e8d5ff9fa87b2f35d90992313eff26eedcb486

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 06 Sep 2016 11:04:08 GMT
server: cloudflare
age: 2858
etag: W/"861a7-3b6-53bd4c1776c8e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-ray: 5d47c78cbd5c97b4-FRA
cf-request-id: 0540bb0bf2000097b4ec80e200000001

GET
H2 200 inline-tweet-sharer.css
hotforsecurity.bitdefender.com/wp-content/plugins/inline-tweet-sharer/ 623 B
363 B 26ms
22ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/inline-tweet-sharer/inline-tweet-sharer.css?ver=2.3.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c502ab7dd81c6a775f58e6b0a866befc8c444377d8a8ec4c07b03063db34834

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 10 Jun 2019 12:23:47 GMT
server: cloudflare
age: 2858
etag: W/"91895-35a-58af74087fa2e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=858
cf-ray: 5d47c78cbd5d97b4-FRA
cf-request-id: 0540bb0bf2000097b4ec80f200000001
cf-bgj: minify

GET
H2 200 dashicons.min.css
hotforsecurity.bitdefender.com/wp-includes/css/ 58 KB
35 KB 26ms
23ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-includes/css/dashicons.min.css?ver=5.5.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc1a3a3bf97eada084f65b5d87085ddb8d3a76a9e450c6a41211e1698048de91

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 07 Sep 2020 12:09:50 GMT
server: cloudflare
age: 2858
etag: W/"656fa-e681-5aeb81869a22b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-ray: 5d47c78cbd5e97b4-FRA
cf-request-id: 0540bb0bf2000097b4ec810200000001

GET
H2 200 css
fonts.googleapis.com/ 7 KB
821 B 19ms
15ms Stylesheet
text/css 2a00:1450:4001:819::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C300%2C700&subset=latin%2Clatin-ext&ver=2.0

Requested by

Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d0cbfb1ab0f94123834567e32df7ec74a1c210793f797368d41a4b4c2732d4a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 18 Sep 2020 01:34:29 GMT
server: ESF
date: Fri, 18 Sep 2020 02:53:56 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 18 Sep 2020 02:53:56 GMT

GET
H2 200 min.css
hotforsecurity.bitdefender.com/wp-content/themes/herald/assets/css/ 209 KB
34 KB 82ms
79ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/themes/herald/assets/css/min.css?ver=2.0
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0bafb2bfda20c5019c125a7f3bb4d7c51abf848201dd589e5cd67d0070f8b58a

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Mon, 12 Feb 2018 12:26:01 GMT
server: cloudflare
etag: W/"913b3-3455b-56502fb292e56"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=214363
cf-ray: 5d47c78cbd5f97b4-FRA
cf-request-id: 0540bb0bf2000097b4ec811200000001
cf-bgj: minify

GET
H2 200 style.css
hotforsecurity.bitdefender.com/wp-content/plugins/meks-smart-author-widget/css/ 205 B
276 B 26ms
22ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/meks-smart-author-widget/css/style.css?ver=1.1.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e15d1f89cbc821b0605f601a862e07b8e1b77075ece6439d726768183c4ec9de

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 01 Nov 2017 15:56:11 GMT
server: cloudflare
age: 2858
etag: W/"140012-f5-55cede917491b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=245
cf-ray: 5d47c78cbd6097b4-FRA
cf-request-id: 0540bb0bf2000097b4ec812200000001
cf-bgj: minify

GET
H2 200 style.css
hotforsecurity.bitdefender.com/wp-content/plugins/meks-smart-social-widget/css/ 34 KB
5 KB 29ms
26ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/meks-smart-social-widget/css/style.css?ver=1.4
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e0383e88d2588eac46cae98bdbc97d681f0ed2540059dbf1106b2d85f92a38d

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 05 Apr 2019 10:30:38 GMT
server: cloudflare
age: 2858
etag: W/"90d10-a569-585c5fa5741fc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-polished: origSize=42345
cf-ray: 5d47c78cbd6197b4-FRA
cf-request-id: 0540bb0bf2000097b4ec813200000001
cf-bgj: minify

GET
H2 200 frontend-builder-plugin-style.min.css
hotforsecurity.bitdefender.com/wp-content/plugins/divi-builder/includes/builder/styles/ 643 KB
54 KB 87ms
84ms Stylesheet
text/css 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/divi-builder/includes/builder/styles/frontend-builder-plugin-style.min.css?ver=2.24
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c0c7ff312fbaf1ee09e030009f39eef707d97de32504fd2b3ef3e0ec7c5b60f1

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Mon, 10 Jun 2019 12:23:44 GMT
server: cloudflare
etag: W/"91fea-a0b41-58af74059c226"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cf-ray: 5d47c78cbd6297b4-FRA
cf-request-id: 0540bb0bf2000097b4ec814200000001

GET
H2 200 jquery.js Show response
hotforsecurity.bitdefender.com/wp-includes/js/jquery/ 95 KB
33 KB 69ms
66ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Mon, 10 Jun 2019 12:20:45 GMT
server: cloudflare
etag: W/"60b33-17a69-58af735a5e3e6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d47c78cbd6397b4-FRA
cf-request-id: 0540bb0bf5000097b4ec815200000001

GET
H2 200 front.min.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/cookie-notice/js/ 5 KB
1 KB 27ms
24ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/cookie-notice/js/front.min.js?ver=1.2.46
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b82eefb6a4f332f80cf77897057def50d542447398557c6be322d86a3ebe613b

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 30 Jan 2019 09:26:41 GMT
server: cloudflare
age: 2858
etag: W/"160037-14f0-580a981f1aedb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d47c78cbd6497b4-FRA
cf-request-id: 0540bb0bf5000097b4ec816200000001

GET
H2 200 main.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/meks-flexible-shortcodes/js/ 3 KB
921 B 22ms
20ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/meks-flexible-shortcodes/js/main.js?ver=1.3.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 12229fc93eb6a5572501671207da32beb14c969a0f78bd2ed4bdf254cac1ffd1

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 27 Sep 2017 12:29:25 GMT
server: cloudflare
age: 2858
etag: W/"14025f-dc9-55a2af13b28e5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d47c78cbd6597b4-FRA
cf-request-id: 0540bb0bf5000097b4ec817200000001

GET
H2 200 frontend.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/stop-user-enumeration/frontend/js/ 232 B
305 B 31ms
29ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.3.22
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84f7bdd9d518f244e12254d2dab2827a56fa1c0be95dd685178105518fdd94d2

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 19 Jul 2019 09:44:22 GMT
server: cloudflare
age: 2858
etag: W/"9171d-e8-58e05922df320"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d47c78cbd6697b4-FRA
cf-request-id: 0540bb0bf5000097b4ec818200000001

GET
H2 200 inline-tweet-sharer.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/inline-tweet-sharer/ 349 B
379 B 24ms
22ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/inline-tweet-sharer/inline-tweet-sharer.js?ver=2.3.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3aca6f2b898088dab64aaba8faa7d6d90dabaa257a2e2d906832137efda5dcf9

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 10 Jun 2019 12:23:47 GMT
server: cloudflare
age: 2858
etag: W/"918a2-15d-58af74087fe16"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d47c78cbd6797b4-FRA
cf-request-id: 0540bb0bf5000097b4ec819200000001

GET
H2 200 satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js Show response
assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/ 241 KB
53 KB 29ms
16ms Script
application/x-javascript 2a02:26f0:6c00:28a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28a::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 862d25e6731d8163d089dc54c7b5e7f658c2735d726f3765d2c8b492566e85e6

