blog.sucuri.net Open in urlscan Pro
2a02:fe80:1010::5 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
Submission: On September 26 via api (September 26th 2020, 7:41:31 pm UTC) from DE

Summary HTTP 82 Redirects Links 58 Behaviour Indicators

Summary

This website contacted 35 IPs in 7 countries across 28 domains to perform 82 HTTP transactions. The main IP is 2a02:fe80:1010::5, located in United Kingdom and belongs to SUCURI-SEC, US. The main domain is blog.sucuri.net.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on September 11th 2019. Valid for: 2 years.

This is the only time blog.sucuri.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
30	2a02:fe80:101... 2a02:fe80:1010::5	30148 (SUCURI-SEC) (SUCURI-SEC)
1	2a00:1450:400... 2a00:1450:4001:818::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:821::200e	15169 (GOOGLE) (GOOGLE)
1	35.186.249.72 35.186.249.72	15169 (GOOGLE) (GOOGLE)
2	104.111.215.136 104.111.215.136	16625 (AKAMAI-AS) (AKAMAI-AS)
4	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
3	2a00:1450:400... 2a00:1450:4001:820::200e	15169 (GOOGLE) (GOOGLE)
1	2600:1901:0:4... 2600:1901:0:498c::	15169 (GOOGLE) (GOOGLE)
9	93.184.220.42 93.184.220.42	15133 (EDGECAST) (EDGECAST)
1	2a00:1450:400... 2a00:1450:400c:c0c::9c	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81a::2008	15169 (GOOGLE) (GOOGLE)
2	2a02:26f0:10c... 2a02:26f0:10c:582::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:4700::68... 2606:4700::6811:d3cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	147.75.80.95 147.75.80.95	54825 (PACKET) (PACKET)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
1 1	2a00:1450:400... 2a00:1450:4001:814::2002	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:819::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:818::2003	15169 (GOOGLE) (GOOGLE)
1	107.178.240.159 107.178.240.159	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
1	147.75.84.91 147.75.84.91	54825 (PACKET) (PACKET)
1	147.75.33.229 147.75.33.229	54825 (PACKET) (PACKET)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 2	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:4700::68... 2606:4700::6811:44b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:14bf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	35.186.240.205 35.186.240.205	15169 (GOOGLE) (GOOGLE)
2	34.96.127.16 34.96.127.16	15169 (GOOGLE) (GOOGLE)
1	130.211.38.145 130.211.38.145	15169 (GOOGLE) (GOOGLE)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
82	35

30 2a02:fe80:1010::5 (United Kingdom)

ASN30148 (SUCURI-SEC, US)

blog.sucuri.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.249.72 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 72.249.186.35.bc.googleusercontent.com

d.impactradius-event.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.215.136 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-136.deploy.static.akamaitechnologies.com

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:498c:: (United States)

ASN15169 (GOOGLE, US)

cdn.mxpnl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 93.184.220.42 (London, United Kingdom)

ASN15133 (EDGECAST, US)

static.olark.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:10c:582::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:d3cc (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.80.95 (Parsippany, United States)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress16

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:819::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.178.240.159 (United States)

ASN15169 (GOOGLE, US)
PTR: 159.240.178.107.bc.googleusercontent.com

api-js.mixpanel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.84.91 (Parsippany, United States)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress13

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.33.229 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress12

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:11:101::b93f:9005 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:44b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:14bf (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.240.205 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 205.240.186.35.bc.googleusercontent.com

sucuri.7eer.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.96.127.16 (United States)

ASN15169 (GOOGLE, US)
PTR: 16.127.96.34.bc.googleusercontent.com

knrpc.olark.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.olark.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 130.211.38.145 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 145.38.211.130.bc.googleusercontent.com

log.olark.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	sucuri.net blog.sucuri.net	616 KB
12	olark.com static.olark.com knrpc.olark.com api.olark.com log.olark.com	585 KB
4	gstatic.com fonts.gstatic.com	37 KB
4	google-analytics.com www.google-analytics.com	53 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
3	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com	72 KB
2	facebook.com www.facebook.com	340 B
2	google.de www.google.de	644 B
2	google.com 1 redirects www.google.com	275 B
2	facebook.net connect.facebook.net	166 KB
2	bing.com bat.bing.com	8 KB
2	licdn.com snap.licdn.com	3 KB
2	doubleclick.net 1 redirects stats.g.doubleclick.net googleads.g.doubleclick.net	356 B
2	tiqcdn.com tags.tiqcdn.com	30 KB
1	hubspot.com track.hubspot.com	529 B
1	twitter.com analytics.twitter.com	651 B
1	7eer.net sucuri.7eer.net	470 B
1	t.co t.co	448 B
1	hs-banner.com js.hs-banner.com	12 KB
1	hs-analytics.net js.hs-analytics.net	18 KB
1	mixpanel.com api-js.mixpanel.com	327 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	hs-scripts.com js.hs-scripts.com	829 B
1	googletagmanager.com www.googletagmanager.com	36 KB
1	mxpnl.com cdn.mxpnl.com	27 KB
1	gravatar.com secure.gravatar.com	19 KB
1	impactradius-event.com d.impactradius-event.com	13 KB
1	googleapis.com fonts.googleapis.com	987 B
82	28

