![](/screenshots/e2e6ec0c-2f10-4925-84ac-f19a6c95dce5.png)
blog.kandji.io
Open in
urlscan Pro
2606:2c40::c73c:67e3
Public Scan
Effective URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_ca...
Submission: On May 07 via manual from TW — Scanned from US
Summary
TLS certificate: Issued by E1 on March 11th 2024. Valid for: 3 months.
This is the only time blog.kandji.io was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 35.227.211.136 35.227.211.136 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 34.95.127.121 34.95.127.121 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 | 2606:2c40::c7... 2606:2c40::c73c:67e3 | 209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare) | |
3 | 199.60.103.29 199.60.103.29 | 209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare) | |
1 | 108.139.47.20 108.139.47.20 | 16509 (AMAZON-02) (AMAZON-02) | |
8 | 104.19.178.52 104.19.178.52 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 142.250.80.8 142.250.80.8 | 15169 (GOOGLE) (GOOGLE) | |
1 | 172.64.155.119 172.64.155.119 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
8 | 52.45.196.192 52.45.196.192 | 14618 (AMAZON-AES) (AMAZON-AES) | |
2 | 142.251.40.206 142.251.40.206 | 15169 (GOOGLE) (GOOGLE) | |
1 | 142.251.111.155 142.251.111.155 | 15169 (GOOGLE) (GOOGLE) | |
1 2 | 142.251.40.98 142.251.40.98 | 15169 (GOOGLE) (GOOGLE) | |
2 3 | 142.250.72.98 142.250.72.98 | 15169 (GOOGLE) (GOOGLE) | |
3 | 142.250.80.68 142.250.80.68 | 15169 (GOOGLE) (GOOGLE) | |
2 | 31.13.71.7 31.13.71.7 | 32934 (FACEBOOK) (FACEBOOK) | |
1 | 31.13.71.36 31.13.71.36 | 32934 (FACEBOOK) (FACEBOOK) | |
1 | 172.64.146.132 172.64.146.132 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
40 | 16 |
ASN15169 (GOOGLE, US)
PTR: 136.211.227.35.bc.googleusercontent.com
kandji.sjv.io |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 121.127.95.34.bc.googleusercontent.com
www.ojrq.net |
ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
blog.kandji.io |
ASN16509 (AMAZON-02, US)
PTR: server-108-139-47-20.jfk50.r.cloudfront.net
ob.testrobotflower.com |
ASN15169 (GOOGLE, US)
PTR: lga34s33-in-f8.1e100.net
www.googletagmanager.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-196-192.compute-1.amazonaws.com
obs.testrobotflower.com |
ASN15169 (GOOGLE, US)
PTR: lga34s38-in-f14.1e100.net
analytics.google.com |
ASN15169 (GOOGLE, US)
PTR: bk-in-f155.1e100.net
stats.g.doubleclick.net |
ASN15169 (GOOGLE, US)
PTR: lga25s79-in-f2.1e100.net
www.googleadservices.com |
ASN15169 (GOOGLE, US)
PTR: lga34s32-in-f2.1e100.net
googleads.g.doubleclick.net |
ASN15169 (GOOGLE, US)
PTR: lga34s35-in-f4.1e100.net
www.google.com |
ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-lga3.fbcdn.net
connect.facebook.net |
ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-lga3.facebook.com
www.facebook.com |
ASN13335 (CLOUDFLARENET, US)
5058330.fs1.hubspotusercontent-na1.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
testrobotflower.com
ob.testrobotflower.com — Cisco Umbrella Rank: 364650 obs.testrobotflower.com — Cisco Umbrella Rank: 301542 |
40 KB |
8 |
cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 312 |
153 KB |
5 |
google.com
analytics.google.com — Cisco Umbrella Rank: 154 www.google.com — Cisco Umbrella Rank: 2 |
978 B |
4 |
doubleclick.net
2 redirects
stats.g.doubleclick.net — Cisco Umbrella Rank: 89 googleads.g.doubleclick.net — Cisco Umbrella Rank: 35 |
4 KB |
4 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39 |