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
last-modified: Fri, 28 Aug 2020 07:47:09 GMT
server: AkamaiNetStorage
status: 200
etag: "e49e21021330a324d601ecb73700d496:1598600829.411212"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://hotforsecurity.bitdefender.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 18 Sep 2020 03:53:56 GMT

GET
H2 200 h4s.png
hotforsecurity.bitdefender.com/wp-content/uploads/2016/07/ 21 KB
21 KB 21ms
18ms Image
image/png 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hotforsecurity.bitdefender.com/wp-content/uploads/2016/07/h4s.png
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e4f237433fef48f03ba6d84f2677528e1a555fd7956d3b01e09e79d2b326f57d

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
cf-cache-status: HIT
last-modified: Tue, 05 Jul 2016 10:34:14 GMT
server: cloudflare
age: 2672
etag: "8a9cc-54c6-536e0fe811580"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
accept-ranges: bytes
cf-ray: 5d47c78f2dcc97b4-FRA
content-length: 21702
cf-request-id: 0540bb0d74000097b4ec826200000001

GET
H2 200 wp-file-manager-800x420.jpeg
hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/ 60 KB
60 KB 59ms
57ms Image
image/jpeg 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/wp-file-manager-800x420.jpeg
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9fd92d837373a6762b0b91f80f038ddcf08ee3a2a46efc7dbbe66320008fb07

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
cf-cache-status: REVALIDATED
last-modified: Wed, 02 Sep 2020 16:21:32 GMT
server: cloudflare
etag: "222743-f001-5ae570760a310"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 5d47c78f2dcd97b4-FRA
content-length: 61441
cf-request-id: 0540bb0d74000097b4ec827200000001
cf-bgj: h2pri

GET
H2 200 ads.js Show response
www.bitdefender.com/themes/draco/scripts/ 65 B
282 B 130ms
123ms Script
application/x-javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bitdefender.com/themes/draco/scripts/ads.js
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e6ea464d3d20c2a23b116f868ba8e02e8f79580632cfa26d7721026a49d66b31

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: MISS
last-modified: Tue, 20 Dec 2016 09:43:19 GMT
server: cloudflare
status: 200
etag: W/"5858fd37-41"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 5d47c78d4d7897b4-FRA
cf-request-id: 0540bb0c4b000097b4ec81b200000001

GET
H2 200 generalDigitalData Show response
www.bitdefender.com/site/Main/ 32 KB
6 KB 592ms
591ms Script
application/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bitdefender.com/site/Main/generalDigitalData?p=/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&t=single&dl=en&h=hot4sec.rbx.ovh.bitdefender.net&s=hotforsecurity.bitdefender.com&err=

Requested by

Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dbf0fbbf5d89d767d911d99bd4d56fab45682d60a8e337ea9367e02879bd1950

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Sep 2020 02:53:57 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000; includeSubdomains; preload
content-type: application/javascript
status: 200
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 5d47c78d4d7b97b4-FRA
cf-request-id: 0540bb0c50000097b4ec81c200000001
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 jquery.adrotate.clicktracker.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/adrotate/library/ 1 KB
662 B 103ms
102ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/adrotate/library/jquery.adrotate.clicktracker.js
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2f64b025cec8c93dcb01fe88f0e79c134bc0a6c751787360153865dfa9f3a962

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Fri, 19 Jul 2019 09:44:21 GMT
server: cloudflare
etag: W/"91626-40b-58e059224b3f0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d47c78f1dc597b4-FRA
cf-request-id: 0540bb0d6c000097b4ec81f200000001

GET
H2 200 scripts.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/contact-form-7/includes/js/ 14 KB
4 KB 21ms
16ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.1.3
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7e17926b30342edecee8b3a93029ac51462e2b479277d8e077ba57173eb1900

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 10 Jun 2019 12:23:43 GMT
server: cloudflare
age: 2858
etag: W/"91932-3868-58af74046ce96"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d47c78f1dc697b4-FRA
cf-request-id: 0540bb0d73000097b4ec820200000001

GET
H2 200 socialfans-script.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/socialfans-counter/assets/js/ 7 KB
2 KB 25ms
21ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/socialfans-counter/assets/js/socialfans-script.js?ver=4.5
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89b026459d5ad9b78afcd0ba868276048e24e67d75bf0737e08e33552edb3cee

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2017 22:44:30 GMT
server: cloudflare
age: 2858
etag: W/"160136-1d23-548996c6f8f80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d47c78f1dc797b4-FRA
cf-request-id: 0540bb0d73000097b4ec821200000001

GET
H2 200 min.js Show response
hotforsecurity.bitdefender.com/wp-content/themes/herald/assets/js/ 94 KB
27 KB 63ms
59ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/themes/herald/assets/js/min.js?ver=2.0
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d13655d1693b0b46340f6b5391c0154b6566fcfe95741d40674ae9a1b5a0293

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Mon, 12 Feb 2018 12:26:01 GMT
server: cloudflare
etag: W/"913a1-178be-56502fb29229e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d47c78f1dc897b4-FRA
cf-request-id: 0540bb0d73000097b4ec822200000001

GET
H2 200 divi-builder.min.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/divi-builder/js/ 209 KB
49 KB 26ms
23ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/divi-builder/js/divi-builder.min.js?ver=2.24
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f1495396c589ea4cd4497c74fe9e218e9913e38504847ad4361d12d7b13bda9

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 10 Jun 2019 12:23:44 GMT
server: cloudflare
age: 2858
etag: W/"91d4b-3444d-58af74057e596"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d47c78f1dc997b4-FRA
cf-request-id: 0540bb0d73000097b4ec823200000001

GET
H2 200 common.js Show response
hotforsecurity.bitdefender.com/wp-content/plugins/divi-builder/core/admin/js/ 1 KB
684 B 20ms
17ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/divi-builder/core/admin/js/common.js?ver=3.24
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c05ee8fac93fde19412046a913b9aecd86210aba6b72cff7c94e01170dd11e3b

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 10 Jun 2019 12:23:44 GMT
server: cloudflare
age: 2858
etag: W/"91db3-550-58af740582fce"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d47c78f2dca97b4-FRA
cf-request-id: 0540bb0d74000097b4ec824200000001

GET
H2 200 wp-embed.min.js Show response
hotforsecurity.bitdefender.com/wp-includes/js/ 1 KB
898 B 19ms
15ms Script
text/javascript 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-includes/js/wp-embed.min.js?ver=5.5.1
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 07 Sep 2020 12:09:49 GMT
server: cloudflare
age: 2858
etag: W/"64a65-59a-5aeb818605f13"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cf-ray: 5d47c78f2dcb97b4-FRA
cf-request-id: 0540bb0d74000097b4ec825200000001

GET
H/1.1

200
OK

rd Show response
bitdefender.demdex.net/id/
Redirect Chain

https://bitdefender.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&d_coop_safe=1&ts=1600397636726
https://bitdefender.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&d_coop_safe=1&ts=1600397636726

971 B
1 KB

66ms
66ms

XHR
application/json

52.209.239.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bitdefender.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&d_coop_safe=1&ts=1600397636726

Requested by

Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.209.239.68 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-209-239-68.eu-west-1.compute.amazonaws.com