	Domain	Requested by
30	blog.sucuri.net	blog.sucuri.net
9	static.olark.com	blog.sucuri.net static.olark.com
4	fonts.gstatic.com	fonts.googleapis.com
4	www.google-analytics.com	blog.sucuri.net www.google-analytics.com
2	px.ads.linkedin.com	1 redirects blog.sucuri.net
2	www.facebook.com	blog.sucuri.net connect.facebook.net
2	www.google.de	blog.sucuri.net
2	www.google.com	1 redirects blog.sucuri.net
2	connect.facebook.net	tags.tiqcdn.com connect.facebook.net
2	bat.bing.com	tags.tiqcdn.com blog.sucuri.net
2	snap.licdn.com	tags.tiqcdn.com snap.licdn.com
2	tags.tiqcdn.com	blog.sucuri.net tags.tiqcdn.com
1	track.hubspot.com
1	analytics.twitter.com	static.ads-twitter.com
1	log.olark.com	blog.sucuri.net
1	api.olark.com	static.olark.com
1	knrpc.olark.com	static.olark.com
1	sucuri.7eer.net	d.impactradius-event.com
1	t.co	blog.sucuri.net
1	js.hs-banner.com	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	www.linkedin.com	1 redirects
1	vars.hotjar.com	static.hotjar.com
1	script.hotjar.com	static.hotjar.com
1	api-js.mixpanel.com	cdn.mxpnl.com
1	googleads.g.doubleclick.net	1 redirects
1	static.ads-twitter.com	tags.tiqcdn.com
1	static.hotjar.com	tags.tiqcdn.com
1	js.hs-scripts.com	tags.tiqcdn.com
1	www.googletagmanager.com	tags.tiqcdn.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	cdn.mxpnl.com	tags.tiqcdn.com
1	secure.gravatar.com	blog.sucuri.net
1	d.impactradius-event.com	blog.sucuri.net
1	fonts.googleapis.com	blog.sucuri.net
82	35

This site contains links to these domains. Also see Links.

Domain
sucuri.net
sitecheck.sucuri.net
dashboard.sucuri.net
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
www.instagram.com
sucuri.hs-sites.com
kb.sucuri.net
labs.sucuri.net
support.sucuri.net

Subject Issuer	Validity	Valid
*.sucuri.net Go Daddy Secure Certificate Authority - G2	`2019-09-11` - `2021-09-11`	2 years	crt.sh
upload.video.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.impactradius-event.com COMODO RSA Domain Validation Secure Server CA	`2019-01-08` - `2021-01-20`	2 years	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2020-03-16` - `2021-06-15`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
*.mxpnl.com RapidSSL RSA CA 2018	`2019-07-29` - `2021-07-28`	2 years	crt.sh
s2.wac.edgecastcdn.net DigiCert SHA2 Secure Server CA	`2019-05-01` - `2020-11-18`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-04` - `2021-08-04`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
static.hotjar.com Let's Encrypt Authority X3	`2020-08-16` - `2020-11-14`	3 months	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
*.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.mixpanel.com GeoTrust RSA CA 2018	`2020-04-20` - `2022-04-21`	2 years	crt.sh
www.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
script.hotjar.com Let's Encrypt Authority X3	`2020-08-17` - `2020-11-15`	3 months	crt.sh
vars.hotjar.com Let's Encrypt Authority X3	`2020-08-15` - `2020-11-13`	3 months	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-08-05` - `2021-02-05`	6 months	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.7eer.net COMODO RSA Domain Validation Secure Server CA	`2018-01-05` - `2021-01-27`	3 years	crt.sh
*.olark.com GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1	`2020-09-14` - `2021-10-16`	a year	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2020-07-27` - `2021-07-27`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
Frame ID: 753BFD08BCF9CF41F80210276561D4DF
Requests: 74 HTTP requests in this frame

Frame: https://static.olark.com/jsclient/loader0.js
Frame ID: 46C9B88DD3FA434C3DCE7CF59EBAB6FF
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Frame ID: 7EE148588F95AA686B3550EC329EB697
Requests: 1 HTTP requests in this frame

Frame: https://static.olark.com/jsclient/app.js
Frame ID: 14811F169D116DF47710F577AC1BC508
Requests: 7 HTTP requests in this frame

Frame: https://static.olark.com/jsclient-bucket2/storage.html?v=1600285780122
Frame ID: EACF60ECE130F25E3DDD16AECC54BAAC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /^\/\/static\.hotjar\.com\/c\/hotjar-/i

Tealium (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /^(?:https?:)?\/\/tags\.tiqcdn\.com\//i

Page Statistics

82
Requests

100 %
HTTPS

64 %
IPv6

28
Domains

35
Subdomains

35
IPs

7
Countries

1728 kB
Transfer

4634 kB
Size

30
Cookies

58 Outgoing links

These are links going to different origins than the main page.

URL: https://sucuri.net/website-antivirus/signup
Title: Products

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-security-platform/signup/
Title: Website Security Platform

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-firewall/
Title: Website Firewall (WAF)

Search URL Search Domain Scan URL

URL: https://sucuri.net/custom/enterprise/
Title: Enterprise Website Security

Search URL Search Domain Scan URL

URL: https://sucuri.net/custom/agency/
Title: Multisite Solutions

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-security-platform/
Title: Features

Search URL Search Domain Scan URL

URL: https://sucuri.net/malware-detection-scanning/
Title: Detection

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-hack-protection/
Title: Protection

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-performance/
Title: Performance

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-malware-removal/
Title: Response

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-backups/
Title: Backups

Search URL Search Domain Scan URL

URL: https://sucuri.net/partners/
Title: Partners

Search URL Search Domain Scan URL

URL: https://sucuri.net/referral/
Title: Referral Program

Search URL Search Domain Scan URL

URL: https://sucuri.net/ecommerce-website-security/
Title: Ecommerce

Search URL Search Domain Scan URL

URL: https://sucuri.net/guides/
Title: Resources

Search URL Search Domain Scan URL

URL: https://sucuri.net/webinars/
Title: Webinars

Search URL Search Domain Scan URL

URL: https://sucuri.net/infographics/
Title: Infographics

Search URL Search Domain Scan URL

URL: https://sitecheck.sucuri.net/
Title: SiteCheck

Search URL Search Domain Scan URL

URL: https://sucuri.net/reports/
Title: Reports

Search URL Search Domain Scan URL

URL: https://sucuri.net/email-courses/
Title: Email Courses

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-security-platform/help-now
Title: Immediate Help

