blog.kandji.io Open in urlscan Pro
2606:2c40::c73c:67e3 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://kandji.sjv.io/c/221109/1475702/17435?subId1=tomsguide-us-8126601953889851819&sharedId=tomsguide-us&u=https%3A%...
Effective URL:
https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_ca...
Submission: On May 07 via manual (May 7th 2024, 1:25:48 am UTC) from TW — Scanned from US

Summary HTTP 40 Redirects Links 37 Behaviour Indicators

Summary

This website contacted 16 IPs in 2 countries across 13 domains to perform 40 HTTP transactions. The main IP is 2606:2c40::c73c:67e3, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is blog.kandji.io.
TLS certificate: Issued by E1 on March 11th 2024. Valid for: 3 months.

This is the only time blog.kandji.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 2	35.227.211.136 35.227.211.136	15169 (GOOGLE) (GOOGLE)
1 1	34.95.127.121 34.95.127.121	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2606:2c40::c7... 2606:2c40::c73c:67e3	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
3	199.60.103.29 199.60.103.29	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
1	108.139.47.20 108.139.47.20	16509 (AMAZON-02) (AMAZON-02)
8	104.19.178.52 104.19.178.52	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	142.250.80.8 142.250.80.8	15169 (GOOGLE) (GOOGLE)
1	172.64.155.119 172.64.155.119	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	52.45.196.192 52.45.196.192	14618 (AMAZON-AES) (AMAZON-AES)
2	142.251.40.206 142.251.40.206	15169 (GOOGLE) (GOOGLE)
1	142.251.111.155 142.251.111.155	15169 (GOOGLE) (GOOGLE)
1 2	142.251.40.98 142.251.40.98	15169 (GOOGLE) (GOOGLE)
2 3	142.250.72.98 142.250.72.98	15169 (GOOGLE) (GOOGLE)
3	142.250.80.68 142.250.80.68	15169 (GOOGLE) (GOOGLE)
2	31.13.71.7 31.13.71.7	32934 (FACEBOOK) (FACEBOOK)
1	31.13.71.36 31.13.71.36	32934 (FACEBOOK) (FACEBOOK)
1	172.64.146.132 172.64.146.132	13335 (CLOUDFLAR...) (CLOUDFLARENET)
40	16

2 35.227.211.136 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 136.211.227.35.bc.googleusercontent.com

kandji.sjv.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.95.127.121 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 121.127.95.34.bc.googleusercontent.com

www.ojrq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2c40::c73c:67e3 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

blog.kandji.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 199.60.103.29 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

blog.kandji.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.139.47.20 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-47-20.jfk50.r.cloudfront.net

ob.testrobotflower.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.19.178.52 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.80.8 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s33-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.155.119 (None, )

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 52.45.196.192 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-196-192.compute-1.amazonaws.com

obs.testrobotflower.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.40.206 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s38-in-f14.1e100.net

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.111.155 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: bk-in-f155.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.40.98 (Queens, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s79-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.72.98 (Plainview, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s32-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.80.68 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s35-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.13.71.7 (Secaucus, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-lga3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.13.71.36 (Secaucus, United States)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-lga3.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.146.132 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

5058330.fs1.hubspotusercontent-na1.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	testrobotflower.com ob.testrobotflower.com — Cisco Umbrella Rank: 364650 obs.testrobotflower.com — Cisco Umbrella Rank: 301542	40 KB
8	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 312	153 KB
5	google.com analytics.google.com — Cisco Umbrella Rank: 154 www.google.com — Cisco Umbrella Rank: 2	978 B
4	doubleclick.net 2 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 89 googleads.g.doubleclick.net — Cisco Umbrella Rank: 35	4 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	408 KB
4	kandji.io blog.kandji.io	178 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 183	72 KB
2	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 126	2 KB
2	sjv.io 2 redirects kandji.sjv.io	1013 B
1	hubspotusercontent-na1.net 5058330.fs1.hubspotusercontent-na1.net	92 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 101	273 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 533	309 B
1	ojrq.net 1 redirects www.ojrq.net — Cisco Umbrella Rank: 5551	589 B
40	13

	Domain	Requested by
8	obs.testrobotflower.com	ob.testrobotflower.com blog.kandji.io
8	cdn.cookielaw.org	blog.kandji.io cdn.cookielaw.org
4	www.googletagmanager.com	blog.kandji.io www.googletagmanager.com
4	blog.kandji.io	blog.kandji.io
3	www.google.com	blog.kandji.io
3	googleads.g.doubleclick.net	2 redirects www.googletagmanager.com
2	connect.facebook.net	www.googletagmanager.com connect.facebook.net
2	www.googleadservices.com	1 redirects www.googletagmanager.com
2	analytics.google.com	www.googletagmanager.com
2	kandji.sjv.io	2 redirects
1	5058330.fs1.hubspotusercontent-na1.net	blog.kandji.io
1	www.facebook.com	blog.kandji.io
1	stats.g.doubleclick.net	www.googletagmanager.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	ob.testrobotflower.com	blog.kandji.io
1	www.ojrq.net	1 redirects
40	16

This site contains links to these domains. Also see Links.

Domain
www.kandji.io
support.kandji.io
kandji-partner.workramp.io

Subject Issuer	Validity	Valid
blog.kandji.io E1	`2024-03-11` - `2024-06-09`	3 months	crt.sh
*.testrobotflower.com Amazon RSA 2048 M02	`2023-07-18` - `2024-08-16`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2024-03-01` - `2024-12-31`	10 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2023-11-13` - `2024-11-12`	a year	crt.sh
*.google.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-02-14` - `2024-05-14`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
hubspotusercontent-na1.net Cloudflare Inc ECC CA-3	`2023-12-26` - `2024-12-25`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Frame ID: 16EEA35C31BFF2AE671BE9DA2D68352E
Requests: 40 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware

Page URL History Show full URLs

https://kandji.sjv.io/c/221109/1475702/17435?subId1=tomsguide-us-8126601953889851819&sharedId=toms... HTTP 302
https://www.ojrq.net/p/?return=https%3A%2F%2Fkandji.sjv.io%2Fc%2F221109%2F1475702%2F17435%3FsubId... HTTP 302
https://kandji.sjv.io/c/221109/1475702/17435?subId1=tomsguide-us-8126601953889851819&sharedId=toms... HTTP 301
https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUk... Page URL

Detected technologies

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Page Statistics

40
Requests

90 %
HTTPS

6 %
IPv6

13
Domains

16
Subdomains

16
IPs

2
Countries

949 kB
Transfer

3115 kB
Size

14
Cookies

37 Outgoing links

These are links going to different origins than the main page.

URL: https://www.kandji.io/start/?utm_source=blog
Title: Book a Demo

Search URL Search Domain Scan URL

URL: https://www.kandji.io/pricing/?utm_source=blog
Title: Request Pricing

Search URL Search Domain Scan URL

URL: https://www.kandji.io/virtual-demo/?utm_source=blog
Title: Virtual Tour

Search URL Search Domain Scan URL

URL: https://www.kandji.io/
Title: Kandji logo

Search URL Search Domain Scan URL

URL: https://www.kandji.io/device-harmony/
Title: Device Harmony

Search URL Search Domain Scan URL

URL: https://www.kandji.io/apple-device-management/
Title: Device Management

Search URL Search Domain Scan URL

URL: https://www.kandji.io/endpoint-detection-response/
Title: Endpoint Detection & Response

Search URL Search Domain Scan URL

URL: https://www.kandji.io/pricing/
Title: Pricing

Search URL Search Domain Scan URL

URL: https://support.kandji.io/
Title: Support

Search URL Search Domain Scan URL

URL: https://www.kandji.io/use-cases/zero-touch-deployment/
Title: Deploy

Search URL Search Domain Scan URL

URL: https://www.kandji.io/use-cases/mac-security-management/
Title: Secure

Search URL Search Domain Scan URL

URL: https://www.kandji.io/use-cases/mdm-configure/
Title: Configure

Search URL Search Domain Scan URL

URL: https://www.kandji.io/use-cases/manage/
Title: Manage

Search URL Search Domain Scan URL

URL: https://www.kandji.io/use-cases/mdm-integrations/
Title: Integrate

Search URL Search Domain Scan URL

URL: https://www.kandji.io/features/liftoff/
Title: Liftoff

Search URL Search Domain Scan URL

URL: https://www.kandji.io/features/passport/
Title: Passport

Search URL Search Domain Scan URL

URL: https://www.kandji.io/features/auto-apps/
Title: Auto Apps

Search URL Search Domain Scan URL

URL: https://www.kandji.io/features/managed-os/
Title: Managed OS

Search URL Search Domain Scan URL

URL: https://www.kandji.io/features/migration-agent/
Title: Migration

Search URL Search Domain Scan URL

URL: https://www.kandji.io/features/reach-compliance/
Title: Compliance

Search URL Search Domain Scan URL

URL: https://www.kandji.io/features/prism/
Title: Prism

Search URL Search Domain Scan URL

URL: https://www.kandji.io/solutions/ios-mdm-solution/
Title: iOS & iPadOS

Search URL Search Domain Scan URL

URL: https://www.kandji.io/resources/
Title: Resources Hub

Search URL Search Domain Scan URL

URL: https://www.kandji.io/resources/customer-stories/
Title: Customer Stories

Search URL Search Domain Scan URL

URL: https://www.kandji.io/resources/macadmins/
Title: MacAdmins Community

Search URL Search Domain Scan URL

URL: https://www.kandji.io/security/
Title: Security Details

Search URL Search Domain Scan URL

URL: https://www.kandji.io/partner/
Title: Resellers

Search URL Search Domain Scan URL

URL: https://www.kandji.io/integrations/
Title: Technology Partners

Search URL Search Domain Scan URL

URL: https://www.kandji.io/partner/become-a-kandji-partner/
Title: Become a Partner

Search URL Search Domain Scan URL

URL: https://www.kandji.io/partner/opportunity/
Title: Register a Deal

Search URL Search Domain Scan URL

URL: https://kandji-partner.workramp.io/login
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://www.kandji.io/company/about/
Title: About Kandji

Search URL Search Domain Scan URL

URL: https://www.kandji.io/company/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.kandji.io/company/news-and-press/
Title: News & Press