Software

Resource Hash

9686dcf96ed3c3715acee18bcb43ce45cc494609a6e60c0406863494550a5a56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v081-06a3fbe83.edge-irl1.demdex.com 5.78.0.20200908113611 3ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: li/ZVMJqTMM=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://hotforsecurity.bitdefender.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 517
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://hotforsecurity.bitdefender.com
X-TID: nvXyUgdETDc=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://bitdefender.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&d_nsid=0&d_coop_safe=1&ts=1600397636726
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 mbox-contents-e392e41418bacceda95c05b2c49657ebca0324a2.js Show response
assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/ 92 KB
31 KB 7ms
7ms Script
application/x-javascript 2a02:26f0:6c00:28a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/mbox-contents-e392e41418bacceda95c05b2c49657ebca0324a2.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28a::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 159526f78a28685850dc55b5b8776267c1b242fd12504e7d8e7e838b22a849cd

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
last-modified: Thu, 16 Jul 2020 12:49:54 GMT
server: AkamaiNetStorage
status: 200
etag: "d66c216299277839f6ed2f2b6e4c2b90:1594903794.35391"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://hotforsecurity.bitdefender.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 31385
expires: Fri, 18 Sep 2020 03:53:56 GMT

GET
H2 200 satellite-5afad58064746d59a10078e2.js Show response
assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/scripts/ 361 B
549 B 8ms
6ms Script
application/x-javascript 2a02:26f0:6c00:28a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/scripts/satellite-5afad58064746d59a10078e2.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28a::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 3426d7ced4ac00288838068e457aca4d7804c1e5e9a92ef61a858d3e97fae4f6

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
content-encoding: gzip
last-modified: Tue, 04 Aug 2020 14:08:10 GMT
server: AkamaiNetStorage
status: 200
etag: "50f093ab328808186f4c389066a15557:1596550090.643657"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://hotforsecurity.bitdefender.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 273
expires: Fri, 18 Sep 2020 03:53:56 GMT

GET
H2 200 ee38c350.min.js Show response
scripts.demandbase.com/adobeanalytics/ 5 KB
2 KB 182ms
80ms Script
application/javascript 99.84.144.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://scripts.demandbase.com/adobeanalytics/ee38c350.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.144.124 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-144-124.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 483741ab3576b4cdf24b73a2f017ea6e20468471b387cc484eccee5fd1fd1cb4

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-amz-version-id: N.PIJWfZDnfeciwZpz.LPjhMyH.wV0Gb
content-encoding: gzip
last-modified: Wed, 08 Jan 2020 23:59:25 GMT
server: AmazonS3
age: 6132
etag: "2023fd9ed69b2ab1edf55023bfaaa06e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
date: Fri, 18 Sep 2020 01:11:45 GMT
x-amz-cf-pop: TXL52-C1
x-amz-cf-id: MJCnVV8nus2zz2ehum6airKw0SegN-hD9w0PXj0HLJGqGh-c7PUr7w==
via: 1.1 1d9f9231888e03b204a8691cc95e7c61.cloudfront.net (CloudFront)

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 451 B
711 B 235ms
140ms Script
application/javascript 99.84.144.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?key=b7702e4099c19fbb2580e68d489df700&callback=Dmdbase_CDC.callback
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.144.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-144-62.txl52.r.cloudfront.net
Software: nginx /
Resource Hash: b03fe35dd277d33be3e4fa547ad92dbd33b250dd0545776716fc4aa28b4c2bfc

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Fri, 18 Sep 2020 02:53:56 GMT
identification-source: CENTRAL
x-amz-cf-pop: TXL52-C1
x-cache: Miss from cloudfront
status: 200
request-id: f9b525a4-21ae-4939-a625-6c7053e00cf6
content-encoding: gzip
pragma: no-cache
server: nginx
vary: Accept-Encoding, Origin
content-type: application/javascript;charset=utf-8
via: 1.1 a477b8537c9bc4c10a3c144386a7b5bf.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, max-age=0, must-revalidate
api-version: v2
x-amz-cf-id: zDC2Jz2vFE7Ja530-ZihZv14hD24dvnqV9rKUIYuQ_wcPnHMmP3mdA==
expires: Thu, 17 Sep 2020 02:53:56 GMT

GET
H2

200

fs.js Show response
edge.fullstory.com/s/
Redirect Chain

https://fullstory.com/s/fs.js
https://edge.fullstory.com/s/fs.js

201 KB
61 KB

140ms
42ms

Script
application/javascript

35.201.112.186
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.fullstory.com/s/fs.js
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.112.186 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 186.112.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d7b38fb952a78e6eb880a5bd612db89e572edf28a14f63830744bd97856e5dc5

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:46:17 GMT
content-encoding: gzip
age: 460
x-guploader-uploadid: ABg5-UzkkV8b5mhQTo_LqZEEoalKz6Df3ryk5WLcQu7Iny2-lK5CQr6XtlRZa4aqsYmOD_0K7DXgDMaqBIzAPC5ILQ9T7_gyjA
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 61619
last-modified: Wed, 09 Sep 2020 14:43:45 GMT
server: UploadServer
etag: "2d5677ac529501af1cd3b383127ad5df"
x-goog-hash: crc32c=vmbjRA==, md5=LVZ3rFKVAa8c07ODEnrV3w==
x-goog-generation: 1599662625306900
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=600,no-transform
x-goog-stored-content-length: 61619
accept-ranges: bytes
content-type: application/javascript
expires: Fri, 18 Sep 2020 02:56:17 GMT

Redirect headers

date: Fri, 11 Sep 2020 23:38:33 GMT
via: 1.1 google
age: 530124
status: 301
location: https://edge.fullstory.com/s/fs.js
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 5896
date: Fri, 18 Sep 2020 01:15:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Fri, 18 Sep 2020 03:15:40 GMT

GET
H2 200 hotforsecurity.jpg
hotforsecurity.bitdefender.com/wp-content/uploads/2019/10/ 481 KB
481 KB 19ms
18ms Image
image/jpeg 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hotforsecurity.bitdefender.com/wp-content/uploads/2019/10/hotforsecurity.jpg
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e0971026066e53fcd75d7f54008d457c621f42ff371ccfc3075684efc7405d8a

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
cf-cache-status: HIT
last-modified: Thu, 31 Oct 2019 13:28:25 GMT
server: cloudflare
age: 6525
etag: "21662-782ca-59634d2f678bb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 5d47c78f3dd297b4-FRA
content-length: 492234
cf-request-id: 0540bb0d7e000097b4ec828200000001
cf-bgj: h2pri

GET
H2 200 dragon.png
download.bitdefender.com/resources/themes/draco/images/ 140 KB
140 KB 126ms
27ms Image
image/png 192.229.220.142
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://download.bitdefender.com/resources/themes/draco/images/dragon.png

Requested by

Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.220.142 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (waw/054E) /

Resource Hash

4d0d2a0d54d25d91923590d3383b8aac038fa588a499df562598fd18064c88df

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN *.bitdefender.com

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
last-modified: Sat, 20 Jan 2018 04:07:08 GMT
server: ECAcc (waw/054E)
age: 4199
status: 200
etag: "5a62c06c-22fc8"
x-frame-options: SAMEORIGIN *.bitdefender.com
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=7200
accept-ranges: bytes
content-length: 143304
expires: Fri, 18 Sep 2020 04:53:57 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 38ms
36ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C300%2C700&subset=latin%2Clatin-ext&ver=2.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://hotforsecurity.bitdefender.com
Referer: https://fonts.googleapis.com/css?family=Roboto%3A400%2C300%2C700&subset=latin%2Clatin-ext&ver=2.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 14 Sep 2020 11:04:15 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:58 GMT
server: sffe
age: 316182
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11020
x-xss-protection: 0
expires: Tue, 14 Sep 2021 11:04:15 GMT