Search URL Search Domain Scan URL

URL: https://dashboard.sucuri.net/login/
Title: Login

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-card-stealing-malware-gstaticapi.html
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=Magento%20Credit%20Card%20Stealing%20Malware%3A%20gstaticapi&url=https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html&via=sucurisecurity
Title: Twitter

Search URL Search Domain Scan URL

URL: https://twitter.com/KrasimirSec
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/in/krasimir-konov/
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.facebook.com/SucuriSecurity
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/sucurisecurity
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/sucuri-security
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.youtube.com/c/sucurinet
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.instagram.com/sucurisecurity/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://sucuri.net/reports/2019-hacked-website-report/?utm_source=Blog&utm_medium=WidgetLogic&utm_campaign=Report&utm_term=EN

Search URL Search Domain Scan URL

URL: https://sucuri.net/webinars/how-to-clean-hacked-magento-site?utm_source=Blog&utm_medium=WidgetLogic&utm_campaign=Webinar&utm_term=EN&utm_content=Hacked-Magento

Search URL Search Domain Scan URL

URL: https://sucuri.net/guides/pci-compliance-requirements-checklist?utm_source=Blog&utm_medium=WidgetLogic&utm_campaign=Guide&utm_term=EN&utm_content=PCI-Compliance

Search URL Search Domain Scan URL

URL: https://sucuri.net/guides/magento-security?utm_source=Blog&utm_medium=WidgetLogic&utm_campaign=Guide&utm_term=EN&utm_content=Magento-Security

Search URL Search Domain Scan URL

URL: https://sucuri.net/webinars/simple-steps-to-secure-your-online-store?utm_source=Blog&utm_medium=WidgetLogic&utm_campaign=Webinar&utm_term=EN&utm_content=Simple-Steps

Search URL Search Domain Scan URL

URL: http://sucuri.hs-sites.com/subscribe-to-security?__hstc=166519265.91fd9ef9fa8643797c9ebb81da42f73c.1601149275223.1601149275223.1601149275223.1&__hssc=166519265.1.1601149275223&__hsfp=2017058934

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-antivirus/
Title: Website AntiVirus

Search URL Search Domain Scan URL

URL: https://sucuri.net/wordpress-security/
Title: WordPress Security

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-firewall/ddos-protection
Title: DDos Protection

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-antivirus/malware-scanning-and-detection
Title: Malware Detection

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-antivirus/malware-removal
Title: Malware Removal

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-firewall/stop-website-attacks-and-hacks
Title: Malware Prevention

Search URL Search Domain Scan URL

URL: https://sucuri.net/website-antivirus/blacklist-removal-and-repair
Title: Blacklist Removal

Search URL Search Domain Scan URL

URL: https://kb.sucuri.net/
Title: Knowledge Base

Search URL Search Domain Scan URL

URL: http://labs.sucuri.net/
Title: Research Labs

Search URL Search Domain Scan URL

URL: https://sucuri.net/faq/
Title: FAQ

Search URL Search Domain Scan URL

URL: https://sucuri.net/company/
Title: About

Search URL Search Domain Scan URL

URL: https://sucuri.net/company/media
Title: Media

Search URL Search Domain Scan URL

URL: https://sucuri.net/company/events
Title: Events

Search URL Search Domain Scan URL

URL: https://sucuri.net/company/employment/
Title: Employment

Search URL Search Domain Scan URL

URL: https://sucuri.net/company/contact-us
Title: Contact

Search URL Search Domain Scan URL

URL: https://sucuri.net/customers/
Title: Testimonials

Search URL Search Domain Scan URL

URL: https://sucuri.net/
Title: Sucuri Home

Search URL Search Domain Scan URL

URL: https://sucuri.net/terms
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://sucuri.net/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://sucuri.net/cookies
Title: See our policy>>

Search URL Search Domain Scan URL

URL: https://support.sucuri.net/support/?malware
Title: submit a support request

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 52

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0 HTTP 302
https://www.google.com/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=474557963 HTTP 302
https://www.google.de/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=474557963&ipr=y

Request Chain 64

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1601149274105&url=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-card-stealing-malware-gstaticapi.html HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D179713%26time%3D1601149274105%26url%3Dhttps%253A%252F%252Fblog.sucuri.net%252F2020%252F09%252Fmagento-credit-card-stealing-malware-gstaticapi.html%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1601149274105&url=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-card-stealing-malware-gstaticapi.html&liSync=true

82 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request magento-credit-card-stealing-malware-gstaticapi.html Show response
blog.sucuri.net/2020/09/ 52 KB
13 KB 26ms
7ms Document
text/html 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

1070146f1b2cb4e54ca9e3f69ac79861ae0d56279a131fea20e64175c06ce318

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000 max-age=300 max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block 1; mode=block

Request headers

:method: GET
:authority: blog.sucuri.net
:scheme: https
:path: /2020/09/magento-credit-card-stealing-malware-gstaticapi.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx
date: Sat, 26 Sep 2020 19:41:13 GMT
content-type: text/html; charset=UTF-8
content-length: 12212
x-sucuri-id: 15005
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
x-xss-protection: 1; mode=block 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff nosniff
strict-transport-security: max-age=31536000 max-age=300 max-age=31536000; includeSubDomains
content-security-policy: upgrade-insecure-requests; upgrade-insecure-requests
content-encoding: gzip
x-cacheable: YES:Forced
age: 10893
vary: Accept-Encoding, User-Agent
x-cache: cached
x-cache-hit: HIT
x-backend: all_requests
x-sucuri-cache: HIT
accept-ranges: bytes