408 KB |
4 |
kandji.io
blog.kandji.io |
178 KB |
2 |
facebook.net
connect.facebook.net — Cisco Umbrella Rank: 183 |
72 KB |
2 |
googleadservices.com
1 redirects
www.googleadservices.com — Cisco Umbrella Rank: 126 |
2 KB |
2 |
sjv.io
2 redirects
kandji.sjv.io |
1013 B |
1 |
hubspotusercontent-na1.net
5058330.fs1.hubspotusercontent-na1.net |
92 KB |
1 |
facebook.com
www.facebook.com — Cisco Umbrella Rank: 101 |
273 B |
1 |
onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 533 |
309 B |
1 |
ojrq.net
1 redirects
www.ojrq.net — Cisco Umbrella Rank: 5551 |
589 B |
40 | 13 |
Domain | Requested by | |
---|---|---|
8 | obs.testrobotflower.com |
ob.testrobotflower.com
blog.kandji.io |
8 | cdn.cookielaw.org |
blog.kandji.io
cdn.cookielaw.org |
4 | www.googletagmanager.com |
blog.kandji.io
www.googletagmanager.com |
4 | blog.kandji.io |
blog.kandji.io
|
3 | www.google.com |
blog.kandji.io
|
3 | googleads.g.doubleclick.net |
2 redirects
www.googletagmanager.com
|
2 | connect.facebook.net |
www.googletagmanager.com
connect.facebook.net |
2 | www.googleadservices.com |
1 redirects
www.googletagmanager.com
|
2 | analytics.google.com |
www.googletagmanager.com
|
2 | kandji.sjv.io | 2 redirects |
1 | 5058330.fs1.hubspotusercontent-na1.net |
blog.kandji.io
|
1 | www.facebook.com |
blog.kandji.io
|
1 | stats.g.doubleclick.net |
www.googletagmanager.com
|
1 | geolocation.onetrust.com |
cdn.cookielaw.org
|
1 | ob.testrobotflower.com |
blog.kandji.io
|
1 | www.ojrq.net | 1 redirects |
40 | 16 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.kandji.io |
support.kandji.io |
kandji-partner.workramp.io |
Subject Issuer | Validity | Valid | |
---|---|---|---|
blog.kandji.io E1 |
2024-03-11 - 2024-06-09 |
3 months | crt.sh |
*.testrobotflower.com Amazon RSA 2048 M02 |
2023-07-18 - 2024-08-16 |
a year | crt.sh |
cookielaw.org Cloudflare Inc ECC CA-3 |
2024-03-01 - 2024-12-31 |
10 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
onetrust.com Cloudflare Inc ECC CA-3 |
2023-11-13 - 2024-11-12 |
a year | crt.sh |
*.google.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
*.googleadservices.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2024-02-14 - 2024-05-14 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
hubspotusercontent-na1.net Cloudflare Inc ECC CA-3 |
2023-12-26 - 2024-12-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Frame ID: 16EEA35C31BFF2AE671BE9DA2D68352E
Requests: 40 HTTP requests in this frame
Screenshot
![](/screenshots/e2e6ec0c-2f10-4925-84ac-f19a6c95dce5.png)
Page Title
Malware: Cuckoo Behaves Like Cross Between Infostealer and SpywarePage URL History Show full URLs
-
https://kandji.sjv.io/c/221109/1475702/17435?subId1=tomsguide-us-8126601953889851819&sharedId=toms...
HTTP 302
https://www.ojrq.net/p/?return=https%3A%2F%2Fkandji.sjv.io%2Fc%2F221109%2F1475702%2F17435%3FsubId... HTTP 302
https://kandji.sjv.io/c/221109/1475702/17435?subId1=tomsguide-us-8126601953889851819&sharedId=toms... HTTP 301
https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUk... Page URL
Detected technologies
Detected patterns
- //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Detected patterns
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/gtm\.js
- googletagmanager\.com/gtag/js
![](/vendor/wappa/icons/OneTrust.png)
Detected patterns
- cdn\.cookielaw\.org
- otSDKStub\.js
Page Statistics
37 Outgoing links
These are links going to different origins than the main page.