GET
H2 200 fontawesome-webfont.woff2
hotforsecurity.bitdefender.com/wp-content/themes/herald/assets/fonts/ 75 KB
76 KB 63ms
62ms Font
application/octet-stream 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/themes/herald/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/wp-content/themes/herald/assets/css/min.css?ver=2.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d792afdac7f7ae5de7c6964950c6c61dc6e3f3813180a59e141c7cb4ac4364dc

Request headers

Origin: https://hotforsecurity.bitdefender.com
Referer: https://hotforsecurity.bitdefender.com/wp-content/themes/herald/assets/css/min.css?ver=2.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Mon, 12 Feb 2018 12:26:01 GMT
server: cloudflare
etag: W/"91400-12d68-56502fb2a2086"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain; charset=UTF-8
status: 200
cf-ray: 5d47c78f4dd797b4-FRA
cf-request-id: 0540bb0d89000097b4ec829200000001

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 38ms
38ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C300%2C700&subset=latin%2Clatin-ext&ver=2.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://hotforsecurity.bitdefender.com
Referer: https://fonts.googleapis.com/css?family=Roboto%3A400%2C300%2C700&subset=latin%2Clatin-ext&ver=2.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 14 Sep 2020 11:04:11 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 316186
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Tue, 14 Sep 2021 11:04:11 GMT

GET
H2 200 socialfans.woff
hotforsecurity.bitdefender.com/wp-content/plugins/socialfans-counter/assets/font/ 17 KB
17 KB 62ms
61ms Font
application/octet-stream 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hotforsecurity.bitdefender.com/wp-content/plugins/socialfans-counter/assets/font/socialfans.woff?v=4.5
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e5ad690c7a754826152d2ecab11de59d6d03326ff66af754860112601ca157c3

Request headers

Origin: https://hotforsecurity.bitdefender.com
Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Thu, 29 Jan 2015 21:24:38 GMT
server: cloudflare
etag: W/"16012e-442c-50dd11d82f180"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain; charset=UTF-8
status: 200
cf-ray: 5d47c78f4dd897b4-FRA
cf-request-id: 0540bb0d8a000097b4ec82a200000001

GET
H2 200 5fdc27b8b6f6fd69e77aa017a53cceb5
secure.gravatar.com/avatar/ 4 KB
4 KB 22ms
6ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/5fdc27b8b6f6fd69e77aa017a53cceb5?s=112&d=mm&r=g
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 52193931ee193d8ab70d0bb34f251f5849b092b783c2d671184a7853e86a040a

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 1
date: Fri, 18 Sep 2020 02:53:57 GMT
last-modified: Thu, 18 Jun 2020 13:37:43 GMT
server: nginx
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="5fdc27b8b6f6fd69e77aa017a53cceb5.jpeg"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/5fdc27b8b6f6fd69e77aa017a53cceb5?s=112&d=mm&r=g>; rel="canonical"
content-length: 4233
expires: Fri, 18 Sep 2020 02:58:57 GMT

GET
H2 200 wp-file-manager.jpeg
hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/ 64 KB
64 KB 62ms
60ms Image
image/jpeg 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/wp-file-manager.jpeg
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b47116dba01d7e6bac5d27ef84a0963de4fbe7ae36592fddda0c54a1fc8c8be2

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
cf-cache-status: REVALIDATED
last-modified: Wed, 02 Sep 2020 16:21:30 GMT
server: cloudflare
etag: "21a81-fe2d-5ae57073e78f8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 5d47c7905e1697b4-FRA
content-length: 65069
cf-request-id: 0540bb0e37000097b4ec82c200000001
cf-bgj: h2pri

GET
H2 200 us-dept-of-treasury-300x200.jpg
hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/ 16 KB
17 KB 17ms
15ms Image
image/jpeg 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/us-dept-of-treasury-300x200.jpg
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 306c9714fc0da628f79970bbcc854b8bbbda370dbf90fe73486330eab400be0e

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
cf-cache-status: HIT
last-modified: Thu, 17 Sep 2020 13:41:03 GMT
server: cloudflare
age: 2673
etag: "222bb6-41cc-5af8289108915"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 5d47c7905e1797b4-FRA
content-length: 16844
cf-request-id: 0540bb0e37000097b4ec82d200000001
cf-bgj: h2pri

GET
H2 200 Staples-Discloses-Data-Breach-Exposing-Limited-Customer-Information-300x200.jpg
hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/ 5 KB
5 KB 35ms
33ms Image
image/jpeg 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/Staples-Discloses-Data-Breach-Exposing-Limited-Customer-Information-300x200.jpg
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0199e005e1574444217590e9fe93bb935175faad3cb4a621eec9be03aa8ba6fb

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
cf-cache-status: HIT
last-modified: Thu, 17 Sep 2020 10:26:06 GMT
server: cloudflare
age: 2673
etag: "222b85-151f-5af7fcfd6f889"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 5d47c7905e1897b4-FRA
content-length: 5407
cf-request-id: 0540bb0e37000097b4ec82e200000001
cf-bgj: h2pri

GET
H2 200 Dusseldorf-University-Hospital-Emergency-Care-Postponed-After-Alleged-Cyber-Attack-300x200.jpg
hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/ 9 KB
9 KB 64ms
63ms Image
image/jpeg 2606:4700::6812:a9de
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hotforsecurity.bitdefender.com/wp-content/uploads/2020/09/Dusseldorf-University-Hospital-Emergency-Care-Postponed-After-Alleged-Cyber-Attack-300x200.jpg
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:a9de , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a73b5169f6b32abacf73b3e8c2e199528e16dee392a605f6fcd15de325b9b09f

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
cf-cache-status: REVALIDATED
last-modified: Wed, 16 Sep 2020 15:05:18 GMT
server: cloudflare
etag: "222b5e-22da-5af6f9882023d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
accept-ranges: bytes
cf-ray: 5d47c7905e1997b4-FRA
content-length: 8922
cf-request-id: 0540bb0e37000097b4ec82f200000001
cf-bgj: h2pri

GET
H2 200 5fdc27b8b6f6fd69e77aa017a53cceb5
secure.gravatar.com/avatar/ 6 KB
6 KB 21ms
6ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/5fdc27b8b6f6fd69e77aa017a53cceb5?s=140&d=mm&r=g
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 13c93fe0e5e18bb4cff177634ecdb8fedb52afdf3c4d2b4cb6f1ef1cf481e9c4

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 1
date: Fri, 18 Sep 2020 02:53:57 GMT
last-modified: Thu, 18 Jun 2020 13:37:43 GMT
server: nginx
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="5fdc27b8b6f6fd69e77aa017a53cceb5.jpeg"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/5fdc27b8b6f6fd69e77aa017a53cceb5?s=140&d=mm&r=g>; rel="canonical"
content-length: 5706
expires: Fri, 18 Sep 2020 02:58:57 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 965 B
760 B 20ms
7ms Script
application/x-javascript 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/scripts/satellite-5afad58064746d59a10078e2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 83af74f9ae1d1e4be00a7e271ab233c20ecc5769bdbd1c72e0524dc86bdf12e4

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 18 Sep 2020 02:53:57 GMT
Content-Encoding: gzip
Last-Modified: Thu, 17 Sep 2020 18:39:56 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=57172
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 447