Search URL Search Domain Scan URL

URL: https://www.kandji.io/company/about/#contact
Title: Contact

Search URL Search Domain Scan URL

URL: https://www.kandji.io/login/
Title: Log in

Search URL Search Domain Scan URL

URL: https://www.kandji.io/start/
Title: Get Started

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://kandji.sjv.io/c/221109/1475702/17435?subId1=tomsguide-us-8126601953889851819&sharedId=tomsguide-us&u=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware HTTP 302
https://www.ojrq.net/p/?return=https%3A%2F%2Fkandji.sjv.io%2Fc%2F221109%2F1475702%2F17435%3FsubId1%3Dtomsguide-us-8126601953889851819%26sharedId%3Dtomsguide-us%26u%3Dhttps%253A%252F%252Fblog.kandji.io%252Fmalware-cuckoo-infostealer-spyware%26level%3D1&cid=17435&tpsync=yes&auth=573b513a0f75de83 HTTP 302
https://kandji.sjv.io/c/221109/1475702/17435?subId1=tomsguide-us-8126601953889851819&sharedId=tomsguide-us&u=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware&level=1&brwsr=a9b49999-0c10-11ef-b5c3-bbaddcbed6e5&brwsrsig=zBEyXr09RxETzwwUsiSqxyyhXXkUyS HTTP 301
https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 15

https://www.googleadservices.com/pagead/conversion/781421631/?label=1lluCKXMhqUZEL-YzvQC&guid=ON&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/781421631/?label=1lluCKXMhqUZEL-YzvQC&guid=ON&script=0&ct_cookie_present=false&random=543707229&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJfBsQI&pscrd=IhMIkKr0-LD6hQMV84qDCB0oIA2xMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6nwJodHRwczovL2Jsb2cua2FuZGppLmlvL21hbHdhcmUtY3Vja29vLWluZm9zdGVhbGVyLXNweXdhcmU_aW1wYWN0X2NsaWNraWQ9V3ZZUnZCMGNreHlLVGl6VFBOVmUtVkR0VWtIVC1TU1kxVGlPVWswJnV0bV9jYW1wYWlnbj1GdXR1cmUlMjBQTEMuJnV0bV9tZWRpdW09QWZmaWxpYXRlJnV0bV9jb250ZW50PU9ubGluZSUyMFRyYWNraW5nJTIwTGluayZ1dG1fc291cmNlPUZ1dHVyZSUyMFBMQy4mdXRtX3Rlcm09SW1wYWN0JmlyZ3djPTEmcGFydG5lcj1GdXR1cmUlMjBQTEMuJm1waWQ9MjIxMTA5Jmdyb3VwPQ HTTP 302
https://www.google.com/pagead/1p-conversion/781421631/?label=1lluCKXMhqUZEL-YzvQC&guid=ON&script=0&ct_cookie_present=false&random=543707229&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJfBsQI&pscrd=IhMIkKr0-LD6hQMV84qDCB0oIA2xMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6nwJodHRwczovL2Jsb2cua2FuZGppLmlvL21hbHdhcmUtY3Vja29vLWluZm9zdGVhbGVyLXNweXdhcmU_aW1wYWN0X2NsaWNraWQ9V3ZZUnZCMGNreHlLVGl6VFBOVmUtVkR0VWtIVC1TU1kxVGlPVWswJnV0bV9jYW1wYWlnbj1GdXR1cmUlMjBQTEMuJnV0bV9tZWRpdW09QWZmaWxpYXRlJnV0bV9jb250ZW50PU9ubGluZSUyMFRyYWNraW5nJTIwTGluayZ1dG1fc291cmNlPUZ1dHVyZSUyMFBMQy4mdXRtX3Rlcm09SW1wYWN0JmlyZ3djPTEmcGFydG5lcj1GdXR1cmUlMjBQTEMuJm1waWQ9MjIxMTA5Jmdyb3VwPQ&is_vtc=1&cid=CAQSGwB7FLtqKdV_AlB_xNRLbx5iIkqAMRJJ-6dFjQ&random=814196700

Request Chain 23

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/781421631/?random=807699336&cv=11&fst=1715045119437&bg=ffffff&guid=ON&async=1&gtm=45be4510v885711243za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware%3Fimpact_clickid%3DWvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0%26utm_campaign%3DFuture%2520PLC.%26utm_medium%3DAffiliate%26utm_content%3DOnline%2520Tracking%2520Link%26utm_source%3DFuture%2520PLC.%26utm_term%3DImpact%26irgwc%3D1%26partner%3DFuture%2520PLC.%26mpid%3D221109%26group%3D&label=1lluCKXMhqUZEL-YzvQC&hn=www.googleadservices.com&frm=0&tiba=Malware%3A%20Cuckoo%20Behaves%20Like%20Cross%20Between%20Infostealer%20and%20Spyware&gtm_ee=1&npa=0&pscdl=noapi&auid=1831954258.1715045119&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.118%7CGoogle%2520Chrome%3B124.0.6367.118%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&ec_mode=a&fdr=QA&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJfBsQI&pscrd=IhMI2dr5-LD6hQMVWq2DCB0vGAUwMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6nwJodHRwczovL2Jsb2cua2FuZGppLmlvL21hbHdhcmUtY3Vja29vLWluZm9zdGVhbGVyLXNweXdhcmU_aW1wYWN0X2NsaWNraWQ9V3ZZUnZCMGNreHlLVGl6VFBOVmUtVkR0VWtIVC1TU1kxVGlPVWswJnV0bV9jYW1wYWlnbj1GdXR1cmUlMjBQTEMuJnV0bV9tZWRpdW09QWZmaWxpYXRlJnV0bV9jb250ZW50PU9ubGluZSUyMFRyYWNraW5nJTIwTGluayZ1dG1fc291cmNlPUZ1dHVyZSUyMFBMQy4mdXRtX3Rlcm09SW1wYWN0JmlyZ3djPTEmcGFydG5lcj1GdXR1cmUlMjBQTEMuJm1waWQ9MjIxMTA5Jmdyb3VwPQ HTTP 302
https://www.google.com/pagead/1p-conversion/781421631/?random=807699336&cv=11&fst=1715045119437&bg=ffffff&guid=ON&async=1&gtm=45be4510v885711243za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware%3Fimpact_clickid%3DWvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0%26utm_campaign%3DFuture%2520PLC.%26utm_medium%3DAffiliate%26utm_content%3DOnline%2520Tracking%2520Link%26utm_source%3DFuture%2520PLC.%26utm_term%3DImpact%26irgwc%3D1%26partner%3DFuture%2520PLC.%26mpid%3D221109%26group%3D&label=1lluCKXMhqUZEL-YzvQC&hn=www.googleadservices.com&frm=0&tiba=Malware%3A%20Cuckoo%20Behaves%20Like%20Cross%20Between%20Infostealer%20and%20Spyware&gtm_ee=1&npa=0&pscdl=noapi&auid=1831954258.1715045119&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.118%7CGoogle%2520Chrome%3B124.0.6367.118%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&ec_mode=a&fdr=QA&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJfBsQI&pscrd=IhMI2dr5-LD6hQMVWq2DCB0vGAUwMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6nwJodHRwczovL2Jsb2cua2FuZGppLmlvL21hbHdhcmUtY3Vja29vLWluZm9zdGVhbGVyLXNweXdhcmU_aW1wYWN0X2NsaWNraWQ9V3ZZUnZCMGNreHlLVGl6VFBOVmUtVkR0VWtIVC1TU1kxVGlPVWswJnV0bV9jYW1wYWlnbj1GdXR1cmUlMjBQTEMuJnV0bV9tZWRpdW09QWZmaWxpYXRlJnV0bV9jb250ZW50PU9ubGluZSUyMFRyYWNraW5nJTIwTGluayZ1dG1fc291cmNlPUZ1dHVyZSUyMFBMQy4mdXRtX3Rlcm09SW1wYWN0JmlyZ3djPTEmcGFydG5lcj1GdXR1cmUlMjBQTEMuJm1waWQ9MjIxMTA5Jmdyb3VwPQ&is_vtc=1&cid=CAQSGwB7FLtqG9hjyYjpxkwzdbkmJAAz4qPumRMrzw&random=1515134654

40 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request malware-cuckoo-infostealer-spyware
blog.kandji.io/
Redirect Chain

https://kandji.sjv.io/c/221109/1475702/17435?subId1=tomsguide-us-8126601953889851819&sharedId=tomsguide-us&u=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware
https://www.ojrq.net/p/?return=https%3A%2F%2Fkandji.sjv.io%2Fc%2F221109%2F1475702%2F17435%3FsubId1%3Dtomsguide-us-8126601953889851819%26sharedId%3Dtomsguide-us%26u%3Dhttps%253A%252F%252Fblog.kandji...
https://kandji.sjv.io/c/221109/1475702/17435?subId1=tomsguide-us-8126601953889851819&sharedId=tomsguide-us&u=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware&level=1&brwsr=a9b49999...
https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link...

29 KB
0

371ms
315ms

Document
text/html

2606:2c40::c73c:67e3
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:2c40::c73c:67e3 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-credentials: false
alt-svc: h3=":443"; ma=86400
cache-control: s-maxage=7200,max-age=5
cache-tag: CT-159120097439,CT-163759176078,CT-165936097429,CT-27579410748,CG-6850365017,P-5058330,CW-127157693999,CW-95831149845,CW-95982514497,CW-95984958073,CW-96856054340,E-95659790937,E-95659796768,E-95659796773,E-95660243592,E-95660429163,E-95663097226,RA-150720214182,RA-95688192170,RA-96550832786,PGS-ALL,SW-3,B-6850365017,GC-118553034663
cf-cache-status: MISS
cf-ray: 87fd6a51f86c8c53-EWR
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html;charset=utf-8
date: Tue, 07 May 2024 01:25:18 GMT
edge-cache-tag: CT-159120097439,CT-163759176078,CT-165936097429,CT-27579410748,CG-6850365017,P-5058330,CW-127157693999,CW-95831149845,CW-95982514497,CW-95984958073,CW-96856054340,E-95659790937,E-95659796768,E-95659796773,E-95660243592,E-95660429163,E-95663097226,RA-150720214182,RA-95688192170,RA-96550832786,PGS-ALL,SW-3,B-6850365017,GC-118553034663
last-modified: Tue, 07 May 2024 01:25:18 GMT
link: </hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>; rel=preload; as=script, </_hcms/forms/v2.js>; rel=preload; as=script
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KVef3MaJKreUnqgdljOM%2FZ2N%2BETY2HTnn7Der8YWBaI67DNI8lgu95VZyZ1O4yDQxF%2Fuw%2Fn1qQdjaTvqs09lUWYk1Ychr2Owv2ukWRupDurVV6eio8KYNg03S8aAspZZaRmMMZEmNE0P8bJO"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: origin, Accept-Encoding
x-content-type-options: nosniff
x-envoy-upstream-service-time: 107
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/cms-30-39-td/envoy-proxy-5f8479db84-9bg2x
x-evy-trace-virtual-host: all
x-hs-cache-config: BrowserCache-5s-EdgeCache-7200s
x-hs-content-id: 165936097429
x-hs-hub-id: 5058330
x-hubspot-correlation-id: a467c555-9ebf-4822-aea9-263d9adcb435
x-request-id: a467c555-9ebf-4822-aea9-263d9adcb435

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
date: Tue, 07 May 2024 01:25:17 GMT
expires: Tue, 07 May 2024 01:25:17 GMT
location: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
p3p: policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
pragma: no-cache
timing-allow-origin: *
via: 1.1 google

GET
H2 200 project.js Show response
blog.kandji.io/hs/hsstatic/cos-i18n/static-1.53/bundles/ 1 KB
1 KB 6456ms
41ms Script
application/javascript 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.kandji.io/hs/hsstatic/cos-i18n/static-1.53/bundles/project.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 07 May 2024 01:25:24 GMT
strict-transport-security: max-age=31536000
via: 1.1 d33ed2107293e32734a96656b820e092.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
age: 4701151
x-amz-cf-pop: JFK50-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: P9ES7sOpFzrLl1QoRwjEAy5outPo5_GO
content-encoding: br
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 09 Nov 2021 16:12:42 GMT
server: cloudflare
etag: W/"61ca66de658cab9587e4636894680d5d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TuK85uZWbM0fgZr4QByNrVEhunn78D0XeDkFgoz03irK839JrjVJsHnhMgv2EhVsvtxfgHYO%2BbNGLC3Oe%2FzU3tK1hDRK9AUVtlA2hhC3jB9hZgLrKBrhFhXNXOi7X3fa"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 87fd6a7c0a274235-EWR
x-amz-cf-id: 2G5KP_rZPKVouuh7_Lhcj1cXj8Vl43pTT4ePnfzK6VFbVa9984xRIg==
expires: Wed, 07 May 2025 01:25:24 GMT