GET
H2 200 style.css
blog.sucuri.net/wp-content/themes/sucuriblog0117/ 72 KB
73 KB 9ms
6ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

5cd565b7dfb57b49ef6196a50e3de30828ca53b5935f29c3cf5e9f3b0f8f2969

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 93645
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 27 Jan 2017 03:26:08 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "11ffc-5470b06cf1400-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: text/css
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.min.css
blog.sucuri.net/wp-includes/css/dist/block-library/ 53 KB
8 KB 15ms
12ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-includes/css/dist/block-library/style.min.css?ver=5.5.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 1752
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 7907
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Thu, 27 Aug 2020 18:00:38 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "d293-5addfb6b23d80-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: text/css
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 select2.min.css
blog.sucuri.net/wp-content/plugins/facetwp-select2/select2/ 15 KB
15 KB 15ms
13ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/plugins/facetwp-select2/select2/select2.min.css?ver=4.0.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

ed026fedc8b8130aecd7be55e134a42efcaa8e90a5f2f8ec88aa9a1a5ab934ec

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 93645
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Tue, 12 Jul 2016 17:48:32 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "3af2-53773e0923c00-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: text/css
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mashsb.min.css
blog.sucuri.net/wp-content/plugins/mashsharer/assets/css/ 46 KB
29 KB 16ms
13ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/plugins/mashsharer/assets/css/mashsb.min.css?ver=3.7.2

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

ff4832891f440eef69f6db3572ef7fc3e69f6635bf0d56af126b3930c0a5070e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 17154
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 28613
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Mon, 18 Nov 2019 16:21:30 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "b75f-597a15713d680-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: text/css
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 css
fonts.googleapis.com/ 12 KB
987 B 18ms
16ms Stylesheet
text/css 2a00:1450:4001:818::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8be5c6301da1b9998a2eda72be2f3fa24ae903241e176be45031da127cb7f4ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 26 Sep 2020 19:41:13 GMT
server: ESF
date: Sat, 26 Sep 2020 19:41:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 26 Sep 2020 19:41:13 GMT

GET
H2 200 cookie-banner.css
blog.sucuri.net/wp-content/themes/sucuriblog0117/css/ 10 KB
3 KB 16ms
14ms Stylesheet
text/css 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/css/cookie-banner.css?ver=20200427

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

5b888d5fe8064f7da845fc4b35a98b40600db773f04dd327fab5ffed447d9b82

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 17063
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 2376
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Mon, 27 Apr 2020 17:30:25 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "287c-5a44911fe4e40-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: text/css
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 frontend.min.js Show response
blog.sucuri.net/wp-content/plugins/google-analytics-premium/assets/js/ 9 KB
3 KB 16ms
14ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/plugins/google-analytics-premium/assets/js/frontend.min.js?ver=7.10.0

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

63a6d926d277a3d64d30e349fa0ea2b0630e9801d173e1947ff3bd6060147ef4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 22306
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 2766
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Mon, 18 Nov 2019 16:19:47 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "2452-597a150f02ec0-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: application/javascript
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.js Show response
blog.sucuri.net/wp-includes/js/jquery/ 95 KB
34 KB 16ms
15ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 94105
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 33776
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 17 May 2019 04:25:54 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "17a69-5890dc7401880-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: application/javascript
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 select2.min.js Show response
blog.sucuri.net/wp-content/plugins/facetwp-select2/select2/ 63 KB
19 KB 17ms
15ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/plugins/facetwp-select2/select2/select2.min.js?ver=4.0.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

ff6377c5173c4ee30318481c90cb7cc19987f2f5304871236266df11b0f48696

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 94105
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 18540
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Tue, 12 Jul 2016 17:48:32 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "fd75-53773e0923c00-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: application/javascript
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mashsb.min.js Show response
blog.sucuri.net/wp-content/plugins/mashsharer/assets/js/ 4 KB
2 KB 17ms
16ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/plugins/mashsharer/assets/js/mashsb.min.js?ver=3.7.2

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

a13a1fe4a87c09c6e9122834b5351f80012e2c539b32bc1d33c6982efab21b4b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 1435
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 1533
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Mon, 18 Nov 2019 16:21:30 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "114c-597a15713d680-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: application/javascript
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 1533
date: Sat, 26 Sep 2020 19:15:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Sat, 26 Sep 2020 21:15:40 GMT

GET
H2 200 17-EN-sucuri-blog-newsletter-banner.png
blog.sucuri.net/wp-content/uploads/2017/09/ 3 KB
4 KB 11ms
10ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2017/09/17-EN-sucuri-blog-newsletter-banner.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

52e26c085124647627c42c2cbce9a619b220a28420761233ea649d320f7c5518

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 1120
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 3010
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Thu, 10 Oct 2019 13:11:10 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "bc2-5948e2294d780"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: image/png
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 hoverIntent.min.js Show response
blog.sucuri.net/wp-includes/js/ 1 KB
1 KB 6ms
6ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-includes/js/hoverIntent.min.js?ver=1.8.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

5036d77bc45902a3567f499ebf981076387d71995d6fab43c9be0cd0b962b230

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 94105
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 483
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Sat, 26 Oct 2019 00:17:07 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "46a-595c52fd2e6c0-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: application/javascript
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 superfish.min.js Show response
blog.sucuri.net/wp-content/themes/genesis/lib/js/menu/ 5 KB
2 KB 6ms
6ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/genesis/lib/js/menu/superfish.min.js?ver=1.7.5