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 4 B
77 B 40ms
39ms XHR
text/plain 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=246977193&t=pageview&_s=1&dl=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&ul=en-us&de=UTF-8&dt=WordPress%20Websites%20Attacked%20via%20File%20Manager%20Plugin%20Vulnerability%20%E2%80%93%20HOTforSecurity&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=210979888&gjid=1153150093&cid=1322363566.1600397637&tid=UA-2819970-3&_gid=348573692.1600397637&_r=1&_slc=1&z=2039600296

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 18 Sep 2020 02:53:57 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://hotforsecurity.bitdefender.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK Cookie set dest5.html
bitdefender.demdex.net/ Frame F6D7 0
0 63ms
62ms Document
text/html 52.209.239.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bitdefender.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.209.239.68 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-209-239-68.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: bitdefender.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=61013499430593030802490060580551072979
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Wed, 09 Sep 2020 13:37:19 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=61013499430593030802490060580551072979;Path=/;Domain=.demdex.net;Expires=Wed, 17-Mar-2021 02:53:57 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: OT+1gD9rSKs=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 id Show response
sstats.bitdefender.com/ 48 B
495 B 227ms
65ms XHR
application/x-javascript 15.236.9.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sstats.bitdefender.com/id?d_visid_ver=5.0.1&d_fieldgroup=A&mcorgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&mid=60993458386039419992487987197801393684&ts=1600397637261

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.9.100 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-9-100.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

c111a297fcbcf2e7a78ac5525f6f58fed3f9a6bf0b4ebc4212089943d92bb76f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Fri, 18 Sep 2020 02:53:57 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-6485bbc5d6-vzpfb
vary: Origin
x-c: master-1362.Ibf4d3d.M0-447
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://hotforsecurity.bitdefender.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=X2QhRQAABMuNOS3-
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=61013499430593030802490060580551072979
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X2QhRQAABMuNOS3-

42 B
915 B

268ms
67ms

Image
image/gif

52.209.239.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=X2QhRQAABMuNOS3-

Requested by

Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.209.239.68 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-209-239-68.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v081-00e89c9b6.edge-irl1.demdex.com 5.78.0.20200908113611 0ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: CgIYoU5WQSU=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Fri, 18 Sep 2020 02:53:57 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=X2QhRQAABMuNOS3-
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

POST
H2 200 delivery Show response
bitdefender.tt.omtrdc.net/rest/v1/ 284 B
476 B 226ms
69ms XHR
application/json 54.76.99.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bitdefender.tt.omtrdc.net/rest/v1/delivery?client=bitdefender&sessionId=a8efe6f88db74faaa7a33d222f0309ca&version=2.3.1
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/mbox-contents-e392e41418bacceda95c05b2c49657ebca0324a2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.99.142 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-99-142.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 45ec87d00e5f0cc159b247f104d7ba531bd97d3d9585e3d533797294c350a6c4

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
content-encoding: gzip
status: 200
vary: Origin,Accept-Encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://hotforsecurity.bitdefender.com
access-control-allow-credentials: true
x-request-id: 188073574e3bc1b6566e6913649ae9af

GET
H/1.1 200
OK insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 8ms
8ms Script
application/x-javascript 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 18 Sep 2020 02:53:57 GMT
Content-Encoding: gzip
Last-Modified: Thu, 03 Sep 2020 20:29:41 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=42925
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&url=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&time...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D359890%26url%3Dhttps%253A%252F%252Fhotforsecurity.bitdefender.com%252Fblog%252Fwo...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&url=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&time...

0
80 B

586ms
586ms

Image
application/javascript

2a05:f500:10:101::b93f:9105
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&url=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&time=1600397637283&liSync=true
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:58 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-ltx1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 0
x-li-uuid: P8D5FizBNRZgOG6bgisAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: yOydESzBNRagI57zVCsAAA==
pragma: no-cache
x-li-pop: afd-prod-eda6
x-msedge-ref: Ref A: 6832B401C5FE43A989588F48B5C4E179 Ref B: FRAEDGE1317 Ref C: 2020-09-18T02:53:57Z
x-frame-options: sameorigin
date: Fri, 18 Sep 2020 02:53:56 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-ltx1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=359890&url=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&time=1600397637283&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 hotjar-37798.js Show response
static.hotjar.com/c/ 46 KB
7 KB 175ms
55ms Script
application/javascript 147.75.84.91
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-37798.js?sv=5

Requested by

Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

147.75.84.91 Parsippany, United States, ASN54825 (PACKET, US),

Reverse DNS

pkt-ams-k2-shared-ingress13

Software

Resource Hash

2167182ab5b869828b4d8dd119d7b933c189f6aab1776b50877e558c15c223f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
content-encoding: br
x-content-type-options: nosniff
content-type: application/javascript
section-io-tag: hotjarjs
age: 0
status: 200
section-io-cache: Hit
vary: Accept-Encoding
content-length: 7076
cache-control: max-age=60
etag: W/35a1f38f38a1f7100d1b64c7c13d10f2
access-control-max-age: 600
section-io-origin-status: 304
access-control-allow-origin: *
x-cache-hit: 1
section-io-origin-time-seconds: 0.019
accept-ranges: bytes
section-io-id: dbf1e34487a6ace6968992f2c8cbdf47
section-origin-responded: true

GET
H2 200 satellite-5d02108464746d34ba000300.js Show response
assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/scripts/ 318 B
529 B 9ms
8ms Script
application/x-javascript 2a02:26f0:6c00:28a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/scripts/satellite-5d02108464746d34ba000300.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28a::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: edefa01f1cd7ecdfc0ad42300ae3583e3d3f51f0b5a2be2bd476aeebf47f2514

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
content-encoding: gzip
last-modified: Fri, 28 Aug 2020 07:47:11 GMT
server: AkamaiNetStorage
status: 200
etag: "ab15a6c3bbc9e645694fd46ec06a5c01:1598600831.865136"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://hotforsecurity.bitdefender.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 254
expires: Fri, 18 Sep 2020 03:53:57 GMT

GET
H2 200 s-code-contents-f491ecdc05b0507cfd2c52966e13abbfea654982.js Show response
assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/ 85 KB
31 KB 6ms
6ms Script
application/x-javascript 2a02:26f0:6c00:28a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/s-code-contents-f491ecdc05b0507cfd2c52966e13abbfea654982.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/satelliteLib-3a8d5287cf775324dc6c68719a1ddc96c5a139ba.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28a::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0659613b273942da1c8965a916f32f6f3cfdb020f61c1a3432ee74649d24b1c9

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
content-encoding: gzip
last-modified: Fri, 28 Aug 2020 07:47:09 GMT
server: AkamaiNetStorage
status: 200
etag: "6a422418026a56c63c8bc524117a02d4:1598600829.732987"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://hotforsecurity.bitdefender.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 31532
expires: Fri, 18 Sep 2020 03:53:57 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
94 B 14ms
14ms XHR
text/plain 2a00:1450:400c:c0c::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-2819970-3&cid=1322363566.1600397637&jid=210979888&gjid=1153150093&_gid=348573692.1600397637&_u=IEBAAEAAAAAAAC~&z=467709863

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 18 Sep 2020 02:53:57 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://hotforsecurity.bitdefender.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ee38c350.min.js Show response
tag.demandbase.com/ 57 KB
58 KB 178ms
74ms Script
application/javascript 143.204.201.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.demandbase.com/ee38c350.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/scripts/satellite-5d02108464746d34ba000300.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.201.40 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-201-40.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b4eaafafc797a31bcb3e91a0c171404d8084ab3b924e7e0ee94bc1dab35bb7d5