GET
H2 200 v2.js Show response
blog.kandji.io/_hcms/forms/ 482 KB
162 KB 6455ms
40ms Script
application/javascript 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.kandji.io/_hcms/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f171db8dc0eb7cec86c84ceac278dbf2fbe33770334635a2703186d14f4828b2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 104
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.5064/bundles/project-v2.js&cfRay=87fd67efc165c3f8-EWR
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"b0047a8901d8ed9f81db3dcb5982114e"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: forms-embed/static-1.5064/bundles/project-v2.js
date: Tue, 07 May 2024 01:25:24 GMT
strict-transport-security: max-age=31536000
via: 1.1 a4f9ca051b97c1ac09e2af244690d376.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-amz-version-id: 4lHA5dnNobe4YqKec9CE2kPtPUzRSBNR
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 36b38d28-fd82-4d57-892c-b722382bfc88
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 1
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 36b38d28-fd82-4d57-892c-b722382bfc88
last-modified: Wed, 03 Apr 2024 11:15:05 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vd%2F20zSigOxFWMAXRiSA1%2Bqn5g1fZDBskJ6sezCm3S9cN6%2F87ZP8khBGl%2BHz8%2FlStBi%2BYH9aNWipYTZMzUOI%2FQ1jwXFjvalmVD%2B%2FppFd45KAP7RPHDd2lVugl23QZGOq"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-68b7f7fbff-wlmbb
cf-ray: 87fd6a7c0a2a4235-EWR
x-amz-cf-id: nm78zKYvPNo92R3BsMZ0HNsol19pRJcJjWM8sRP7c0Kt7TFUo51kiQ==

GET
H2 200 130ddaec76c305292f6ec30ebef2d5ce.js Show response
ob.testrobotflower.com/i/ 102 KB
38 KB 346ms
4ms Script
text/javascript 108.139.47.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ob.testrobotflower.com/i/130ddaec76c305292f6ec30ebef2d5ce.js
Requested by: Host: blog.kandji.io
URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.47.20 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-47-20.jfk50.r.cloudfront.net
Software: Caddy /
Resource Hash: 3dbb76c2655ea2f996850c9101b4217c4343587e61e34555bd4d498de0ae7b69

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 06 May 2024 21:12:19 GMT
content-encoding: gzip
via: 1.1 e60ffc5cb1078c77d0ecabfc06b14cd0.cloudfront.net (CloudFront)
server: Caddy
x-amz-cf-pop: JFK50-P1
age: 15179
etag: "19784-ylb8HxKQZPvMhXseA9rK8oeZ2eQ"
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
cache-control: max-age=43200
content-length: 38109
x-amz-cf-id: FdKqN86dsBZpg5LsPImMKR6FzJ4ZdX4OhcM2YL4vOJywH4Ruyoo1pQ==
expires: Tue, 07 May 2024 09:12:19 GMT

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/52104b08-403c-474b-8e63-8560d38d0080/ 50 KB
7 KB 353ms
29ms Script
application/x-javascript 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/52104b08-403c-474b-8e63-8560d38d0080/OtAutoBlock.js

Requested by

Host: blog.kandji.io
URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cea95b67c69f3eadce6a5ae44f8c92cdc25d9ecfd4f1f07abddbcc5609508f9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 May 2024 01:25:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 25720
content-md5: cZ3p4H6Oo0yMk5k3IdT0MQ==
content-length: 6819
x-ms-lease-status: unlocked
last-modified: Thu, 15 Jun 2023 16:56:03 GMT
server: cloudflare
etag: 0x8DB6DC167708395
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: f03b4817-801e-007c-75bf-17177c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 87fd6a55fdfe0f90-EWR
expires: Wed, 08 May 2024 01:25:18 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 347ms
22ms Script
application/javascript 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6f08699117c1f15f6d35e7b4380d12d18a1881f075e177b5853b1017a3307544

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 May 2024 01:25:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: cfMMgqnnnYda745QhUdJrw==
age: 15
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6882
x-ms-lease-status: unlocked
last-modified: Thu, 02 May 2024 18:04:40 GMT
server: cloudflare
etag: 0x8DC6AD2569D1DB7
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 81aa8688-601e-0010-3e74-9d778f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 87fd6a55fdff0f90-EWR
expires: Wed, 08 May 2024 01:25:18 GMT

GET
H2 200 kandji.min.css
blog.kandji.io/hs-fs/hub/5058330/hub_generated/template_assets/95659790937/1714606602095/Kandji_December2022/css/ 78 KB
15 KB 6458ms
44ms Stylesheet
text/css 199.60.103.29
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.kandji.io/hs-fs/hub/5058330/hub_generated/template_assets/95659790937/1714606602095/Kandji_December2022/css/kandji.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.60.103.29 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

608854bc9b4ff57f231d9b41b1b325b4a987f48eb56f26d928868acd8a2f30dc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: upgrade-insecure-requests
content-encoding: br
age: 2231
x-amz-request-id: F9HPZSY13693H32D
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
x-amz-replication-status: PENDING
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"bf6969b4ed04d4ea3ce545ba141380ad"
vary: origin, Accept-Encoding
x-amz-meta-created-unix-time-millis: 1714606603151
content-type: text/css
x-evy-trace-virtual-host: all
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Tue, 07 May 2024 01:25:24 GMT
strict-transport-security: max-age=31536000
via: 1.1 b5e757a7da6f6fe6261f56a8a9646880.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-version-id: YQfeRzRYCP7qf_TbRR4YQdYoWaIep.Mc
x-amz-cf-pop: IAD89-C1
x-hs-alternate-content-type: text/plain
x-hubspot-correlation-id: fccf68c1-8cca-44eb-b1ca-a20ae782e7c0
x-cache: Miss from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 192
alt-svc: h3=":443"; ma=86400
x-amz-id-2: iCaDhGep/cYFMzAK1kDnzm5YnoMUv88l3WY7SEHajJCwd3B6Ze+2FZOKIP0UYYHyCVGofDqAGic=
x-evy-trace-route-configuration: listener_https/all
x-request-id: fccf68c1-8cca-44eb-b1ca-a20ae782e7c0
last-modified: Wed, 01 May 2024 23:36:44 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4AewlbENA2ScbmrVqjAKf8i8%2BXPYtTOczX0xo9fumMgIO1%2BNaAzfD9Q4R2%2F4yu8r7ptd%2FHaWqzjKPLPcLkr%2Fn3AFy%2FDruIQD%2Bh%2BeYc%2FN1HnZwwrPlvfKqy49T5KKfHi3"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-7mxgq
access-control-allow-credentials: false
cf-ray: 87fd6a7c0a224235-EWR
timing-allow-origin: blog.kandji.io
x-amz-cf-id: TzYK1goTY6genjB4tbroyyR_nWJHHGwaH9JPuAZCl_A5EDhoFssN5w==

GET
H2 200 52104b08-403c-474b-8e63-8560d38d0080.json Show response
cdn.cookielaw.org/consent/52104b08-403c-474b-8e63-8560d38d0080/ 4 KB
2 KB 410ms
103ms XHR
application/x-javascript 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/52104b08-403c-474b-8e63-8560d38d0080/52104b08-403c-474b-8e63-8560d38d0080.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bb5b82601b4d9a2d5c0c2114554c057cfcbd14758cbfcc4caabcd22ad9abe6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 May 2024 01:25:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-md5: 6BMqikelNA/grYiNXxYYUQ==
content-length: 1508
x-ms-lease-status: unlocked
last-modified: Thu, 15 Jun 2023 16:56:03 GMT
server: cloudflare
etag: 0x8DB6DC1675F9622
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 36884402-a01e-007b-7e03-247b1f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 87fd6a582ca91889-EWR
expires: Wed, 08 May 2024 01:25:18 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 334 KB
106 KB 374ms
54ms Script
application/javascript 142.250.80.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T7GZQ3L

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.8 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s33-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

69e1f1c48622424da58b7e0a252ce36635da1ad1ec17a6bc43e395e5e479217e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 07 May 2024 01:25:18 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 108519
x-xss-protection: 0
last-modified: Tue, 07 May 2024 00:09:18 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 07 May 2024 01:25:18 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 71 B
309 B 536ms
87ms XHR
application/json 172.64.155.119
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.155.119 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4da8a6638ad70698ad3d01aa0ef124aebe35c297685c0796b174822f597b1d09

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
accept: application/json
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 07 May 2024 01:25:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 87fd6a5bcaa169c4-LAX
access-control-allow-headers: Content-Type