Title: Book a Demo
Search URL Search Domain Scan URL
Title: Request Pricing
Search URL Search Domain Scan URL
Title: Virtual Tour
Search URL Search Domain Scan URL
Title: Kandji logo
Search URL Search Domain Scan URL
Title: Device Harmony
Search URL Search Domain Scan URL
Title: Device Management
Search URL Search Domain Scan URL
Title: Endpoint Detection & Response
Search URL Search Domain Scan URL
Title: Pricing
Search URL Search Domain Scan URL
Title: Support
Search URL Search Domain Scan URL
Title: Deploy
Search URL Search Domain Scan URL
Title: Secure
Search URL Search Domain Scan URL
Title: Configure
Search URL Search Domain Scan URL
Title: Manage
Search URL Search Domain Scan URL
Title: Integrate
Search URL Search Domain Scan URL
Title: Liftoff
Search URL Search Domain Scan URL
Title: Passport
Search URL Search Domain Scan URL
Title: Auto Apps
Search URL Search Domain Scan URL
Title: Managed OS
Search URL Search Domain Scan URL
Title: Migration
Search URL Search Domain Scan URL
Title: Compliance
Search URL Search Domain Scan URL
Title: Prism
Search URL Search Domain Scan URL
Title: iOS & iPadOS
Search URL Search Domain Scan URL
Title: Resources Hub
Search URL Search Domain Scan URL
Title: Customer Stories
Search URL Search Domain Scan URL
Title: MacAdmins Community
Search URL Search Domain Scan URL
Title: Security Details
Search URL Search Domain Scan URL
Title: Resellers
Search URL Search Domain Scan URL
Title: Technology Partners
Search URL Search Domain Scan URL
Title: Become a Partner
Search URL Search Domain Scan URL
Title: Register a Deal
Search URL Search Domain Scan URL
Title: Partner Portal
Search URL Search Domain Scan URL
Title: About Kandji
Search URL Search Domain Scan URL
Title: Careers
Search URL Search Domain Scan URL
Title: News & Press
Search URL Search Domain Scan URL
Title: Contact
Search URL Search Domain Scan URL
Title: Log in
Search URL Search Domain Scan URL
Title: Get Started
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://kandji.sjv.io/c/221109/1475702/17435?subId1=tomsguide-us-8126601953889851819&sharedId=tomsguide-us&u=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware
HTTP 302
https://www.ojrq.net/p/?return=https%3A%2F%2Fkandji.sjv.io%2Fc%2F221109%2F1475702%2F17435%3FsubId1%3Dtomsguide-us-8126601953889851819%26sharedId%3Dtomsguide-us%26u%3Dhttps%253A%252F%252Fblog.kandji.io%252Fmalware-cuckoo-infostealer-spyware%26level%3D1&cid=17435&tpsync=yes&auth=573b513a0f75de83 HTTP 302
https://kandji.sjv.io/c/221109/1475702/17435?subId1=tomsguide-us-8126601953889851819&sharedId=tomsguide-us&u=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware&level=1&brwsr=a9b49999-0c10-11ef-b5c3-bbaddcbed6e5&brwsrsig=zBEyXr09RxETzwwUsiSqxyyhXXkUyS HTTP 301
https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 15- https://www.googleadservices.com/pagead/conversion/781421631/?label=1lluCKXMhqUZEL-YzvQC&guid=ON&script=0 HTTP 302