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: p9C3gcO6ONJe9xpJzyEtOoH0XrOJVHac
via: 1.1 18e87eada05046c231b7f49230fa6dc4.cloudfront.net (CloudFront)
etag: "27413c32acc2787f619b30d68f2dd23a"
age: 3388
x-cache: Hit from cloudfront
status: 200
content-length: 58727
last-modified: Thu, 03 Sep 2020 14:14:48 GMT
server: AmazonS3
date: Fri, 18 Sep 2020 01:57:30 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
x-amz-cf-id: 62lLW6AMsSSM3qSj4uXMJDzTZs0y75vo651lb2638SjGaojAkbOX_w==

GET
H2 200 json Show response
fls.doubleclick.net/ 40 B
723 B 160ms
61ms Script
text/javascript 216.58.212.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fls.doubleclick.net/json?spot=5165113&src=&var=s_3_Integrate_DFA_get_0&host=integrate.112.2o7.net%2Fdfa_echo%3Fvar%3Ds_3_Integrate_DFA_get_0%26AQE%3D1%26A2S%3D1&ord=9882463977528

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/s-code-contents-f491ecdc05b0507cfd2c52966e13abbfea654982.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.134 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f134.1e100.net

Software

cafe /

Resource Hash

e32a6ae5e43f7f652674e0f03dc23f86839f839b29ee4e63c01c93da180bb0d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60
x-xss-protection: 0
pragma: no-cache
server: cafe
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: no-cache, must-revalidate
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 202 page Show response
rs.fullstory.com/rec/ 52 B
237 B 293ms
193ms XHR
text/plain 35.186.194.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rs.fullstory.com/rec/page

Requested by

Host: fullstory.com
URL: https://fullstory.com/s/fs.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.194.58 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

58.194.186.35.bc.googleusercontent.com

Software

Resource Hash

1776651e4a3c9aeb0124d70ef86c2832dc6900251e7771124b482283256d710d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
via: 1.1 google
x-content-type-options: nosniff
status: 202
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://hotforsecurity.bitdefender.com
access-control-allow-credentials: true
alt-svc: clear
content-length: 52

GET
H2 200 modules.5fdb294d4cb17b8c9a47.js Show response
script.hotjar.com/ 360 KB
70 KB 190ms
62ms Script
application/javascript 147.75.32.125
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.hotjar.com/modules.5fdb294d4cb17b8c9a47.js
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-37798.js?sv=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.32.125 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress4
Software: /
Resource Hash: b5fb6443344734b6a16af14f4fd4446832356d3b4b1b566df218678a098ba2ca

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
content-encoding: br
age: 36918
status: 200
section-io-cache: Hit
content-length: 71575
last-modified: Thu, 17 Sep 2020 16:35:02 GMT
etag: "05df4610f3591cf54fee41e507f5db01"
vary: Accept-Encoding
section-io-origin-status: 200
access-control-allow-origin: *
cache-control: max-age=31536000
section-io-origin-time-seconds: 0.028
section-io-id: 042404a44176cab3153af8ff8c350a95
accept-ranges: bytes
content-type: application/javascript
section-origin-responded: true

GET
H2 200 box-469cf41adb11dc78be68c1ae7f9457a4.html
vars.hotjar.com/ Frame 65C1 0
0 170ms
58ms Document
text/html 147.75.32.125
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-37798.js?sv=5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.32.125 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress4
Software: /
Resource Hash

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-469cf41adb11dc78be68c1ae7f9457a4.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

Response headers

status: 200
date: Fri, 18 Sep 2020 02:53:57 GMT
content-type: text/html
content-length: 851
last-modified: Mon, 17 Aug 2020 18:24:17 GMT
etag: "d594f1d4c3e5dbd6b556c60d34e0daea"
cache-control: max-age=31536000
content-encoding: br
section-io-origin-status: 200
section-io-origin-time-seconds: 0.045
section-origin-responded: true
age: 2682781
vary: Accept-Encoding
section-io-cache: Hit
accept-ranges: bytes
section-io-id: d71797c97e01ec7474c72fafc44b34f4

GET
H2 200 s4276200771555 Show response
sstats.bitdefender.com/b/ss/bitdefenderproduction/10/JS-2.20.0-D7QN/ 768 B
1 KB 84ms
83ms Script
application/x-javascript 15.236.9.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sstats.bitdefender.com/b/ss/bitdefenderproduction/10/JS-2.20.0-D7QN/s4276200771555?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=18%2F8%2F2020%204%3A53%3A57%205%20-120&d.&nsid=0&jsonv=1&.d&sdid=6995DBBAB099ABF2-56425E52535884FC&D=D%3D&mid=60993458386039419992487987197801393684&aamlh=6&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&pageName=h4s%3Aarticle%3Awordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048&g=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&c.&s_dmdbase=ISP%20Visitor%3AISP%20Visitor%3AISP%20Visitor%3AISP%20Visitor%3AISP%20Visitor%3AISP%20Visitor%3ABot%3AISP%20Visitor&s_dmdbase_custom1=ISP%20Visitor%3AISP%20Visitor%3AISP%20Visito%3AISP%20Visitor%3AISP%20Visitor%3AISP%20Visitor%3AISP%20Visitor%3AISP%20Visitor&.c&cc=EUR&ch=h4s&server=h4s&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=article&v1=h4s%3Aarticle%3Awordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048&c2=wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048&v3=D%3Dc8&c4=bitdefenderproduction&v4=D%3Dc9&c5=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&v5=D%3Dc10&c6=us&v6=D%3Dc6&c7=en&v7=D%3Dc7&c8=18%2F9%2F2020&c9=04%3A53%7C04%3A00-04%3A59%7Cfriday%7Cgmt%20%2B2&c10=false&c75=%7Cprod&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=0E920C0F53DA9E9B0A490D45%40AdobeOrg&AQE=1

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4b7ac0a30c6cfe2deb06368f62d41f996c29744e/s-code-contents-f491ecdc05b0507cfd2c52966e13abbfea654982.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.9.100 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-9-100.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

5d0b40b416f93d141dba676a4736692de67b2dba9b47ab6d8801ca0f639c1a95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-aam-tid: LeR3wyz6TP4=
date: Fri, 18 Sep 2020 02:53:57 GMT
x-content-type-options: nosniff
x-c: master-1362.Ibf4d3d.M0-447
p3p: CP="This is not a P3P policy"
status: 200
content-length: 768
x-xss-protection: 1; mode=block
dcs: dcs-prod-irl1-v081-0e58d4b2c.edge-irl1.demdex.com 5.78.0.20200908113611 4ms (+1ms)
pragma: no-cache
last-modified: Sat, 19 Sep 2020 02:53:57 GMT
server: jag
xserver: anedge-6485bbc5d6-mpwzt
etag: 3436827755840634880-4621444201506856729
vary: *
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Thu, 17 Sep 2020 02:53:57 GMT

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 425 B
942 B 120ms
120ms XHR
application/json 99.84.144.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fhotforsecurity.bitdefender.com%2Fblog%2Fwordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html&page_title=WordPress%20Websites%20Attacked%20via%20File%20Manager%20Plugin%20Vulnerability%20%E2%80%93%20HOTforSecurity&src=tag&key=4df37d5c7636f0687f8288c1a889681f
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/ee38c350.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.144.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-144-62.txl52.r.cloudfront.net
Software: nginx /
Resource Hash: 5a55f4df74cbd026360319f0171afb69e728c975fa28490fa8b22ab32e675f62