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

68f2b0a3381830c544349d5df116c2b96ba1d8efa46cf0c15e3a130d91bf6ab4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 94105
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 1812
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Tue, 27 Nov 2018 17:57:24 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "13ae-57ba92e896900-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: application/javascript
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 superfish.args.min.js Show response
blog.sucuri.net/wp-content/themes/genesis/lib/js/menu/ 132 B
791 B 9ms
6ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/genesis/lib/js/menu/superfish.args.min.js?ver=2.7.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

20550f7bcb2a817ac9a5879e04260da8268e971c0b8031a6b7a2f48a55ee60d5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 94105
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 132
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Tue, 27 Nov 2018 17:57:24 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "84-57ba92e896900-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: application/javascript
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 skip-links.min.js Show response
blog.sucuri.net/wp-content/themes/genesis/lib/js/ 344 B
895 B 9ms
7ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/genesis/lib/js/skip-links.min.js?ver=2.7.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

0556982c2b3cf8fc78bc3d5d3c1e98b7861a0a8150ef7ecf2f3c7a733e4e0cf8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 94104
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 235
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Tue, 27 Nov 2018 17:57:24 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "158-57ba92e896900-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: application/javascript
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 theme.js Show response
blog.sucuri.net/wp-content/themes/sucuriblog0117/js/ 3 KB
1 KB 10ms
7ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/js/theme.js?ver=1.1.0

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

6ae8162fefa27a4c1b69440f19e997af99d94d2e3fef9265e0c44c4caf7cbbda

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 94149
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 859
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Wed, 14 Mar 2018 21:46:59 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "a37-5676650887ac0-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: application/javascript
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 sticky.js Show response
blog.sucuri.net/wp-content/themes/sucuriblog0117/js/ 9 KB
3 KB 10ms
8ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/js/sticky.js?ver=1.0.4

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

cc07dc22acd75d21ea2a03ced344d13aeeea586029288b1d7004739f8ce3c7be

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 94149
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 2507
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 27 Jan 2017 03:26:08 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "2502-5470b06cf1400-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: application/javascript
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 sticky-init.js Show response
blog.sucuri.net/wp-content/themes/sucuriblog0117/js/ 2 KB
1 KB 11ms
9ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/js/sticky-init.js?ver=1.0.1

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

36d47eadbca93ee9613695d80ee179247a0b6bd78b503a549778dbcbe46b0815

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 94149
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 536
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 27 Jan 2017 03:26:08 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "667-5470b06cf1400-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: application/javascript
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cookie-banner.js Show response
blog.sucuri.net/wp-content/themes/sucuriblog0117/js/ 4 KB
2 KB 11ms
9ms Script
application/javascript 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/js/cookie-banner.js?ver=20200914

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

5aafcc6bf2a5538e40efb22b67dee2fb1f1809b846853b69df489d70cac45a36

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 21
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 1277
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Mon, 14 Sep 2020 11:23:40 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "e5b-5af444432af8e-gzip"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: application/javascript
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 A166802-5dda-4f98-aad8-1f58dbc8f1771.js Show response
d.impactradius-event.com/ 40 KB
13 KB 388ms
24ms Script
text/javascript 35.186.249.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d.impactradius-event.com/A166802-5dda-4f98-aad8-1f58dbc8f1771.js
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.249.72 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 72.249.186.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 8235aa051c240d36805f28bb37173c4e2a40cf4b347e1d99d96db420caba3aa0

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:38:59 GMT
content-encoding: gzip
age: 135
x-guploader-uploadid: ABg5-UwGFQGM-aHFravxa_RcuWcqC8TYPK2BOBWxx4QQwoyd2uV3ejUMx6bKyThz8hxhDnmLCQGUGkLpgv6OePbRlh0
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 12966
last-modified: Tue, 18 Feb 2020 03:14:51 GMT
server: UploadServer
etag: "7b386031dce97320ca627c68daf254c5"
vary: Accept-Encoding
x-goog-hash: crc32c=zxauHA==, md5=ezhgMdzpcyDKYnxo2vJUxQ==
x-goog-generation: 1581995691826115
cache-control: public,max-age=900,s-maxage=300
x-goog-stored-content-length: 12966
accept-ranges: bytes
content-type: text/javascript; charset=utf-8
expires: Sat, 26 Sep 2020 19:43:59 GMT

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/gpl/sucuri/prod/ 125 KB
29 KB 81ms
32ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 962c88e8518bf26a936523951920e67cb36acd16e1e2c8dc0cd841d66d5e7836

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
last-modified: Mon, 14 Sep 2020 11:31:01 GMT
server: AkamaiNetStorage
etag: "66fda149ceaf4d4f7926a004abb49885:1600083061.448799"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=300
accept-ranges: bytes
content-length: 29828
expires: Sat, 26 Sep 2020 19:46:13 GMT

GET
H2 200 logo.png
blog.sucuri.net/wp-content/themes/sucuriblog0117/images/ 3 KB
4 KB 8ms
7ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/images/logo.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

28aae72cc297372e89cf023bce6310cd1d7239a1b6612cdffdbb0fb04e10a6ec

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 500924
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 3346
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 27 Jan 2017 03:26:08 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "d12-5470b06cf1400"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: image/png
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 8ms
5ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://blog.sucuri.net
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 18:23:18 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:28 GMT
server: sffe
age: 350275
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9132
x-xss-protection: 0
expires: Wed, 22 Sep 2021 18:23:18 GMT