- https://googleads.g.doubleclick.net/pagead/viewthroughconversion/781421631/?label=1lluCKXMhqUZEL-YzvQC&guid=ON&script=0&ct_cookie_present=false&random=543707229&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJfBsQI&pscrd=IhMIkKr0-LD6hQMV84qDCB0oIA2xMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6nwJodHRwczovL2Jsb2cua2FuZGppLmlvL21hbHdhcmUtY3Vja29vLWluZm9zdGVhbGVyLXNweXdhcmU_aW1wYWN0X2NsaWNraWQ9V3ZZUnZCMGNreHlLVGl6VFBOVmUtVkR0VWtIVC1TU1kxVGlPVWswJnV0bV9jYW1wYWlnbj1GdXR1cmUlMjBQTEMuJnV0bV9tZWRpdW09QWZmaWxpYXRlJnV0bV9jb250ZW50PU9ubGluZSUyMFRyYWNraW5nJTIwTGluayZ1dG1fc291cmNlPUZ1dHVyZSUyMFBMQy4mdXRtX3Rlcm09SW1wYWN0JmlyZ3djPTEmcGFydG5lcj1GdXR1cmUlMjBQTEMuJm1waWQ9MjIxMTA5Jmdyb3VwPQ HTTP 302
- https://www.google.com/pagead/1p-conversion/781421631/?label=1lluCKXMhqUZEL-YzvQC&guid=ON&script=0&ct_cookie_present=false&random=543707229&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJfBsQI&pscrd=IhMIkKr0-LD6hQMV84qDCB0oIA2xMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6nwJodHRwczovL2Jsb2cua2FuZGppLmlvL21hbHdhcmUtY3Vja29vLWluZm9zdGVhbGVyLXNweXdhcmU_aW1wYWN0X2NsaWNraWQ9V3ZZUnZCMGNreHlLVGl6VFBOVmUtVkR0VWtIVC1TU1kxVGlPVWswJnV0bV9jYW1wYWlnbj1GdXR1cmUlMjBQTEMuJnV0bV9tZWRpdW09QWZmaWxpYXRlJnV0bV9jb250ZW50PU9ubGluZSUyMFRyYWNraW5nJTIwTGluayZ1dG1fc291cmNlPUZ1dHVyZSUyMFBMQy4mdXRtX3Rlcm09SW1wYWN0JmlyZ3djPTEmcGFydG5lcj1GdXR1cmUlMjBQTEMuJm1waWQ9MjIxMTA5Jmdyb3VwPQ&is_vtc=1&cid=CAQSGwB7FLtqKdV_AlB_xNRLbx5iIkqAMRJJ-6dFjQ&random=814196700
- https://googleads.g.doubleclick.net/pagead/viewthroughconversion/781421631/?random=807699336&cv=11&fst=1715045119437&bg=ffffff&guid=ON&async=1>m=45be4510v885711243za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware%3Fimpact_clickid%3DWvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0%26utm_campaign%3DFuture%2520PLC.%26utm_medium%3DAffiliate%26utm_content%3DOnline%2520Tracking%2520Link%26utm_source%3DFuture%2520PLC.%26utm_term%3DImpact%26irgwc%3D1%26partner%3DFuture%2520PLC.%26mpid%3D221109%26group%3D&label=1lluCKXMhqUZEL-YzvQC&hn=www.googleadservices.com&frm=0&tiba=Malware%3A%20Cuckoo%20Behaves%20Like%20Cross%20Between%20Infostealer%20and%20Spyware>m_ee=1&npa=0&pscdl=noapi&auid=1831954258.1715045119&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.118%7CGoogle%2520Chrome%3B124.0.6367.118%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&ec_mode=a&fdr=QA&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJfBsQI&pscrd=IhMI2dr5-LD6hQMVWq2DCB0vGAUwMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6nwJodHRwczovL2Jsb2cua2FuZGppLmlvL21hbHdhcmUtY3Vja29vLWluZm9zdGVhbGVyLXNweXdhcmU_aW1wYWN0X2NsaWNraWQ9V3ZZUnZCMGNreHlLVGl6VFBOVmUtVkR0VWtIVC1TU1kxVGlPVWswJnV0bV9jYW1wYWlnbj1GdXR1cmUlMjBQTEMuJnV0bV9tZWRpdW09QWZmaWxpYXRlJnV0bV9jb250ZW50PU9ubGluZSUyMFRyYWNraW5nJTIwTGluayZ1dG1fc291cmNlPUZ1dHVyZSUyMFBMQy4mdXRtX3Rlcm09SW1wYWN0JmlyZ3djPTEmcGFydG5lcj1GdXR1cmUlMjBQTEMuJm1waWQ9MjIxMTA5Jmdyb3VwPQ HTTP 302
- https://www.google.com/pagead/1p-conversion/781421631/?random=807699336&cv=11&fst=1715045119437&bg=ffffff&guid=ON&async=1>m=45be4510v885711243za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware%3Fimpact_clickid%3DWvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0%26utm_campaign%3DFuture%2520PLC.%26utm_medium%3DAffiliate%26utm_content%3DOnline%2520Tracking%2520Link%26utm_source%3DFuture%2520PLC.%26utm_term%3DImpact%26irgwc%3D1%26partner%3DFuture%2520PLC.