GET
H2 200 ct Show response
obs.testrobotflower.com/ 5 KB
2 KB 385ms
46ms Script
text/javascript 52.45.196.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.testrobotflower.com/ct?id=57239&url=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware%3Fimpact_clickid%3DWvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0%26utm_campaign%3DFuture%2520PLC.%26utm_medium%3DAffiliate%26utm_content%3DOnline%2520Tracking%2520Link%26utm_source%3DFuture%2520PLC.%26utm_term%3DImpact%26irgwc%3D1%26partner%3DFuture%2520PLC.%26mpid%3D221109%26group%3D&sf=0&tpi=&ch=cheq4ppc&uvid=&tsf=0&tsfmi=&tsfu=&cb=1715045118914&hl=2&op=0&ag=2115704966&rand=238210819795207696598661181216050327103512558170969121892911145687016051022919972255&fs=1600x1200&fst=1600x1200&np=win32&nv=google%20inc.&ref=&ss=1600x1200&nc=0&at=&di=W1siZWYiLDU5MV0sWyJibmNoIiwxXSxbImFibmNoIiwxXSxbLTMyLCItIl0sWy00NywiUGFjaWZpYy9Ib25vbHVsdSxlbi1VUyxsYXRuLGdyZWdvcnkiXSxbLTgsIi0iXSxbLTI0LCJbXSJdLFstMzUsIlsxNzE1MDQ1MTE4ODMwLDEwXSJdLFstNDMsIjAwMDAwMDAxMDEwMDAwMDEwMDExMTAxMTAwMTAxMTAxMDAwMDAxIl0sWy01MywiMTAwIl0sWy0yLCI4LGVBSFdYMS9mM3F6Q3Zia3V5bVF3Z2xJYUYzcEVzUkVFVHBvVmRGVkJRUXBSY1JCRlNLSUlnaVJJcjBLaEpScXBTQXRDQWtRSHBJenliYlhwbVpyLzUvZDk2YnpjdVNBUEovR3QiXSxbLTU1LCIyIl0sWy0xMiwibnVsbCJdLFstNjMsIi0iXSxbLTE5LCJbMjAsMjAsMjAsMjAsMCwwLDEsMjQsMjQsXCItXCIsMTYwMCwxMjAwLDE2MDAsMTIwMCwxNjAwLDEyMDAsMTYwMCwxMjAwLDAsMCwwLDAsXCItXCIsXCItXCIsMTYwMCwxMjAwXSJdLFstMzMsIi0iXSxbLTY1LCItIl0sWy02MiwiODAiXSxbLTQ5LCItIl0sWy0zOCwibCwtMSwtMSwxMjcsMCwxLDAsNDIsMTMsLTE3MTUwNDUxMTc3NTAsLTEsMCwsLDEyODIsMTI4MiJdLFstNDUsIi0iXSxbLTIwLCItIl0sWy0yMSwiLSJdLFstNywiLSJdLFstMjMsIisiXSxbLTU4LCItIl0sWy0xOCwiWzAsMCwwLDFdIl0sWy02NCwiWzAsXCJXaW4zMlwiLFt7XCJiXCI6XCJHb29nbGUgQ2hyb21lXCIsXCJ2XCI6XCIxMjRcIn0se1wiYlwiOlwiTm90OkEtQnJhbmRcIixcInZcIjpcIjhcIn0se1wiYlwiOlwiQ2hyb21pdW1cIixcInZcIjpcIjEyNFwifV1dIl0sWy02MCwyMDRdLFstOSwiKyJdLFstNjYsImdlb2xvY2F0aW9uLHN0b3JhZ2VhY2Nlc3MsZ2FtZXBhZCxjaGVjdCxtaWRpLGRpc3BsYXljYXB0dXJlLHVzYixwaWN0dXJlaW5waWN0dXJlLHB1YmxpY2tleWNyZWRlbnRpYWxzZ2V0LGxvY2FsZm9udHMsb3RwY3JlZGVudGlhbHMsZW5jcnlwdGVkbWVkaWEsY2hzYXZlZGF0YSxjaHVhZnVsbHZlcnNpb25saXN0LGNodWF3b3c2NCxjaGRvd25saW5rLGNocHJlZmVyc2NvbG9yc2NoZW1lLHN5bmN4aHIsY2h1YW1vZGVsLGNocHJlZmVyc3JlZHVjZWR0cmFuc3BhcmVuY3ksc2VyaWFsLGNhbWVyYSxjaHByZWZlcnNyZWR1Y2VkbW90aW9uLHByaXZhdGVzdGF0ZXRva2VuaXNzdWFuY2UsaWRlbnRpdHljcmVkZW50aWFsc2dldCxjaHVhZnVsbHZlcnNpb24sZnVsbHNjcmVlbixjaGRwcix1bmxvYWQsa2V5Ym9hcmRtYXAsY2h1YXBsYXRmb3JtLGd5cm9zY29wZSxjaHVhbW9iaWxlLHdpbmRvd21hbmFnZW1lbnQsY2h1YSxwdWJsaWNrZXljcmVkZW50aWFsc2NyZWF0ZSxtYWduZXRvbWV0ZXIsYWNjZWxlcm9tZXRlcixwcml2YXRlc3RhdGV0b2tlbnJlZGVtcHRpb24sY2h1YWFyY2gseHJzcGF0aWFsdHJhY2tpbmcsY2h1YWZvcm1mYWN0b3JzLGlkbGVkZXRlY3Rpb24sY2h1YXBsYXRmb3JtdmVyc2lvbixjaHdpZHRoLGNsaXBib2FyZHJlYWQsY2h2aWV3cG9ydHdpZHRoLHBheW1lbnQsY2h2aWV3cG9ydGhlaWdodCxjaHJ0dCxhdXRvcGxheSxjcm9zc29yaWdpbmlzb2xhdGVkLGhpZCxjaHVhYml0bmVzcyxzY3JlZW53YWtlbG9jayxjbGlwYm9hcmR3cml0ZSxjaGRldmljZW1lbW9yeSxtaWNyb3Bob25lIl0sWy0xMywiLSJdLFstNCwiPGh0bWwgbGFuZz1cImVuXCIgY2xhc3M9XCJzY3JvbGwtcHQtWzFyZW1dIG5hdlN3YXA6c2Nyb2xsLXB0LVs2cmVtXVwiPjxoZWFkPlxuICAgIDxtZXRhIGNoYXJzZXQ9XCJ1dGYtOFwiPlxuICAgIDxtZXRhIG5hbWU9XCJnb29nbGUtc2l0ZS12ZXJpZmljYXRpb25cIiBjb250ZW50PVwibDZzeHV1RFA4OF84RmF5SDFpMDlCWFVtR1o3UVZmeFVqd2VrWUI0bklmSVwiPlxuXG4gICAgXG5cbiAgICA8c2NyaXB0IGFzeW5jPVwiXCIgZGF0YS1vdC1pZ25vcmU9XCJcIiBjbGFzcz1cIm9wdGFub24tY2F0ZWdvcnktQzAwMDFcIiBzcmM9XCJodHRwczovL3d3dy5nb29nbGV0YWdtYW5hZ2VyLmNvbS9ndG0uanM%2FaWQ9R1RNLVQ3R1pRM0xcIj48L3NjcmlwdD48c2NyaXB0PmZ1bmN0aW9uIGRvbVJlYWR5KGspe2lmKFsnaW50ZXJhY3RpdmUnLCdjb21wbGV0ZSddLmluZGV4T2YoZG9jdW1lbnQucmVhZHlTdGF0ZSk%2BPTApe2soKX1lbHNle2RvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoJ0RPTUNvbnRlbnRMb2FkZWQnLGspfX08L3NjcmlwdD5cblxuICAgIDx0aXRsZT5NYWx3YXJlOiBDdWNrb28gQmVoYXZlcyBMaWtlIENyb3NzIEJldHdlZW4gSW5mb3N0ZWFsZXIgYW5kIFNweXdhcmU8L3RpdGxlPlxuICAgIDxsaW5rIHJlbD1cInNob3J0Y3V0IGljb25cIiBocmVmPVwiaHR0cHM6Ly9ibG9nLmthbmRqaS5pby9odWJmcy9mYXZpY29uLTMuaWNvXCI%2BXG4gICAgPG1ldGEgbmFtZT1cImRlc2NyaXB0aW9uXCIgY29udGVudD1cIkthbmRqaSdzIHRocmVhdCByZXNlYXJjaCB0ZWFtIGhhcyBkaXNjb3ZlcmVkIGEgcGllY2Ugb2YgbWFsd2FyZSB0aGF0IGNvbWJpbmVzIGFzcGVjdHMgb2YgYW4gaW5mb3N0ZWFsZXIgYW5kIHNweXdhcmUuIEhlcmUncyBob3cgaXQgd29ya3MuXCI%2BXG4gICAgXG4gICAgXG4gICAgXG4gICAgXG4gICAgXG5cbiAgICBcbiAgICA8c2NyaXB0PmZ1bmN0aW9uIG9uQ2hlcVJlc3BvbnNlKGEscil7d2luZG93LmNxX3JlcV9pZD1yfTwvc2NyaXB0PlxuICAgIDxzY3JpcHQgYXN5bmM9XCJcIiBzcmM9XCJodHRwczovL29iLnRlc3Ryb2JvdGZsb3dlci5jb20vaS8xMzBkZGFlYzc2YzMwNTI5MmY2ZWMzMGViZWYyZDVjZS5qc1wiIGRhdGEtY2g9XCJjaGVxNHBwY1wiIGNsYXNzPVwiY3RfY2xpY2t0cnVlXzU3MjM5XCI%2BPC9zY3JpcHQ%2BXG4gICAgXG5cbiAgICBcbiAgICA8c2NyaXB0IHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIiBzcmM9XCJodHRwczovL2Nkbi5jb29raWVsYXcub3JnL2NvbnNlbnQvNTIxMDRiMDgtNDAzYy00NzRiLThlNjMtODU2MGQzOGQwMDgwL090QXV0b0Jsb2NrLmpzXCI%2BPC9zY3JpcHQ%2BXG4gICAgPHNjcmlwdCBzcmM9XCJodHRwczovL2Nkbi5jb29raWVsYXcub3JnL3NjcmlwdHRlbXBsYXRlcy9vdFNES1N0dWIuanNcIiB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCIgY2hhcnNldD1cIlVURi04XCIgZGF0YS1kb21haW4tc2NyaXB0PVwiNTIxMDRiMDgtNDAzYy00NzRiLThlNjMtODU2MGQzOGQwMDgwXCI%2BPC9zY3JpcHQ%2BXG4gICAgPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCI%2BXG4gICAgICBmdW5jdGlvbiBPcHRhbm9uV3JhcHBlcigpIHsgfVxuICAgIDwvc2NyaXB0PlxuICAgIFxuXG4gICAgXG4gICAgPHNjcmlwdD4oZnVuY3Rpb24odyxkLHMsbCxpKXt3W2xdPXdbbF18fFtdO3dbbF0ucHVzaCh7J2d0bS5zdGFydCc6XG4gICAgICAgICAgbmV3IERhdGUoKS5nZXRUaW1lKCksZXZlbnQ6J2d0bS5qcyd9KTt2YXIgZj1kLmdldEVsZW1lbnRzQnlUYWdOYW1lKHMpWzBdLFxuICAgICAgICBqPWQuY3JlYXRlRWxlbWVudChzKSxkbD1sIT0nZGF0YUxheWVyJz8nJmw9JytsOicnO2ouYXN5bmM9dHJ1ZTtcbiAgICAgICAgai5zZXRBdHRyaWJ1dGVOb2RlKGQuY3JlYXRlQXR0cmlidXRlKCdkYXRhLW90LWlnbm9yZScpKTtcbiAgICAgICAgai5zZXRBdHRyaWJ1dGUoJ2NsYXNzJywnb3B0YW5vbi1jYXRlZ29yeS1DMDAwMScpO1xuICAgICAgICBqLnNyYz0naHR0cHM6Ly93d3cuZ29vZ2xldGFnbWFuYWdlci5jb20vZ3RtLmpzP2lkPScraStkbDtmLnBhcmVudE5vZGUuaW5zZXJ0QmVmb3JlKGosZik7XG4gICAgICB9KSh3aW5kb3csZG9jdW1lbnQsJ3NjcmlwdCcsJ2RhdGFMYXllcicsJ0dUTS1UN0daUTNMJyk7PC9zY3JpcHQ%2BXG4gICJdLFstNiwie1wid1wiOltdLFwiblwiOltdLFwiZFwiOltdfSJdLFstNTYsImxhbmRzY2FwZS1wcmltYXJ5Il0sWy0xMCwiLSJdLFstMzAsIltcInZcIiwwXSJdLFstNTAsIi0iXSxbLTM0LCItIl0sWy01NCwie1wiaFwiOltcIl8zXCIsXCIyODcyODk5MzIwXCIsXCJfMVwiLFwiMTAzNzk3NTEwMlwiXSxcImRcIjpbXSxcImJcIjpbXSxcInNcIjoxfSJdLFstMzYsIltcIjQvM1wiLFwiNC8zXCJdIl0sWy0xLCItIl0sWy0xMSwie1widFwiOlwiXCIsXCJtXCI6W1wiZGVzY3JpcHRpb25cIixcIm9nOmRlc2NyaXB0aW9uXCIsXCJvZzp0aXRsZVwiLFwidHdpdHRlcjpkZXNjcmlwdGlvblwiLFwidHdpdHRlcjp0aXRsZVwiXX0iXSxbLTIyLCJbXCJuXCIsXCJuXCJdIl0sWy00MSwiLSJdLFstNjgsIi0iXSxbMzcsIlszMzE2MjI0MDQ5LGZ1bmN0aW9uKG5ld1ZhbHVlKSB7XG4gICAgICAgICAgICAgIGFkZENvbnRlbnRXaW5kb3dQcm94eSh0aGlzKVxuICAgICAgICAgICAgICAvLyBSZXNldCBwcm9wZXJ0eSwgdGhlIGhvb2sgaXMgb25seSBuZWVkZWQgb25jZVxuICAgICAgICAgICAgICBPYmplY3QuZGVmaW5lUHJvcGVydHkoaWZyYW1lLCAnc3JjZG9jJywge1xuICAgICAgICAgICAgICAgIGNvbmZpZ3VyYWJsZTogZmFsc2UsXG4gICAgICAgICAgICAgICAgd3JpdGFibGU6IGZhbHNlLFxuICAgICAgICAgICAgICAgIHZhbHVlOiBfc3JjZG9jXG4gICAgICAgICAgICAgIH0pXG4gICAgICAgICAgICAgIF9pZnJhbWUuc3JjZG9jID0gbmV3VmFsdWVcbiAgICAgICAgICAgIH1dIl0sWzEyLCJ7XCJjdHhcIjpcIndlYmdsXCIsXCJ2XCI6XCJpbnRlbCBpbmMuXCIsXCJyXCI6XCJpbnRlbCBpcmlzIG9wZW5nbCBlbmdpbmVcIixcInNsdlwiOlwid2ViZ2wgZ2xzbCBlcyAxLjAgKG9wZW5nbCBlcyBnbHNsIGVzIDEuMCBjaHJvbWl1bSlcIixcImd2ZXJcIjpcIndlYmdsIDEuMCAob3BlbmdsIGVzIDIuMCBjaHJvbWl1bSlcIixcImd2ZW5cIjpcIndlYmtpdFwiLFwiYmVuXCI6OCxcIndnbFwiOjEsXCJncmVuXCI6XCJ3ZWJraXQgd2ViZ2xcIixcInNlZlwiOjE5MzA4MjAyNzksXCJzZWNcIjpcIlwifSJdLFstMzksIltcIjIwMDMwMTA3XCIsMixcIkdlY2tvXCIsXCJOZXRzY2FwZVwiLFwiTW96aWxsYVwiLG51bGwsbnVsbCx0cnVlLDgsZmFsc2UsbnVsbCw1LHRydWUsdHJ1ZSxudWxsLDAsdHJ1ZSx0cnVlXSJdLFstNDYsIjAiXSxbLTUyLCItIl0sWy01OSwiZGVmYXVsdCJdLFstNDIsIjE3MjQyOTc2NTMiXSxbLTE2LCIwIl0sWy0xNywiMTYiXSxbLTI3LCJbNTAsMTAsMCxcIjRnXCIsbnVsbF0iXSxbLTUxLCItIl0sWy02NywiMjUzMjMxMjg4ODoyMiJdLFstMjYsIntcInRqaHNcIjoxMDI4MDQ2OCxcInVqaHNcIjo3MDc5ODc2LFwiamhzbFwiOjQyOTQ3MDUxNTJ9Il0sWy02MSwie1wid2dzbFwiOlwiNDtyZWFkb25seV9hbmRfcmVhZHdyaXRlX3N0b3JhZ2VfdGV4dHVyZXM7cGFja2VkXzR4OF9pbnRlZ2VyX2RvdF9wcm9kdWN0O3VucmVzdHJpY3RlZF9wb2ludGVyX3BhcmFtZXRlcnM7cG9pbnRlcl9jb21wb3NpdGVfYWNjZXNzO1wiLFwicGNmXCI6XCJiZ3JhOHVub3JtXCJ9Il0sWy0yOCwiZW4tVVMsZW4iXSxbLTM3LCItMTQ0LTY2LTE4MC0iXSxbLTUsIi0iXSxbLTE1LCItIl0sWy0yNSwiLSJdLFstMjksIi0iXSxbLTQ4LCIwLDAiXSxbLTMsIltcImludGVybmFsLXBkZi12aWV3ZXJcIixcImludGVybmFsLXBkZi12aWV3ZXJcIixcImludGVybmFsLXBkZi12aWV3ZXJcIixcImludGVybmFsLXBkZi12aWV3ZXJcIixcImludGVybmFsLXBkZi12aWV3ZXJcIl0iXSxbLTMxLCJmYWxzZSJdLFstNDQsIjAsMCwwLDUiXSxbLTE0LCItIl0sWy00MCwiMzMiXSxbLTU3LCJXRTBaVjF4T2NWaFhYVlZjU3hjRldsWlVTVXhOWEYwSEdXSllTaGxZU1VsVlFHUVpFVnhQV0ZVWldFMFpCVmhYVmxkQVZGWk1TZ2NaRVFNT0F3Z01DUW9KQVJBVkdRVllWMVpYUUZSV1RFb0hBd2dCQXdvSkVCVllUUmw0UzB0WVFCZFBYQmtSVVUxTlNVb0RGaFpXV3hkTlhFcE5TMVpiVmsxZlZWWk9YRXNYV2xaVUZsQVdDQW9KWFYxWVhGb09EMW9LQ1F3TEFBdGZEMXhhQ2dsY1cxeGZDMTBNV2x3WFUwb0RDQU1QRGdnS0FSQT0iXSxbImRkYiIsIjAsOCwwLDAsMCwxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDUsMCwwLDAsMSwwLDAsMCwwLDEsMCwwLDAsMSwwLDAsMCwxLDEsMCwwLDAsMCwxLDEsMiwxLDAsOCwwLDEsMCwwLDAsMCwwLDAsMCwwLDIsMCw1LDAsMCwxLDAsMCwwLDIzLDAiXSxbImNiIiwiMCwwLDAsMCwwLDAsMCwwLDAsMiwwLDAsOCwwLDAsMCwwLDAsMCwwLDEsMCwwLDAsMSwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMSwwLDAsMCwxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDYsMSwxLDAsMCwwLDAsMCwwLDAiXV0%3D&dep=0&pre=0&sdd=%7B%7D&cri=owj5ck4TG9&pto=1348&ver=59&gac=-&mei=&ap=&fe=1&duid=1.1715045118.sDO7ZUho2EPH9mSI&suid=1.1715045118.OtkzT43yckAyU8xS&tuid=1.1715045118.8bfaVz4Cf0SATWWt&fbc=-&gtm=W10%3D&it=6%2C504%2C713&fbcl=-&gacl=-&gacsd=-&rtic=-&bgc=-&spa=1&urid=0&ab=&sck=-
Requested by: Host: ob.testrobotflower.com
URL: https://ob.testrobotflower.com/i/130ddaec76c305292f6ec30ebef2d5ce.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 52.45.196.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-196-192.compute-1.amazonaws.com
Software: /
Resource Hash: 9d2ed8ff28378191ad747458666b94dbe8cda83914db23a86217fbe7086d74e6