GET
H2 200 footer-logo.png
blog.sucuri.net/wp-content/themes/sucuriblog0117/images/ 5 KB
5 KB 6ms
6ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/themes/sucuriblog0117/images/footer-logo.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

22bb0c5bd8a734570e15845cab2c13fab934924e44dc353a344ceeda1a830ff1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/wp-content/themes/sucuriblog0117/style.css?ver=1.2.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 500922
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 4881
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 27 Jan 2017 03:26:08 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "1311-5470b06cf1400"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: image/png
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://blog.sucuri.net
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 18:23:48 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:49 GMT
server: sffe
age: 350245
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9180
x-xss-protection: 0
expires: Wed, 22 Sep 2021 18:23:48 GMT

GET
DATA 200
OK truncated
/ 11 KB
11 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 745caffca4b97cf5cf2374d82c6dfb6fb7c7b694e85432f92ec4dcb35f4418c9

Request headers

Origin: https://blog.sucuri.net
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
H2 200 mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://blog.sucuri.net
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 18:25:30 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:27 GMT
server: sffe
age: 350143
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9080
x-xss-protection: 0
expires: Wed, 22 Sep 2021 18:25:30 GMT

GET
H2 200 mem6YaGs126MiZpBA-UFUK0Zdc1GAK6b.woff2
fonts.gstatic.com/s/opensans/v18/ 10 KB
10 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem6YaGs126MiZpBA-UFUK0Zdc1GAK6b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ffcde34efda55a63cb66dbec4bf10acb531014d581e2d8e511836b84e08c2305

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://blog.sucuri.net
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,700,600
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 18:24:18 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:34 GMT
server: sffe
age: 350215
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9728
x-xss-protection: 0
expires: Wed, 22 Sep 2021 18:24:18 GMT

GET
DATA 200
OK truncated
/ 14 KB
14 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6

Request headers

Origin: https://blog.sucuri.net
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H2 200 08062019-magento-skimmers-from-atob-alibaba_blog.png
blog.sucuri.net/wp-content/uploads/2019/08/ 98 KB
98 KB 10ms
6ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2019/08/08062019-magento-skimmers-from-atob-alibaba_blog.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

b0e361433106aeb2b9c3a67e642c6d42a404883b9ed29fa5894f0e000b7813a1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 47543
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 100105
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Thu, 10 Oct 2019 13:18:34 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "18709-5948e3d0bbe80"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: image/png
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 magento_skimmer_exfiltration.png
blog.sucuri.net/wp-content/uploads/2020/09/ 39 KB
39 KB 12ms
8ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2020/09/magento_skimmer_exfiltration.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

df5cda54d69e7d5514fa0b279c9d6e5a3572ccecdaa27d04eef5c9ecb3425ac7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 8810
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 39660
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 25 Sep 2020 14:27:53 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "9aec-5b0241f4b78cb"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: image/png
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 magento_skimmer_if_statement.png
blog.sucuri.net/wp-content/uploads/2020/09/ 10 KB
11 KB 16ms
12ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2020/09/magento_skimmer_if_statement.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

554d100d54f2568605ab859cc66f6611b2bc7669aac1191dbce8b1be3f5c434b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 9859
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 10469
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Fri, 25 Sep 2020 14:30:16 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "28e5-5b02427cbd04b"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: image/png
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 df2487806812cf3a45af64a37a1e0daf
secure.gravatar.com/avatar/ 19 KB
19 KB 56ms
23ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/df2487806812cf3a45af64a37a1e0daf?s=115&d=mm&r=g
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 38b9f4b74b3797dc9319885e24d25a91753d5b11a1dc2253296f78678b49d4c1

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 4
date: Sat, 26 Sep 2020 19:41:13 GMT
last-modified: Wed, 25 Jul 2018 20:51:33 GMT
server: nginx
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="df2487806812cf3a45af64a37a1e0daf.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/df2487806812cf3a45af64a37a1e0daf?s=115&d=mm&r=g>; rel="canonical"
content-length: 19301
expires: Sat, 26 Sep 2020 19:46:13 GMT

GET
H2 200 20-side-bar-widgetlogic-2019-website-threat-report.png
blog.sucuri.net/wp-content/uploads/2020/02/ 154 KB
154 KB 17ms
14ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2020/02/20-side-bar-widgetlogic-2019-website-threat-report.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

54255469b8af99948eb1636aa77fa443ae0666fd4cceb9fc3adcbdcd06eba89a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 33386
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 157379
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Wed, 05 Feb 2020 17:10:47 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "266c3-59dd73ccab3c0"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: image/png
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 blog-sidebar_widgetlogic_webinars_hacked-magento.png
blog.sucuri.net/wp-content/uploads/2019/04/ 17 KB
18 KB 17ms
14ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2019/04/blog-sidebar_widgetlogic_webinars_hacked-magento.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

9172040efe51c9a2e174d2f6e3ce5fedd8730f79735d33de4fb4da1274cebef6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 83948
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 17394
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Thu, 10 Oct 2019 13:17:13 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "43f2-5948e3837c840"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: image/png
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 blog-sidebar_widgetlogic_guides_pci-dss-compliance.png
blog.sucuri.net/wp-content/uploads/2019/05/ 8 KB
9 KB 17ms
15ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2019/05/blog-sidebar_widgetlogic_guides_pci-dss-compliance.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

702966ec0cdc77b9ab5b5024c5aa8011b1ee2219a3935261ae3f30d3d4161e80

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 182272
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 8662
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Thu, 10 Oct 2019 13:17:36 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "21d6-5948e3996bc00"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: image/png
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 blog-sidebar_widgetlogic_guides_magento-security.png
blog.sucuri.net/wp-content/uploads/2019/05/ 7 KB
7 KB 17ms
15ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2019/05/blog-sidebar_widgetlogic_guides_magento-security.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