%26mpid%3D221109%26group%3D&label=1lluCKXMhqUZEL-YzvQC&hn=www.googleadservices.com&frm=0&tiba=Malware%3A%20Cuckoo%20Behaves%20Like%20Cross%20Between%20Infostealer%20and%20Spyware>m_ee=1&npa=0&pscdl=noapi&auid=1831954258.1715045119&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.118%7CGoogle%2520Chrome%3B124.0.6367.118%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&ec_mode=a&fdr=QA&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJfBsQI&pscrd=IhMI2dr5-LD6hQMVWq2DCB0vGAUwMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6nwJodHRwczovL2Jsb2cua2FuZGppLmlvL21hbHdhcmUtY3Vja29vLWluZm9zdGVhbGVyLXNweXdhcmU_aW1wYWN0X2NsaWNraWQ9V3ZZUnZCMGNreHlLVGl6VFBOVmUtVkR0VWtIVC1TU1kxVGlPVWswJnV0bV9jYW1wYWlnbj1GdXR1cmUlMjBQTEMuJnV0bV9tZWRpdW09QWZmaWxpYXRlJnV0bV9jb250ZW50PU9ubGluZSUyMFRyYWNraW5nJTIwTGluayZ1dG1fc291cmNlPUZ1dHVyZSUyMFBMQy4mdXRtX3Rlcm09SW1wYWN0JmlyZ3djPTEmcGFydG5lcj1GdXR1cmUlMjBQTEMuJm1waWQ9MjIxMTA5Jmdyb3VwPQ&is_vtc=1&cid=CAQSGwB7FLtqG9hjyYjpxkwzdbkmJAAz4qPumRMrzw&random=1515134654
40 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
malware-cuckoo-infostealer-spyware
blog.kandji.io/ Redirect Chain
|
29 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
project.js
blog.kandji.io/hs/hsstatic/cos-i18n/static-1.53/bundles/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v2.js
blog.kandji.io/_hcms/forms/ |
482 KB 162 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
130ddaec76c305292f6ec30ebef2d5ce.js
ob.testrobotflower.com/i/ |
102 KB 38 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OtAutoBlock.js
cdn.cookielaw.org/consent/52104b08-403c-474b-8e63-8560d38d0080/ |
50 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otSDKStub.js
cdn.cookielaw.org/scripttemplates/ |
21 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
kandji.min.css
blog.kandji.io/hs-fs/hub/5058330/hub_generated/template_assets/95659790937/1714606602095/Kandji_December2022/css/ |
78 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
52104b08-403c-474b-8e63-8560d38d0080.json
cdn.cookielaw.org/consent/52104b08-403c-474b-8e63-8560d38d0080/ |
4 KB 2 KB |
XHR
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
334 KB 106 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/ |
71 B 309 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ct
obs.testrobotflower.com/ |
5 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
335 KB 107 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
335 KB 107 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
analytics.google.com/g/ |
0 253 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/g/ |
0 253 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
257 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-conversion/781421631/ Redirect Chain
|
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tc_imp.gif
obs.testrobotflower.com/tracker/ |
43 B 79 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
3986c830-9eb0-4353-a0b8-3ee56c388081
https://blog.kandji.io/ |
261 B 0 |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
38007fd9-8fe5-4840-9fb1-602171884157
https://blog.kandji.io/ |
529 B 0 |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/202303.1.0/ |
407 KB 98 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/781421631/ |
3 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
www.googleadservices.com/pagead/conversion/781421631/ |