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-type: text/javascript
pragma: no-cache
date: Tue, 07 May 2024 01:25:19 GMT
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 1971
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 335 KB
107 KB 43ms
42ms Script
application/javascript 142.250.80.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-V21CT0R1FX

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T7GZQ3L

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.8 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s33-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

260956d4d537ac0ac99a98735ce0d900b148e5c12fb8c3ebc483cad3e4eba1f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 07 May 2024 01:25:18 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 109453
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 07 May 2024 01:25:18 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 335 KB
107 KB 40ms
40ms Script
application/javascript 142.250.80.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-V21CT0R1FX&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T7GZQ3L

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.8 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s33-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

1bcfcf052a5f075a974b6161f219e6bd1bbe1c40a11c395f7308b1b903f19f32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 07 May 2024 01:25:18 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 109472
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 07 May 2024 01:25:18 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
253 B 339ms
16ms Ping
text/plain 142.251.40.206
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-V21CT0R1FX&gtm=45je4510v893716759za200&_p=1715045118435&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=903398415.1715045119&ul=en-us&sr=1600x1200&ir=1&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.118%7CGoogle%2520Chrome%3B124.0.6367.118%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_eu=EA&_s=1&cu=USD&dl=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware%3Futm_campaign%3DFuture%20PLC.%26utm_medium%3DAffiliate%26utm_content%3DOnline%20Tracking%20Link%26utm_source%3DFuture%20PLC.%26utm_term%3DImpact&dt=Malware%3A%20Cuckoo%20Behaves%20Like%20Cross%20Between%20Infostealer%20and%20Spyware&sid=1715045119&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1&up.system_color_mode=Light&up.user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F124.0.0.0%20Safari%2F537.36&tfd=1534
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-V21CT0R1FX&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.40.206 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s38-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 07 May 2024 01:25:19 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.kandji.io
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
253 B 352ms
16ms Ping
text/plain 142.251.111.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-V21CT0R1FX&cid=903398415.1715045119&gtm=45je4510v893716759za200&aip=1&dma=0&gcd=13l3l3l3l1&npa=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-V21CT0R1FX&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS: bk-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 07 May 2024 01:25:19 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.kandji.io
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 257 KB
88 KB 42ms
41ms Script
application/javascript 142.250.80.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-781421631&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T7GZQ3L

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.8 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s33-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

20d82657ec70a33dbdafd19d6d1ecee26e0a47e7509f4a7cbf0a781472aed208

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 07 May 2024 01:25:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 89929
x-xss-protection: 0
last-modified: Tue, 07 May 2024 00:09:18 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 07 May 2024 01:25:19 GMT

GET
H2

200

/
www.google.com/pagead/1p-conversion/781421631/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/781421631/?label=1lluCKXMhqUZEL-YzvQC&guid=ON&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/781421631/?label=1lluCKXMhqUZEL-YzvQC&guid=ON&script=0&ct_cookie_present=false&random=543707229&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJfB...
https://www.google.com/pagead/1p-conversion/781421631/?label=1lluCKXMhqUZEL-YzvQC&guid=ON&script=0&ct_cookie_present=false&random=543707229&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJfBsQI&pscrd=IhMIkKr0-LD...

42 B
108 B

742ms
30ms

Image
image/gif

142.250.80.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/781421631/?label=1lluCKXMhqUZEL-YzvQC&guid=ON&script=0&ct_cookie_present=false&random=543707229&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJfBsQI&pscrd=IhMIkKr0-LD6hQMV84qDCB0oIA2xMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6nwJodHRwczovL2Jsb2cua2FuZGppLmlvL21hbHdhcmUtY3Vja29vLWluZm9zdGVhbGVyLXNweXdhcmU_aW1wYWN0X2NsaWNraWQ9V3ZZUnZCMGNreHlLVGl6VFBOVmUtVkR0VWtIVC1TU1kxVGlPVWswJnV0bV9jYW1wYWlnbj1GdXR1cmUlMjBQTEMuJnV0bV9tZWRpdW09QWZmaWxpYXRlJnV0bV9jb250ZW50PU9ubGluZSUyMFRyYWNraW5nJTIwTGluayZ1dG1fc291cmNlPUZ1dHVyZSUyMFBMQy4mdXRtX3Rlcm09SW1wYWN0JmlyZ3djPTEmcGFydG5lcj1GdXR1cmUlMjBQTEMuJm1waWQ9MjIxMTA5Jmdyb3VwPQ&is_vtc=1&cid=CAQSGwB7FLtqKdV_AlB_xNRLbx5iIkqAMRJJ-6dFjQ&random=814196700