6f18655609294ac138a2f8b6d5303b55c9f86bfbaf53a0ab12fe00bea0ccafbd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 100340
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 6707
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Thu, 10 Oct 2019 13:17:40 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "1a33-5948e39d3c500"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: image/png
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 blog-sidebar_widgetlogic_webinars_hacked-magento-1.png
blog.sucuri.net/wp-content/uploads/2019/05/ 19 KB
19 KB 18ms
15ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2019/05/blog-sidebar_widgetlogic_webinars_hacked-magento-1.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

30097a6ad85bc38bc929ca5bc8cddcf5ccf19c22e3abb94dd0e349f4c740bc1a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 100334
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 19108
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Thu, 10 Oct 2019 13:18:14 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "4aa4-5948e3bda9180"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: image/png
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 blog-sidebar_widgetlogic_webinars_steps-to-secure-online-store.png
blog.sucuri.net/wp-content/uploads/2019/05/ 35 KB
36 KB 18ms
16ms Image
image/png 2a02:fe80:1010::5
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.sucuri.net/wp-content/uploads/2019/05/blog-sidebar_widgetlogic_webinars_steps-to-secure-online-store.png

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::5 , United Kingdom, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

d7c595b31aa44f6c9127b95f20e207e6b82036ea86a80ac1e8af9f5aef645f76

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;, upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
x-content-type-options: nosniff, nosniff
x-cacheable: YES
x-backend: all_requests
age: 4639
x-cache: cached
status: 200
x-sucuri-cache: HIT
host-header: e172abecbd394f56a1a2479517f27fbfe05ff815
content-length: 35778
x-xss-protection: 1; mode=block, 1; mode=block
last-modified: Thu, 10 Oct 2019 13:17:56 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "8bc2-5948e3ac7e900"
strict-transport-security: max-age=31536000, max-age=300, max-age=31536000; includeSubDomains
content-type: image/png
x-cache-hit: HIT
cache-control: max-age=315360000
x-sucuri-id: 15005
content-security-policy: upgrade-insecure-requests;, upgrade-insecure-requests
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 4 B
69 B 13ms
13ms XHR
text/plain 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=569233320&t=pageview&_s=1&dl=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-card-stealing-malware-gstaticapi.html&ul=en-us&de=UTF-8&dt=Magento%20Credit%20Card%20Stealing%20Malware%3A%20gstaticapi&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IGBACEABBAAAAC~&jid=319348517&gjid=467520850&cid=1541455156.1601149274&tid=UA-4077922-18&_gid=774368928.1601149274&_r=1&_slc=1&z=1496077118

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 26 Sep 2020 19:41:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://blog.sucuri.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 mixpanel-2-latest.min.js Show response
cdn.mxpnl.com/libs/ 79 KB
27 KB 22ms
6ms Script
text/javascript 2600:1901:0:498c::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:498c:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 4232e3c12b3860ed86f62ab38ee1a711ba7393218593d61cefa8100c28afdd6f

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:32:35 GMT
content-encoding: gzip
age: 518
x-guploader-uploadid: ABg5-UxHR5JVJAUtzs7gudZBE1SlbrFlYIWOiS2Lkuq7oF3pmua7udl_kGT4zF8gKhJsEm4ko98b_WGUN9LU2SYCkdh-l8_jQw
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 26928
last-modified: Mon, 17 Aug 2020 21:43:08 GMT
server: UploadServer
etag: "0f7532346a033260e6e905e6396195aa"
vary: Accept-Encoding
x-goog-hash: crc32c=AlJgbg==, md5=D3UyNGoDMmDm6QXmOWGVqg==
x-goog-generation: 1597700588364815
access-control-allow-origin: *
cache-control: public,max-age=600
x-goog-stored-content-length: 26928
accept-ranges: bytes
content-type: text/javascript
expires: Sat, 26 Sep 2020 19:42:35 GMT

GET
H2 200 loader0.js Show response
static.olark.com/jsclient/ Frame 46C9 9 KB
3 KB 68ms
16ms Script
application/javascript 93.184.220.42
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static.olark.com/jsclient/loader0.js
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.42 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BA1) /
Resource Hash: cc1eb1d903e776e996b31757ee8b1bbc6406de1f5fef0a776b6a429dd4ea6839

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
content-encoding: gzip
age: 1850
x-cache: HIT
p3p: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
status: 200
content-length: 3191
last-modified: Wed, 16 Sep 2020 19:52:03 GMT
server: ECS (amb/6BA1)
etag: W/"5f626ce3-2302"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 google
cache-control: max-age=2700
accept-ranges: bytes
expires: Sat, 26 Sep 2020 20:26:14 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
87 B 16ms
15ms XHR
text/plain 2a00:1450:400c:c0c::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-4077922-18&cid=1541455156.1601149274&jid=319348517&gjid=467520850&_gid=774368928.1601149274&_u=IGBACEAABAAAAC~&z=1253730948

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sat, 26 Sep 2020 19:41:14 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://blog.sucuri.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 28ms
27ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-4077922-18

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

17d649130448f0a91601e534cf7a6bcfdb89b707f062094bab0f283ceac25714

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36449
x-xss-protection: 0
last-modified: Sat, 26 Sep 2020 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 26 Sep 2020 19:41:14 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 965 B
761 B 33ms
9ms Script
application/x-javascript 2a02:26f0:10c:582::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:582::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 26 Sep 2020 19:41:14 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=60335
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 448