3 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
en.json
cdn.cookielaw.org/consent/52104b08-403c-474b-8e63-8560d38d0080/03671698-6fce-41d2-9923-6d638bd47d4c/ |
102 KB 19 KB |
Fetch
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-conversion/781421631/ Redirect Chain
|
42 B 108 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fbevents.js
connect.facebook.net/en_US/ |
218 KB 59 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otFloatingFlat.json
cdn.cookielaw.org/scripttemplates/202303.1.0/assets/ |
10 KB 3 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otPcCenter.json
cdn.cookielaw.org/scripttemplates/202303.1.0/assets/v2/ |
61 KB 12 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/202303.1.0/assets/ |
21 KB 4 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
821678078239751
connect.facebook.net/signals/config/ |
66 KB 14 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ |
0 273 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/pagead/1p-user-list/781421631/ |
42 B 455 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
mon
obs.testrobotflower.com/ |
0 146 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
mon
obs.testrobotflower.com/ |
0 16 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
mon
obs.testrobotflower.com/ |
0 39 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
analytics.google.com/g/ |
0 54 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
mon
obs.testrobotflower.com/ |
0 39 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PPNeueMontreal-Variable.ttf
5058330.fs1.hubspotusercontent-na1.net/hubfs/5058330/raw_assets/public/Kandji_December2022/fonts/ |
190 KB 92 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
mon
obs.testrobotflower.com/ |
0 39 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
mon
obs.testrobotflower.com/ |
0 39 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| domReady function| onCheqResponse object| OneTrustStub function| OptanonWrapper object| dataLayer function| __ctcg_ct_57239_exec object| google_tag_manager object| google_tag_data function| gtag function| onYouTubeIframeAPIReady object| gaGlobal object| _cq string| cq_req_id string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData object| GooglebQhCsO object| Optanon object| OneTrust function| fbq function| _fbq object| _fbq_gtm_ids14 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.ojrq.net/ | Name: brwsr Value: a9b49999-0c10-11ef-b5c3-bbaddcbed6e5 |
|
.sjv.io/ | Name: brwsr Value: a9b49999-0c10-11ef-b5c3-bbaddcbed6e5 |
|
kandji.sjv.io/ | Name: irld Value: LVXyzY-X8gwM2Q4Q3mjUwhWULVpSVGXyKdWAnSZ%3AT4I3I7X0z |
|
.kandji.io/ | Name: _cq_duid Value: 1.1715045118.sDO7ZUho2EPH9mSI |
|
.kandji.io/ | Name: _cq_suid Value: 1.1715045118.OtkzT43yckAyU8xS |
|
.kandji.io/ | Name: _ga Value: GA1.1.903398415.1715045119 |
|
obs.testrobotflower.com/ | Name: cg_uuid Value: 86df4a77cd6d6cfeeccd5a8cfe1f04d9 |
|
.kandji.io/ | Name: _ga_V21CT0R1FX Value: GS1.1.1715045119.1.0.1715045119.60.0.0 |
|
.kandji.io/ | Name: _gcl_au Value: 1.1.1831954258.1715045119 |
|