Requested by

Protocol

Server

142.250.80.68 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 May 2024 01:25:20 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 07 May 2024 01:25:20 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-conversion/781421631/?label=1lluCKXMhqUZEL-YzvQC&guid=ON&script=0&ct_cookie_present=false&random=543707229&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJfBsQI&pscrd=IhMIkKr0-LD6hQMV84qDCB0oIA2xMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6nwJodHRwczovL2Jsb2cua2FuZGppLmlvL21hbHdhcmUtY3Vja29vLWluZm9zdGVhbGVyLXNweXdhcmU_aW1wYWN0X2NsaWNraWQ9V3ZZUnZCMGNreHlLVGl6VFBOVmUtVkR0VWtIVC1TU1kxVGlPVWswJnV0bV9jYW1wYWlnbj1GdXR1cmUlMjBQTEMuJnV0bV9tZWRpdW09QWZmaWxpYXRlJnV0bV9jb250ZW50PU9ubGluZSUyMFRyYWNraW5nJTIwTGluayZ1dG1fc291cmNlPUZ1dHVyZSUyMFBMQy4mdXRtX3Rlcm09SW1wYWN0JmlyZ3djPTEmcGFydG5lcj1GdXR1cmUlMjBQTEMuJm1waWQ9MjIxMTA5Jmdyb3VwPQ&is_vtc=1&cid=CAQSGwB7FLtqKdV_AlB_xNRLbx5iIkqAMRJJ-6dFjQ&random=814196700
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 tc_imp.gif
obs.testrobotflower.com/tracker/ 43 B
79 B 12ms
12ms Image
image/gif 52.45.196.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://obs.testrobotflower.com/tracker/tc_imp.gif?e=37dfbd8ee84e00126bebc731ef468b949225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5b168f6e2e17071a10acf9f29f674184d7df037d381cad2c7150816889379257635126c25a5309600509c6ba3f4677be26bb25cb43e29625f15a6eb20f2e7e0fdb50ee54e285929c68f37950aa2084ba5f7ff35b7b1a2d18c8c9077af562b7818fbd1910fa0a9fc95df820da75c45b956279f02b01f2040e0228d2595fe69fe0a100ba2f965f980cf64d766dbad1276140023df819958d45a95f60e8e4e47116253bc6f57662d4dd09012b4675190bb98e32606d64f5ac183bd5b4f02d97fe58740f30b9e4f0d58a7dac8bdb0fee57c90c3b36cebaccbcf53dc2d4b339c23a5ad6abc12a1e44f7673bad820876b08de97e8d04fc44b4980a870d97dd75d66071d2d964d27a8f80b4acd8f1b84874a275efa5a3764e69ed8f24c1f617ae1603528c020598898fcccced9337cb24d78efa996af56978248325209b86924f31ede97da000ee984bc942bb46725f749e37b617c7ee9874a0b10aeb28e0c0e8fd71b9506e5bb26f25682d7f75ea9b6ae601c3da8819a49d6aef9327df8eb6da6a99a7f758212edadb706597f31e4c0dc9e3e532fd7fc7e72db9b677ee25f175c04591508ac76f984463b1f0d66b40613c5a745e4915aa85ce3d8159ee1b19562bf8c81681c30e49bae5b0f9e32980beb1f1f0bdebb4091a29f947e6ca2a7095062146b827083331fb02f2364891afd73ac837907686aa3a8de94fdd255a632d743957d982b1ce3e7b35e66b5b838e99e2e4c751079fb1bd74809831249d921f2e75ebc58c442bb63b971dca4ba060c500d1cb10f1a620b18982c0fd2470f3f269718877ba9ff5fa049668280447c13e1612f3f61d9de606d885899b0cdf8d9560566206ba7deb56b849a0df38d06b147005632221f3509cdf2149ab3891d4a96c8c9109f52061a503613e83fa875829b228a0d054a353230a58a1293090ed8b7ac13c3d998c0fa2dddbe38142da5d553e14f277255180910c5cba38fbffc12d8fd4f00f5d7ca2623c0904cf1558fa98ee1812917e70d3978443d5d5bacf5a25a631bb07695ed04f237fd0d0184097cbe0dee1ae0ee23daf72c824c28b1ed9eefe2b2bf28040c382a3b4c4f7bbd12616c9bf7147912d93149c59e0e12baccaccd479acc5a187fc2c1eccbee48b23b95dd5316f700e7a89d56062ce6ff85ccb8b31ac1228e6685fcf38adf13b2fef0374120ccfafa964e0d316416b5b3e949a84ee80228414a5ad353f9382120d0a40612737b175e29d31538df1d0a695c2c1cbf8dd34f0b7ca4938772c0f69382419d31c5d09e9a1b9a533bcb13511dbd215f3c934d2c29a97c2ffba1dfa078d14b03ca5d7afcbdf6f33948199b668670d2683dddce23503a29a55755ef72db42a6902f712a23f99442f91065390d8e8b8d7df9afbd336cd57979d6c94f7b7d56be8dfbc614c95908b36b135e68af04345ce892b96c3786fb61551bd1a4c7a1a&cri=owj5ck4TG9&ts=417&cb=1715045119331
Requested by: Host: blog.kandji.io
URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 52.45.196.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-196-192.compute-1.amazonaws.com
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
date: Tue, 07 May 2024 01:25:19 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
BLOB 200
OK 3986c830-9eb0-4353-a0b8-3ee56c388081
https://blog.kandji.io/ 261 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://blog.kandji.io/3986c830-9eb0-4353-a0b8-3ee56c388081
Requested by: Host: blog.kandji.io
URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 250260acfc57d0e8ac6a5e948c5f6108556bdfded2f08e6229bd18d3adc86214

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Length: 261
Content-Type

GET
BLOB 200
OK 38007fd9-8fe5-4840-9fb1-602171884157
https://blog.kandji.io/ 529 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://blog.kandji.io/38007fd9-8fe5-4840-9fb1-602171884157
Requested by: Host: blog.kandji.io
URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0ad5dcf0c25bc5b4701df692bd59913ce3ea4504c4e4d5df8ab7b2a9bd19d225

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Length: 529
Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202303.1.0/ 407 KB
98 KB 20ms
20ms Script
application/javascript 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202303.1.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

099d33a1d679bcfa3722a172d91742af80d45166f760db1512e4944a9d95bc23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 May 2024 01:25:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 12zQcT/rVMicuxojEvnp3g==
age: 21802
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 100389
x-ms-lease-status: unlocked
last-modified: Tue, 18 Apr 2023 02:32:15 GMT
server: cloudflare
etag: 0x8DB3FB51FD9A927
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 28d3babc-501e-0022-05ac-12fc9c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 87fd6a5c2adf0f90-EWR

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/781421631/ 3 KB
2 KB 627ms
65ms Script
text/javascript 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/781421631/?random=1715045119420&cv=11&fst=1715045119420&bg=ffffff&guid=ON&async=1&gtm=45be4510v885711243za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware%3Fimpact_clickid%3DWvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0%26utm_campaign%3DFuture%2520PLC.%26utm_medium%3DAffiliate%26utm_content%3DOnline%2520Tracking%2520Link%26utm_source%3DFuture%2520PLC.%26utm_term%3DImpact%26irgwc%3D1%26partner%3DFuture%2520PLC.%26mpid%3D221109%26group%3D&hn=www.googleadservices.com&frm=0&tiba=Malware%3A%20Cuckoo%20Behaves%20Like%20Cross%20Between%20Infostealer%20and%20Spyware&npa=0&pscdl=noapi&auid=1831954258.1715045119&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.118%7CGoogle%2520Chrome%3B124.0.6367.118%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-781421631&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

cafe /

Resource Hash

5dfe99f8540962833d70393060fb02ec8a61fc26751fe52faa1d753e7c749984

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 07 May 2024 01:25:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1620
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/781421631/ 3 KB
2 KB 30ms
30ms Script
text/javascript 142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/781421631/?random=1715045119437&cv=11&fst=1715045119437&bg=ffffff&guid=ON&async=1&gtm=45be4510v885711243za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware%3Fimpact_clickid%3DWvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0%26utm_campaign%3DFuture%2520PLC.%26utm_medium%3DAffiliate%26utm_content%3DOnline%2520Tracking%2520Link%26utm_source%3DFuture%2520PLC.%26utm_term%3DImpact%26irgwc%3D1%26partner%3DFuture%2520PLC.%26mpid%3D221109%26group%3D&label=1lluCKXMhqUZEL-YzvQC&hn=www.googleadservices.com&frm=0&tiba=Malware%3A%20Cuckoo%20Behaves%20Like%20Cross%20Between%20Infostealer%20and%20Spyware&gtm_ee=1&npa=0&pscdl=noapi&auid=1831954258.1715045119&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.118%7CGoogle%2520Chrome%3B124.0.6367.118%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&ec_mode=a&fdr=QA&data=event%3Dconversion&em=tv.1&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-781421631&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s79-in-f2.1e100.net

Software

cafe /

Resource Hash

cd1c23d30067b0cc8081b4558286b54ffa07b3dd3016f9e6a14d9eb8c0e34730

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 07 May 2024 01:25:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2027
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/52104b08-403c-474b-8e63-8560d38d0080/03671698-6fce-41d2-9923-6d638bd47d4c/ 102 KB
19 KB 26ms
26ms Fetch
application/x-javascript 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/52104b08-403c-474b-8e63-8560d38d0080/03671698-6fce-41d2-9923-6d638bd47d4c/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202303.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f4f10148f08d9c4d64b6b8e582eb8bea4f3465435b46fdae96076894eb21e57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 May 2024 01:25:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 9924
content-md5: 6YAHBWJVty0S7Rqo+hSfVw==
content-length: 19524
x-ms-lease-status: unlocked
last-modified: Thu, 15 Jun 2023 16:56:07 GMT
server: cloudflare
etag: 0x8DB6DC169B51599
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: e2f2c9f7-001e-0000-1450-793983000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 87fd6a5c98d01889-EWR
expires: Wed, 08 May 2024 01:25:19 GMT

GET
H2

200

/
www.google.com/pagead/1p-conversion/781421631/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/781421631/?random=807699336&cv=11&fst=1715045119437&bg=ffffff&guid=ON&async=1&gtm=45be4510v885711243za200&gcd=13l3l3l3l1&dma=0&u_w=1...
https://www.google.com/pagead/1p-conversion/781421631/?random=807699336&cv=11&fst=1715045119437&bg=ffffff&guid=ON&async=1&gtm=45be4510v885711243za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=http...