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 02:53:57 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: TXL52-C1
x-cache: Miss from cloudfront
status: 200
request-id: 511cafb7-325a-491f-b5f8-e508714cbc3a
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://hotforsecurity.bitdefender.com
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 a477b8537c9bc4c10a3c144386a7b5bf.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: gi3G3pm-WVghaZfA0ZYB8qXE8r2rNgZAwkkgIM60zEWjYsja0LfGnw==
expires: Thu, 17 Sep 2020 02:53:57 GMT

GET
H/1.1

200
OK

validateCookie
segments.company-target.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/demandbase
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
https://segments.company-target.com/log?vendor=choca&user_id=AARMX06-yEMAAA-D3icOFw
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AARMX06-yEMAAA-D3icOFw&verifyHash=4e78f503d31b295a1c50f49638b40a4a404c63a4

26 B
409 B

226ms
226ms

Image
image/gif

143.204.201.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/validateCookie?vendor=choca&user_id=AARMX06-yEMAAA-D3icOFw&verifyHash=4e78f503d31b295a1c50f49638b40a4a404c63a4
Requested by: Host: hotforsecurity.bitdefender.com
URL: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.201.2 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-201-2.fra53.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer: https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 18 Sep 2020 02:53:58 GMT
Via: 1.1 269bfdd288bfea5423a4e9e701777da6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Vary: Origin
X-Cache: Miss from cloudfront
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
trace-id: f361d5652dc65ec9
X-Amz-Cf-Id: ePhvx7YeY83UUi9i6LG2gBVE81ssKv-QzlX5-4LVBHA6it59hfS4Nw==

Redirect headers

Date: Fri, 18 Sep 2020 02:53:58 GMT
Via: 1.1 269bfdd288bfea5423a4e9e701777da6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Vary: Origin
X-Cache: Miss from cloudfront
Location: /validateCookie?vendor=choca&user_id=AARMX06-yEMAAA-D3icOFw&verifyHash=4e78f503d31b295a1c50f49638b40a4a404c63a4
Connection: keep-alive
trace-id: 88c51479f80822be
Content-Length: 0
X-Amz-Cf-Id: Vucn_TmjWmDvhFP2h7AfFyJTfxcgWJ3hCVwVntPBq4ejRrVLWQRpBQ==