.kandji.io/ | Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Mon+May+06+2024+15%3A25%3A19+GMT-1000+(Hawaii-Aleutian+Standard+Time)&version=202303.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware%3Fimpact_clickid%3DWvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0%26utm_campaign%3DFuture%2520PLC.%26utm_medium%3DAffiliate%26utm_content%3DOnline%2520Tracking%2520Link%26utm_source%3DFuture%2520PLC.%26utm_term%3DImpact%26irgwc%3D1%26partner%3DFuture%2520PLC.%26mpid%3D221109%26group%3D |
|
.kandji.io/ | Name: _fbp Value: fb.1.1715045119933.1425587431 |
|
.doubleclick.net/ | Name: test_cookie Value: CheckForPermission |
|
.blog.kandji.io/ | Name: __cfruid Value: cd997ab7c981c2e57287bec23c312ac4310e0821-1715045124 |
|
.blog.kandji.io/ | Name: __cf_bm Value: pDY.nXaGCgRoYz44N5v45KcpJ0u0PQivG4pSIVCer08-1715045124-1.0.1.1-Z00v_e.auDA8hjhmdMiHuUpZglaw3W5NKDM4QRXBrs0Ddarcu7aQRRDa.U0sTVoY4X2fxk6mQiGi2bQEzZPPjg |
14 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests |
Strict-Transport-Security | max-age=31536000 |
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
5058330.fs1.hubspotusercontent-na1.net
analytics.google.com
blog.kandji.io
cdn.cookielaw.org
connect.facebook.net
geolocation.onetrust.com
googleads.g.doubleclick.net
kandji.sjv.io
ob.testrobotflower.com
obs.testrobotflower.com
stats.g.doubleclick.net
www.facebook.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.ojrq.net
104.19.178.52
108.139.47.20
142.250.72.98
142.250.80.68
142.250.80.8
142.251.111.155
142.251.40.206
142.251.40.98
172.64.146.132
172.64.155.119
199.60.103.29
2606:2c40::c73c:67e3
31.13.71.36
31.13.71.7
34.95.127.121
35.227.211.136
52.45.196.192
099d33a1d679bcfa3722a172d91742af80d45166f760db1512e4944a9d95bc23
0ad5dcf0c25bc5b4701df692bd59913ce3ea4504c4e4d5df8ab7b2a9bd19d225
179a0ba55c3bbf759340ba2a57846f81a7de249ed7e502b5e8814af2ef964533
17b3c66292df72b6c315c952f755b9272e0beaee2bb143457c937ec106578cee
1bcfcf052a5f075a974b6161f219e6bd1bbe1c40a11c395f7308b1b903f19f32
20d82657ec70a33dbdafd19d6d1ecee26e0a47e7509f4a7cbf0a781472aed208
250260acfc57d0e8ac6a5e948c5f6108556bdfded2f08e6229bd18d3adc86214
260956d4d537ac0ac99a98735ce0d900b148e5c12fb8c3ebc483cad3e4eba1f9
3dbb76c2655ea2f996850c9101b4217c4343587e61e34555bd4d498de0ae7b69
4da8a6638ad70698ad3d01aa0ef124aebe35c297685c0796b174822f597b1d09
5dfe99f8540962833d70393060fb02ec8a61fc26751fe52faa1d753e7c749984
608854bc9b4ff57f231d9b41b1b325b4a987f48eb56f26d928868acd8a2f30dc
69e1f1c48622424da58b7e0a252ce36635da1ad1ec17a6bc43e395e5e479217e
6f08699117c1f15f6d35e7b4380d12d18a1881f075e177b5853b1017a3307544
7f4f10148f08d9c4d64b6b8e582eb8bea4f3465435b46fdae96076894eb21e57
8bb5b82601b4d9a2d5c0c2114554c057cfcbd14758cbfcc4caabcd22ad9abe6e
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
910f74967a8d03e18bdd8b4a46a1573653c71d374e9823f2d416d9bd250b1ea6
930239150e702d9d4bf43c3881aa70f8ad5fd9068dcbecb7c8bcca654784f7f1
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9d2ed8ff28378191ad747458666b94dbe8cda83914db23a86217fbe7086d74e6
b382967162c482928529c765a21bf9ae4141dd1ccbdbf480140bdbd67eab8991
cd1c23d30067b0cc8081b4558286b54ffa07b3dd3016f9e6a14d9eb8c0e34730
cea95b67c69f3eadce6a5ae44f8c92cdc25d9ecfd4f1f07abddbcc5609508f9e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f171db8dc0eb7cec86c84ceac278dbf2fbe33770334635a2703186d14f4828b2
f589b180c1064f697c91ac117fafda9aff1c66123a099e82da0b976a09011510