42 B
108 B

717ms
39ms

Image
image/gif

142.250.80.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/781421631/?random=807699336&cv=11&fst=1715045119437&bg=ffffff&guid=ON&async=1&gtm=45be4510v885711243za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware%3Fimpact_clickid%3DWvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0%26utm_campaign%3DFuture%2520PLC.%26utm_medium%3DAffiliate%26utm_content%3DOnline%2520Tracking%2520Link%26utm_source%3DFuture%2520PLC.%26utm_term%3DImpact%26irgwc%3D1%26partner%3DFuture%2520PLC.%26mpid%3D221109%26group%3D&label=1lluCKXMhqUZEL-YzvQC&hn=www.googleadservices.com&frm=0&tiba=Malware%3A%20Cuckoo%20Behaves%20Like%20Cross%20Between%20Infostealer%20and%20Spyware&gtm_ee=1&npa=0&pscdl=noapi&auid=1831954258.1715045119&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.118%7CGoogle%2520Chrome%3B124.0.6367.118%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&ec_mode=a&fdr=QA&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJfBsQI&pscrd=IhMI2dr5-LD6hQMVWq2DCB0vGAUwMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6nwJodHRwczovL2Jsb2cua2FuZGppLmlvL21hbHdhcmUtY3Vja29vLWluZm9zdGVhbGVyLXNweXdhcmU_aW1wYWN0X2NsaWNraWQ9V3ZZUnZCMGNreHlLVGl6VFBOVmUtVkR0VWtIVC1TU1kxVGlPVWswJnV0bV9jYW1wYWlnbj1GdXR1cmUlMjBQTEMuJnV0bV9tZWRpdW09QWZmaWxpYXRlJnV0bV9jb250ZW50PU9ubGluZSUyMFRyYWNraW5nJTIwTGluayZ1dG1fc291cmNlPUZ1dHVyZSUyMFBMQy4mdXRtX3Rlcm09SW1wYWN0JmlyZ3djPTEmcGFydG5lcj1GdXR1cmUlMjBQTEMuJm1waWQ9MjIxMTA5Jmdyb3VwPQ&is_vtc=1&cid=CAQSGwB7FLtqG9hjyYjpxkwzdbkmJAAz4qPumRMrzw&random=1515134654

Requested by

Protocol

Server

142.250.80.68 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 May 2024 01:25:20 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 07 May 2024 01:25:20 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-conversion/781421631/?random=807699336&cv=11&fst=1715045119437&bg=ffffff&guid=ON&async=1&gtm=45be4510v885711243za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware%3Fimpact_clickid%3DWvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0%26utm_campaign%3DFuture%2520PLC.%26utm_medium%3DAffiliate%26utm_content%3DOnline%2520Tracking%2520Link%26utm_source%3DFuture%2520PLC.%26utm_term%3DImpact%26irgwc%3D1%26partner%3DFuture%2520PLC.%26mpid%3D221109%26group%3D&label=1lluCKXMhqUZEL-YzvQC&hn=www.googleadservices.com&frm=0&tiba=Malware%3A%20Cuckoo%20Behaves%20Like%20Cross%20Between%20Infostealer%20and%20Spyware&gtm_ee=1&npa=0&pscdl=noapi&auid=1831954258.1715045119&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.118%7CGoogle%2520Chrome%3B124.0.6367.118%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&ec_mode=a&fdr=QA&data=event%3Dconversion&em=tv.1&fmt=3&ct_cookie_present=false&sscte=1&crd=CLHBsQIIsMGxAgi5wbECCJfBsQI&pscrd=IhMI2dr5-LD6hQMVWq2DCB0vGAUwMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6nwJodHRwczovL2Jsb2cua2FuZGppLmlvL21hbHdhcmUtY3Vja29vLWluZm9zdGVhbGVyLXNweXdhcmU_aW1wYWN0X2NsaWNraWQ9V3ZZUnZCMGNreHlLVGl6VFBOVmUtVkR0VWtIVC1TU1kxVGlPVWswJnV0bV9jYW1wYWlnbj1GdXR1cmUlMjBQTEMuJnV0bV9tZWRpdW09QWZmaWxpYXRlJnV0bV9jb250ZW50PU9ubGluZSUyMFRyYWNraW5nJTIwTGluayZ1dG1fc291cmNlPUZ1dHVyZSUyMFBMQy4mdXRtX3Rlcm09SW1wYWN0JmlyZ3djPTEmcGFydG5lcj1GdXR1cmUlMjBQTEMuJm1waWQ9MjIxMTA5Jmdyb3VwPQ&is_vtc=1&cid=CAQSGwB7FLtqG9hjyYjpxkwzdbkmJAAz4qPumRMrzw&random=1515134654
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 218 KB
59 KB 326ms
5ms Script
application/x-javascript 31.13.71.7
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T7GZQ3L

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.71.7 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-lga3.fbcdn.net

Software

Resource Hash

f589b180c1064f697c91ac117fafda9aff1c66123a099e82da0b976a09011510

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 07 May 2024 01:25:19 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57845
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=1, rtx=0, c=12, mss=1346, tbw=2779, tp=-1, tpl=-1, uplat=1, ullat=-1
pragma: public
x-fb-debug: Gygri5o+IfgUkWI91BXo18beDUSb3eiQeC8JgDywsAOQNNwflQeSTDePDiqsmcLw1vmIX5opFgRELJUZk0gvbw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 otFloatingFlat.json Show response
cdn.cookielaw.org/scripttemplates/202303.1.0/assets/ 10 KB
3 KB 20ms
19ms Fetch
application/json 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202303.1.0/assets/otFloatingFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202303.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

179a0ba55c3bbf759340ba2a57846f81a7de249ed7e502b5e8814af2ef964533

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 May 2024 01:25:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: PubgfHj+VI+S8CXDj6L+0w==
age: 84877
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 2702
x-ms-lease-status: unlocked
last-modified: Tue, 18 Apr 2023 02:32:08 GMT
server: cloudflare
etag: 0x8DB3FB51B88C45D
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 9566c74a-401e-00a8-6161-23a72d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 87fd6a5d09261889-EWR

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/202303.1.0/assets/v2/ 61 KB
12 KB 21ms
20ms Fetch
application/json 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202303.1.0/assets/v2/otPcCenter.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202303.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b382967162c482928529c765a21bf9ae4141dd1ccbdbf480140bdbd67eab8991

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 May 2024 01:25:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 94mqEGmIxKb0iFeUZrbqtw==
age: 84155
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 12540
x-ms-lease-status: unlocked
last-modified: Tue, 18 Apr 2023 02:32:10 GMT
server: cloudflare
etag: 0x8DB3FB51C6E493B
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 9475e437-101e-001c-2994-226be3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 87fd6a5d09271889-EWR

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202303.1.0/assets/ 21 KB
4 KB 22ms
21ms Fetch
text/css 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202303.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202303.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

930239150e702d9d4bf43c3881aa70f8ad5fd9068dcbecb7c8bcca654784f7f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 07 May 2024 01:25:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: XcxlleAcPGO2n5kTZrHH2Q==
age: 84155
x-ms-lease-status: unlocked
last-modified: Tue, 18 Apr 2023 02:32:19 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 81f0c99d-101e-0033-67ce-216628000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 87fd6a5d09281889-EWR

GET
H2 200 821678078239751 Show response
connect.facebook.net/signals/config/ 66 KB
14 KB 47ms
46ms Script
application/x-javascript 31.13.71.7
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/821678078239751?v=2.9.155&r=stable&domain=blog.kandji.io&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.71.7 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-lga3.fbcdn.net

Software

Resource Hash

17b3c66292df72b6c315c952f755b9272e0beaee2bb143457c937ec106578cee

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 07 May 2024 01:25:19 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=2, rtx=0, c=62, mss=1346, tbw=63297, tp=-1, tpl=-1, uplat=43, ullat=0
pragma: public
x-fb-debug: 28SL+DZ8tiaPALsxGnJ9fMJH02DRt1AVjKkvVp0t8dgrA7Q7F77bfrwIH1Yhc55TgC+q6ONA33XupXShLR++pA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
273 B 328ms
5ms Image
text/plain 31.13.71.36
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=821678078239751&ev=PageView&dl=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware%3Fimpact_clickid%3DWvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0%26utm_campaign%3DFuture%2520PLC.%26utm_medium%3DAffiliate%26utm_content%3DOnline%2520Tracking%2520Link%26utm_source%3DFuture%2520PLC.%26utm_term%3DImpact%26irgwc%3D1%26partner%3DFuture%2520PLC.%26mpid%3D221109%26group%3D&rl=&if=false&ts=1715045119935&sw=1600&sh=1200&v=2.9.155&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4126&fbp=fb.1.1715045119933.1425587431&cs_est=true&ler=empty&cdl=API_unavailable&it=1715045119873&coo=false&tm=1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.71.36 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-lga3.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=1, rtx=0, c=10, mss=1346, tbw=2769, tp=-1, tpl=-1, uplat=1, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 07 May 2024 01:25:20 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.google.com/pagead/1p-user-list/781421631/ 42 B
455 B 707ms
25ms Image
image/gif 142.250.80.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/781421631/?random=1715045119420&cv=11&fst=1715043600000&bg=ffffff&guid=ON&async=1&gtm=45be4510v885711243za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware%3Fimpact_clickid%3DWvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0%26utm_campaign%3DFuture%2520PLC.%26utm_medium%3DAffiliate%26utm_content%3DOnline%2520Tracking%2520Link%26utm_source%3DFuture%2520PLC.%26utm_term%3DImpact%26irgwc%3D1%26partner%3DFuture%2520PLC.%26mpid%3D221109%26group%3D&hn=www.googleadservices.com&frm=0&tiba=Malware%3A%20Cuckoo%20Behaves%20Like%20Cross%20Between%20Infostealer%20and%20Spyware&npa=0&pscdl=noapi&auid=1831954258.1715045119&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.118%7CGoogle%2520Chrome%3B124.0.6367.118%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwB7FLtqLSQ2ITRMVD7icr7dJViAp9y6G-BRuQ&random=2194901822&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.68 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 07 May 2024 01:25:20 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 mon Show response
obs.testrobotflower.com/ 0
146 B 14ms
13ms XHR
application/json 52.45.196.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.testrobotflower.com/mon
Requested by: Host: ob.testrobotflower.com
URL: https://ob.testrobotflower.com/i/130ddaec76c305292f6ec30ebef2d5ce.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 52.45.196.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-196-192.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://blog.kandji.io
date: Tue, 07 May 2024 01:25:20 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

POST
H2 200 mon Show response
obs.testrobotflower.com/ 0
16 B 14ms
14ms XHR
application/json 52.45.196.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.testrobotflower.com/mon
Requested by: Host: ob.testrobotflower.com
URL: https://ob.testrobotflower.com/i/130ddaec76c305292f6ec30ebef2d5ce.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 52.45.196.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-196-192.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://blog.kandji.io
date: Tue, 07 May 2024 01:25:20 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

POST
H2 200 mon Show response
obs.testrobotflower.com/ 0
39 B 15ms
15ms XHR
application/json 52.45.196.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.testrobotflower.com/mon
Requested by: Host: ob.testrobotflower.com
URL: https://ob.testrobotflower.com/i/130ddaec76c305292f6ec30ebef2d5ce.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 52.45.196.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-196-192.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://blog.kandji.io
date: Tue, 07 May 2024 01:25:22 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

POST
H2 204 collect
analytics.google.com/g/ 0
54 B 31ms
30ms Ping
text/plain 142.251.40.206
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-V21CT0R1FX&gtm=45je4510v893716759za200&_p=1715045118435&gcd=13l3l3l3l1&npa=0&dma=0&cid=903398415.1715045119&ul=en-us&sr=1600x1200&ir=1&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.118%7CGoogle%2520Chrome%3B124.0.6367.118%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_eu=EA&_s=2&cu=USD&dl=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware%3Futm_campaign%3DFuture%20PLC.%26utm_medium%3DAffiliate%26utm_content%3DOnline%20Tracking%20Link%26utm_source%3DFuture%20PLC.%26utm_term%3DImpact&dt=Malware%3A%20Cuckoo%20Behaves%20Like%20Cross%20Between%20Infostealer%20and%20Spyware&sid=1715045119&sct=1&seg=0&en=CQ&_ee=1&_et=210&up.cq_category=bots&tfd=6749
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-V21CT0R1FX&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.40.206 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s38-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 07 May 2024 01:25:24 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.kandji.io
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 mon Show response
obs.testrobotflower.com/ 0
39 B 41ms
40ms XHR
application/json 52.45.196.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.testrobotflower.com/mon
Requested by: Host: ob.testrobotflower.com
URL: https://ob.testrobotflower.com/i/130ddaec76c305292f6ec30ebef2d5ce.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 52.45.196.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-196-192.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://blog.kandji.io
date: Tue, 07 May 2024 01:25:24 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