Verdicts & Comments Add Verdict or Comment

200 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

24 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.demdex.net/	1970-01-19 16:52:29	Name: dextp Value: 60-1-1600397637384\|121998-1-1600397637486\|129099-1-1600397637586
.bitdefender.com/	1970-01-19 13:16:29	Name: __cfduid Value: dfc3af3c4af4403ad5d38161b610e84111600397635
.demdex.net/	1970-01-19 16:52:29	Name: demdex Value: 61013499430593030802490060580551072979
.bitdefender.com/	1969-12-31 23:59:59	Name: s_ppv Value: h4s%253Aarticle%253Awordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048%2C34%2C34%2C1200%2C1600%2C1200%2C1600%2C1200%2C1%2CP
.bitdefender.com/	1970-01-20 06:04:29	Name: AMCV_0E920C0F53DA9E9B0A490D45%40AdobeOrg Value: 2000951482%7CMCIDTS%7C18524%7CMCMID%7C60993458386039419992487987197801393684%7CMCAAMLH-1601002437%7C6%7CMCAAMB-1601002437%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1600404837s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18531%7CvVersion%7C5.0.1
.bitdefender.com/	1970-01-19 21:18:53	Name: _hjid Value: 62953af1-49b3-4cf9-9b89-29f21303406f
.bitdefender.com/	1969-12-31 23:59:59	Name: s_ppvl Value: h4s%253Aarticle%253Awordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048%2C34%2C34%2C1200%2C1600%2C1200%2C1600%2C1200%2C1%2CP
.bitdefender.com/	1969-12-31 23:59:59	Name: _hjTLDTest Value: 1
.bitdefender.com/	1969-12-31 23:59:59	Name: s_ht Value: 1600397637658
.bitdefender.com/	1970-01-19 12:33:19	Name: s_dfa Value: bitdefenderproduction
.hotforsecurity.bitdefender.com/	1970-01-19 13:16:29	Name: aam_uuid Value: 61013499430593030802490060580551072979
.bitdefender.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.bitdefender.com/	1970-01-19 12:34:44	Name: _gid Value: GA1.2.348573692.1600397637
.bitdefender.com/	1969-12-31 23:59:59	Name: s_hc Value: 1%7C0%7C0%7C0%7C0
.bitdefender.com/	1970-01-19 12:33:19	Name: _hjAbsoluteSessionInProgress Value: 0
.bitdefender.com/	1970-01-19 21:18:53	Name: bd112 Value: XY%2FBTsQwDET%2FJQdOpCm71S4URVz2yhcQDmnrJhZpEjluC0L8O21vcLLHejMav32LmYJohWfOrVFGretadcgDjBAHoKpPk1EFGYx6tRiNchCBbLihQ96GZfuStVFdSG5zJxoyQSlyhW53FWmZbf8Bg1zQyhEDyMlG64BkDrPDKJc57IkdBuQveWrq5rHyPIU7O%2BVn1gWjC3CIIWiIx%2Ba1T9wU6CvqPqu0%2BD%2BdI%2FBBlZ0aE23cTFv4%2F8cOCIi0uBeMExTeDqJ9uNT1%2Bel6OV9%2F3n8B
.bitdefender.com/	1970-01-19 12:33:17	Name: _gat Value: 1
.bitdefender.com/	1970-01-20 06:04:29	Name: s_ecid Value: MCMID%7C60993458386039419992487987197801393684
.bitdefender.com/	1970-01-19 12:33:19	Name: dmdbase_cdc Value: DBSET
.bitdefender.com/	1970-01-20 06:07:22	Name: mbox Value: session#a8efe6f88db74faaa7a33d222f0309ca#1600399497\|PC#a8efe6f88db74faaa7a33d222f0309ca.37_0#1663642438
.bitdefender.com/	1970-01-19 12:33:19	Name: mboxEdgeCluster Value: 37
.bitdefender.com/	1970-01-20 06:04:29	Name: _ga Value: GA1.2.1322363566.1600397637
.bitdefender.com/	1969-12-31 23:59:59	Name: at_check Value: true
.bitdefender.com/	1969-12-31 23:59:59	Name: AMCVS_0E920C0F53DA9E9B0A490D45%40AdobeOrg Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.company-target.com
assets.adobedtm.com
bitdefender.demdex.net
bitdefender.tt.omtrdc.net
cm.everesttech.net
download.bitdefender.com
dpm.demdex.net
edge.fullstory.com
fls.doubleclick.net
fonts.googleapis.com
fonts.gstatic.com
fullstory.com
hotforsecurity.bitdefender.com
match.prod.bidr.io
px.ads.linkedin.com
rs.fullstory.com
script.hotjar.com
scripts.demandbase.com
secure.gravatar.com
segments.company-target.com
snap.licdn.com
sstats.bitdefender.com
static.hotjar.com
stats.g.doubleclick.net
tag.demandbase.com
vars.hotjar.com
www.bitdefender.com
www.google-analytics.com
www.linkedin.com
143.204.201.2
143.204.201.40
147.75.32.125
147.75.84.91
15.236.9.100
192.229.220.142
216.58.212.134
2600:1901:0:2470::
2606:4700::6812:a9de
2620:1ec:21::14
2a00:1450:4001:819::200a
2a00:1450:4001:81d::2003
2a00:1450:4001:821::200e
2a00:1450:400c:c0c::9d
2a02:26f0:6c00:28a::1e80
2a02:26f0:6c00:296::25ea
2a04:fa87:fffe::c000:4902
2a05:f500:10:101::b93f:9105
35.186.194.58
35.201.112.186
52.209.239.68
52.212.22.61
54.76.99.142
66.117.28.86
99.84.144.124
99.84.144.62
0199e005e1574444217590e9fe93bb935175faad3cb4a621eec9be03aa8ba6fb
0659613b273942da1c8965a916f32f6f3cfdb020f61c1a3432ee74649d24b1c9
0bafb2bfda20c5019c125a7f3bb4d7c51abf848201dd589e5cd67d0070f8b58a
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
12229fc93eb6a5572501671207da32beb14c969a0f78bd2ed4bdf254cac1ffd1
131ea672276e17b2cbdc4536f44a2d873b98905ea9081f6d0e3c9a64eb465b69
13c93fe0e5e18bb4cff177634ecdb8fedb52afdf3c4d2b4cb6f1ef1cf481e9c4
159526f78a28685850dc55b5b8776267c1b242fd12504e7d8e7e838b22a849cd
1776651e4a3c9aeb0124d70ef86c2832dc6900251e7771124b482283256d710d
1d13655d1693b0b46340f6b5391c0154b6566fcfe95741d40674ae9a1b5a0293
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
2167182ab5b869828b4d8dd119d7b933c189f6aab1776b50877e558c15c223f1
2f64b025cec8c93dcb01fe88f0e79c134bc0a6c751787360153865dfa9f3a962
306c9714fc0da628f79970bbcc854b8bbbda370dbf90fe73486330eab400be0e
3426d7ced4ac00288838068e457aca4d7804c1e5e9a92ef61a858d3e97fae4f6
382fe3dd880202e9e2971b7ae531720bc1bf2bb68decbc507d04e64b62531f44
3aca6f2b898088dab64aaba8faa7d6d90dabaa257a2e2d906832137efda5dcf9
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3c502ab7dd81c6a775f58e6b0a866befc8c444377d8a8ec4c07b03063db34834
3e0383e88d2588eac46cae98bdbc97d681f0ed2540059dbf1106b2d85f92a38d
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
45ec87d00e5f0cc159b247f104d7ba531bd97d3d9585e3d533797294c350a6c4
483741ab3576b4cdf24b73a2f017ea6e20468471b387cc484eccee5fd1fd1cb4
4d0d2a0d54d25d91923590d3383b8aac038fa588a499df562598fd18064c88df
52193931ee193d8ab70d0bb34f251f5849b092b783c2d671184a7853e86a040a
5a55f4df74cbd026360319f0171afb69e728c975fa28490fa8b22ab32e675f62
5d0b40b416f93d141dba676a4736692de67b2dba9b47ab6d8801ca0f639c1a95
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0
83af74f9ae1d1e4be00a7e271ab233c20ecc5769bdbd1c72e0524dc86bdf12e4
84f7bdd9d518f244e12254d2dab2827a56fa1c0be95dd685178105518fdd94d2
862d25e6731d8163d089dc54c7b5e7f658c2735d726f3765d2c8b492566e85e6
89b026459d5ad9b78afcd0ba868276048e24e67d75bf0737e08e33552edb3cee
8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af
8cb438bd4d1961f80ade4f1a295ca7de253630adcdd10473932908e638908c5e
8ee6a829478761f158d239ceb4dd636ae4e703dc1970057c71628549d1de6d14
8f1495396c589ea4cd4497c74fe9e218e9913e38504847ad4361d12d7b13bda9
9686dcf96ed3c3715acee18bcb43ce45cc494609a6e60c0406863494550a5a56
a73b5169f6b32abacf73b3e8c2e199528e16dee392a605f6fcd15de325b9b09f
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b03fe35dd277d33be3e4fa547ad92dbd33b250dd0545776716fc4aa28b4c2bfc
b47116dba01d7e6bac5d27ef84a0963de4fbe7ae36592fddda0c54a1fc8c8be2
b4eaafafc797a31bcb3e91a0c171404d8084ab3b924e7e0ee94bc1dab35bb7d5
b5fb6443344734b6a16af14f4fd4446832356d3b4b1b566df218678a098ba2ca
b7e17926b30342edecee8b3a93029ac51462e2b479277d8e077ba57173eb1900
b82eefb6a4f332f80cf77897057def50d542447398557c6be322d86a3ebe613b
c05ee8fac93fde19412046a913b9aecd86210aba6b72cff7c94e01170dd11e3b
c0c7ff312fbaf1ee09e030009f39eef707d97de32504fd2b3ef3e0ec7c5b60f1
c111a297fcbcf2e7a78ac5525f6f58fed3f9a6bf0b4ebc4212089943d92bb76f
d0cbfb1ab0f94123834567e32df7ec74a1c210793f797368d41a4b4c2732d4a0
d792afdac7f7ae5de7c6964950c6c61dc6e3f3813180a59e141c7cb4ac4364dc
d7b38fb952a78e6eb880a5bd612db89e572edf28a14f63830744bd97856e5dc5
db7e27157a918cd3ebf833e1544924cab8837dbcaebe9e00989020ad3e43283d
dbf0fbbf5d89d767d911d99bd4d56fab45682d60a8e337ea9367e02879bd1950
dc1a3a3bf97eada084f65b5d87085ddb8d3a76a9e450c6a41211e1698048de91
ddb5f37e49e5bb129115dc56bf737c89b3a27770107d3c24abe60b2cec84460e
e07021158049cd2c874f0aa3c3eb60c126414affb59e7185838dcc62531406a0
e0971026066e53fcd75d7f54008d457c621f42ff371ccfc3075684efc7405d8a
e15d1f89cbc821b0605f601a862e07b8e1b77075ece6439d726768183c4ec9de
e1ae4fa36b6ad8f568dd6e04e1e8d5ff9fa87b2f35d90992313eff26eedcb486
e32a6ae5e43f7f652674e0f03dc23f86839f839b29ee4e63c01c93da180bb0d0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4e3e93e78b70bc6e4a01cd3669047ccc88f0c8df0383ade180909c0f2870580
e4f237433fef48f03ba6d84f2677528e1a555fd7956d3b01e09e79d2b326f57d
e5ad690c7a754826152d2ecab11de59d6d03326ff66af754860112601ca157c3
e6ea464d3d20c2a23b116f868ba8e02e8f79580632cfa26d7721026a49d66b31
edefa01f1cd7ecdfc0ad42300ae3583e3d3f51f0b5a2be2bd476aeebf47f2514
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f9fd92d837373a6762b0b91f80f038ddcf08ee3a2a46efc7dbbe66320008fb07

hotforsecurity.bitdefender.com Open in urlscan Pro 2606:4700::6812:a9de Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

73 Requests

100 %HTTPS

42 %IPv6

17 Domains

29 Subdomains

22 IPs

7 Countries

1581 kBTransfer

3807 kBSize

24 Cookies

31 Outgoing links

Redirected requests

73 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

hotforsecurity.bitdefender.com Open in urlscan Pro
2606:4700::6812:a9de Public Scan

Screenshot
Live screenshot

Full Image

73
Requests

100 %
HTTPS

42 %
IPv6

17
Domains

29
Subdomains

22
IPs

7
Countries

1581 kB
Transfer

3807 kB
Size

24
Cookies

73 HTTP transactions
0 data transactions