GET
H2 200 PPNeueMontreal-Variable.ttf
5058330.fs1.hubspotusercontent-na1.net/hubfs/5058330/raw_assets/public/Kandji_December2022/fonts/ 190 KB
92 KB 382ms
59ms Font
font/ttf 172.64.146.132
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://5058330.fs1.hubspotusercontent-na1.net/hubfs/5058330/raw_assets/public/Kandji_December2022/fonts/PPNeueMontreal-Variable.ttf
Requested by: Host: blog.kandji.io
URL: https://blog.kandji.io/hs-fs/hub/5058330/hub_generated/template_assets/95659790937/1714606602095/Kandji_December2022/css/kandji.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.132 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 910f74967a8d03e18bdd8b4a46a1573653c71d374e9823f2d416d9bd250b1ea6

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.kandji.io/
Origin: https://blog.kandji.io
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
x-amz-meta-cache-tag: F-95662839379,FD-95664176134,P-5058330,FLS-ALL
age: 2102494
x-amz-request-id: CPGTQPVZABWW9NTG
x-amz-server-side-encryption: AES256
edge-cache-tag: F-95662839379,FD-95664176134,P-5058330,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
etag: W/"61d5f1a1a93cc2b08ca4fc4032b9df1e"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: font/ttf
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1671243819749
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
x-robots-tag: none
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Tue, 07 May 2024 01:25:24 GMT
via: 1.1 7d7ca86035bc3bfd0afe842de972bb66.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: LseMZwrny9avZzv6GoE3a9pheWcyZ0eh
x-amz-cf-pop: BOS50-C3
x-hs-alternate-content-type: text/plain
x-cache: RefreshHit from cloudfront
cache-tag: F-95662839379,FD-95664176134,P-5058330,FLS-ALL
x-amz-meta-index-tag: none
x-amz-storage-class: INTELLIGENT_TIERING
x-amz-id-2: tV4vFpmR8GvFpNp4iGX1HvLOmwqtHoWgt4HGBqljJtte5L4mFQACIruEBTPuoeSBtg5gXyHVHnY=
last-modified: Sat, 17 Dec 2022 02:23:40 GMT
server: cloudflare
cf-ray: 87fd6a7e7ea74243-EWR
timing-allow-origin: 5058330.fs1.hubspotusercontent-na1.net
x-amz-cf-id: qFB26E0lf3yjfMEE5Pt69PrKvN1uO-oY3uCIHrUxw_AE_q37o4eLyQ==

POST
H2 200 mon Show response
obs.testrobotflower.com/ 0
39 B 22ms
21ms XHR
application/json 52.45.196.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.testrobotflower.com/mon
Requested by: Host: ob.testrobotflower.com
URL: https://ob.testrobotflower.com/i/130ddaec76c305292f6ec30ebef2d5ce.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 52.45.196.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-196-192.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://blog.kandji.io
date: Tue, 07 May 2024 01:25:29 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

POST
H2 200 mon Show response
obs.testrobotflower.com/ 0
39 B 21ms
21ms XHR
application/json 52.45.196.192
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.testrobotflower.com/mon
Requested by: Host: ob.testrobotflower.com
URL: https://ob.testrobotflower.com/i/130ddaec76c305292f6ec30ebef2d5ce.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 52.45.196.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-196-192.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://blog.kandji.io
date: Tue, 07 May 2024 01:25:34 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

Verdicts & Comments Add Verdict or Comment

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

14 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.ojrq.net/	1970-01-21 06:00:05	Name: brwsr Value: a9b49999-0c10-11ef-b5c3-bbaddcbed6e5
.sjv.io/	1970-01-21 06:00:05	Name: brwsr Value: a9b49999-0c10-11ef-b5c3-bbaddcbed6e5
kandji.sjv.io/	1970-01-21 00:43:17	Name: irld Value: LVXyzY-X8gwM2Q4Q3mjUwhWULVpSVGXyKdWAnSZ%3AT4I3I7X0z
.kandji.io/	1970-01-20 22:35:29	Name: _cq_duid Value: 1.1715045118.sDO7ZUho2EPH9mSI
.kandji.io/	1969-12-31 23:59:59	Name: _cq_suid Value: 1.1715045118.OtkzT43yckAyU8xS
.kandji.io/	1970-01-21 06:00:05	Name: _ga Value: GA1.1.903398415.1715045119
obs.testrobotflower.com/	1970-01-21 04:27:55	Name: cg_uuid Value: 86df4a77cd6d6cfeeccd5a8cfe1f04d9
.kandji.io/	1970-01-21 06:00:05	Name: _ga_V21CT0R1FX Value: GS1.1.1715045119.1.0.1715045119.60.0.0
.kandji.io/	1970-01-20 22:33:41	Name: _gcl_au Value: 1.1.1831954258.1715045119
.kandji.io/	1970-01-21 05:09:41	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Mon+May+06+2024+15%3A25%3A19+GMT-1000+(Hawaii-Aleutian+Standard+Time)&version=202303.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware%3Fimpact_clickid%3DWvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0%26utm_campaign%3DFuture%2520PLC.%26utm_medium%3DAffiliate%26utm_content%3DOnline%2520Tracking%2520Link%26utm_source%3DFuture%2520PLC.%26utm_term%3DImpact%26irgwc%3D1%26partner%3DFuture%2520PLC.%26mpid%3D221109%26group%3D
.kandji.io/	1970-01-20 22:33:41	Name: _fbp Value: fb.1.1715045119933.1425587431
.doubleclick.net/	1970-01-20 20:24:06	Name: test_cookie Value: CheckForPermission
.blog.kandji.io/	1969-12-31 23:59:59	Name: __cfruid Value: cd997ab7c981c2e57287bec23c312ac4310e0821-1715045124
.blog.kandji.io/	1970-01-20 20:24:06	Name: __cf_bm Value: pDY.nXaGCgRoYz44N5v45KcpJ0u0PQivG4pSIVCer08-1715045124-1.0.1.1-Z00v_e.auDA8hjhmdMiHuUpZglaw3W5NKDM4QRXBrs0Ddarcu7aQRRDa.U0sTVoY4X2fxk6mQiGi2bQEzZPPjg

14 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=(Line 473) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
worker	verbose	URL: blob:https://blog.kandji.io/3986c830-9eb0-4353-a0b8-3ee56c388081(Line 1) Message: Error
other	warning	URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=(Line 473) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/821678078239751?v=2.9.155&r=stable&domain=blog.kandji.io&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105(Line 107) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=(Line 473) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=(Line 473) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=(Line 473) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=(Line 473) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=(Line 473) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group=(Line 473) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
network	error	URL: https://kandji.sjv.io/c/221109/1475702/17435?subId1=tomsguide-us-8126601953889851819&sharedId=tomsguide-us&u=https%3A%2F%2Fblog.kandji.io%2Fmalware-cuckoo-infostealer-spyware Message: Failed to load resource: net::ERR_QUIC_PROTOCOL_ERROR
other	warning	URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group= Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group= Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.kandji.io/malware-cuckoo-infostealer-spyware?impact_clickid=WvYRvB0ckxyKTizTPNVe-VDtUkHT-SSY1TiOUk0&utm_campaign=Future%20PLC.&utm_medium=Affiliate&utm_content=Online%20Tracking%20Link&utm_source=Future%20PLC.&utm_term=Impact&irgwc=1&partner=Future%20PLC.&mpid=221109&group= Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5058330.fs1.hubspotusercontent-na1.net
analytics.google.com
blog.kandji.io
cdn.cookielaw.org
connect.facebook.net
geolocation.onetrust.com
googleads.g.doubleclick.net
kandji.sjv.io
ob.testrobotflower.com
obs.testrobotflower.com
stats.g.doubleclick.net
www.facebook.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.ojrq.net
104.19.178.52
108.139.47.20
142.250.72.98
142.250.80.68
142.250.80.8
142.251.111.155
142.251.40.206
142.251.40.98
172.64.146.132
172.64.155.119
199.60.103.29
2606:2c40::c73c:67e3
31.13.71.36
31.13.71.7
34.95.127.121
35.227.211.136
52.45.196.192
099d33a1d679bcfa3722a172d91742af80d45166f760db1512e4944a9d95bc23
0ad5dcf0c25bc5b4701df692bd59913ce3ea4504c4e4d5df8ab7b2a9bd19d225
179a0ba55c3bbf759340ba2a57846f81a7de249ed7e502b5e8814af2ef964533
17b3c66292df72b6c315c952f755b9272e0beaee2bb143457c937ec106578cee
1bcfcf052a5f075a974b6161f219e6bd1bbe1c40a11c395f7308b1b903f19f32
20d82657ec70a33dbdafd19d6d1ecee26e0a47e7509f4a7cbf0a781472aed208
250260acfc57d0e8ac6a5e948c5f6108556bdfded2f08e6229bd18d3adc86214
260956d4d537ac0ac99a98735ce0d900b148e5c12fb8c3ebc483cad3e4eba1f9
3dbb76c2655ea2f996850c9101b4217c4343587e61e34555bd4d498de0ae7b69
4da8a6638ad70698ad3d01aa0ef124aebe35c297685c0796b174822f597b1d09
5dfe99f8540962833d70393060fb02ec8a61fc26751fe52faa1d753e7c749984
608854bc9b4ff57f231d9b41b1b325b4a987f48eb56f26d928868acd8a2f30dc
69e1f1c48622424da58b7e0a252ce36635da1ad1ec17a6bc43e395e5e479217e
6f08699117c1f15f6d35e7b4380d12d18a1881f075e177b5853b1017a3307544
7f4f10148f08d9c4d64b6b8e582eb8bea4f3465435b46fdae96076894eb21e57
8bb5b82601b4d9a2d5c0c2114554c057cfcbd14758cbfcc4caabcd22ad9abe6e
8da927b6b1240ffca4323fbb2a12c8e5abb541040965c2bc5b7d09a2eb963b02
910f74967a8d03e18bdd8b4a46a1573653c71d374e9823f2d416d9bd250b1ea6
930239150e702d9d4bf43c3881aa70f8ad5fd9068dcbecb7c8bcca654784f7f1
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9d2ed8ff28378191ad747458666b94dbe8cda83914db23a86217fbe7086d74e6
b382967162c482928529c765a21bf9ae4141dd1ccbdbf480140bdbd67eab8991
cd1c23d30067b0cc8081b4558286b54ffa07b3dd3016f9e6a14d9eb8c0e34730
cea95b67c69f3eadce6a5ae44f8c92cdc25d9ecfd4f1f07abddbcc5609508f9e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f171db8dc0eb7cec86c84ceac278dbf2fbe33770334635a2703186d14f4828b2
f589b180c1064f697c91ac117fafda9aff1c66123a099e82da0b976a09011510

blog.kandji.io Open in urlscan Pro 2606:2c40::c73c:67e3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

40 Requests

90 %HTTPS

6 %IPv6

13 Domains

16 Subdomains

16 IPs

2 Countries

949 kBTransfer

3115 kBSize

14 Cookies

37 Outgoing links

Page URL History

Redirected requests

40 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

blog.kandji.io Open in urlscan Pro
2606:2c40::c73c:67e3 Public Scan

Screenshot
Live screenshot

Full Image

40
Requests

90 %
HTTPS

6 %
IPv6

13
Domains

16
Subdomains

16
IPs

2
Countries

949 kB
Transfer

3115 kB
Size

14
Cookies

40 HTTP transactions
0 data transactions