GET
H2 200 bat.js Show response
bat.bing.com/ 26 KB
8 KB 28ms
27ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:13 GMT
content-encoding: gzip
last-modified: Thu, 16 Jul 2020 20:00:00 GMT
x-msedge-ref: Ref A: CD6B3B6A445C42C48F46CF4FA2ACAE3D Ref B: FRAEDGE1313 Ref C: 2020-09-26T19:41:14Z
status: 200
etag: "0e0bdafab5bd61:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 8022

GET
H2 200 498146.js Show response
js.hs-scripts.com/ 692 B
829 B 76ms
55ms Script
application/javascript 2606:4700::6811:d3cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/498146.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:d3cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 73ebb43f30785b38f3cc876da2e3fa065258efb16bd4ce672daa4b470b7c7a09

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 28
cf-polished: origSize=789
status: 200
cf-request-id: 056d881fa400002c523086a200000001
cf-bgj: minify
server: cloudflare
x-trace: 2BB0E6D0836EC958D5C0CA6ECE267601CB52003DFE000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://sucuri.net
cache-control: public, max-age=60
access-control-allow-credentials: true
cf-ray: 5d8f7612afdf2c52-FRA
expires: Sat, 26 Sep 2020 19:42:14 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 135 KB
34 KB 19ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

097afea517679d2e0b986d77cb3fe7808026882b52ca074a050e03e7a4a6996b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 34302
x-xss-protection: 0
pragma: public
x-fb-debug: OkUYwe41Oe8+3Y/paKAy9KQwvcBrptjSE6pd9GfPqyDJgtfBfx/kj6Sx/fRHQu5hrr6xJCaQDMhVrqGokGCQEQ==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Sat, 26 Sep 2020 19:41:14 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 hotjar-1177970.js Show response
static.hotjar.com/c/ 3 KB
2 KB 17ms
17ms Script
application/javascript 147.75.80.95
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1177970.js?sv=6

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

147.75.80.95 Parsippany, United States, ASN54825 (PACKET, US),

Reverse DNS

pkt-ams-k2-shared-ingress16

Software

Resource Hash

6adc93d57c52b77bcc3708e245a23b8fb397c9628a2e25faa2ab332bb5be0252

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
content-encoding: br
x-content-type-options: nosniff
content-type: application/javascript
section-io-tag: hotjarjs
age: 27
status: 200
section-io-cache: Hit
vary: Accept-Encoding
content-length: 1523
cache-control: max-age=60
etag: W/3b84bf8957e7530d0248764abd13270f
access-control-max-age: 600
section-io-origin-status: 304
access-control-allow-origin: *
x-cache-hit: 1
section-io-origin-time-seconds: 0.020
accept-ranges: bytes
section-io-id: e7be0e736cf8514af03dfeb28b4f1514
section-origin-responded: true

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 78ms
22ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
content-encoding: gzip
age: 79732
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-hhn4031-HHN
last-modified: Mon, 10 Aug 2020 18:10:59 GMT
x-timer: S1601149274.065260,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
202 B 29ms
28ms Script
application/x-javascript 104.111.215.136
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=gpl/sucuri/202009141130&cb=1601149273997
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gpl/sucuri/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.136 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-136.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
last-modified: Thu, 14 Apr 2016 16:57:51 GMT
server: AkamaiNetStorage
etag: "7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type: application/x-javascript
status: 200
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Sat, 26 Sep 2020 19:51:14 GMT

GET
H3-Q050

200

/
www.google.de/pagead/1p-user-list/1040458670/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0
https://www.google.com/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=474557963
https://www.google.de/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=474557963&ipr=y

42 B
538 B

40ms
27ms

Image
image/gif

2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=474557963&ipr=y

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Sep 2020 19:41:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 26 Sep 2020 19:41:14 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/1040458670/?value=1.00&currency_code=USD&label=ZMfLCJ7ZoGgQrseQ8AM&guid=ON&script=0&is_vtc=1&random=474557963&ipr=y
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
api-js.mixpanel.com/decide/ 65 B
327 B 88ms
37ms XHR
application/json 107.178.240.159
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api-js.mixpanel.com/decide/?verbose=1&version=1&lib=web&token=c59343135653bd9019d29f1db79e348b&ip=1&_=1601149274011
Requested by: Host: cdn.mxpnl.com
URL: https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.240.159 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 159.240.178.107.bc.googleusercontent.com
Software: gunicorn/19.9.0 /
Resource Hash: 5fcb16854bcf34558fc9100ea313b2f61a3394ca23e65719553f09c902b2476e

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
via: 1.1 google
server: gunicorn/19.9.0
access-control-allow-headers: X-Requested-With
status: 200
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://blog.sucuri.net
cache-control: no-cache, no-store
access-control-allow-credentials: true
alt-svc: clear

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
106 B 30ms
29ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-4077922-18&cid=1541455156.1601149274&jid=319348517&_u=IGBACEAABAAAAC~&z=559671264

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Sep 2020 19:41:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
106 B 31ms
30ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-4077922-18&cid=1541455156.1601149274&jid=319348517&_u=IGBACEAABAAAAC~&z=559671264

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Sep 2020 19:41:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 modules.94fbf54e63238ed34ad8.js Show response
script.hotjar.com/ 360 KB
70 KB 19ms
18ms Script
application/javascript 147.75.84.91
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.hotjar.com/modules.94fbf54e63238ed34ad8.js
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1177970.js?sv=6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.84.91 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress13
Software: /
Resource Hash: a5e260f8d1d46595c71cf35eb09243ef8ee32453ff9fe49ea9c5ac6d3919f721

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
content-encoding: br
age: 107506
status: 200
section-io-cache: Hit
content-length: 71526
last-modified: Fri, 25 Sep 2020 13:45:49 GMT
etag: "80af45ee8f7a76b874d609a70491a556"
vary: Accept-Encoding
section-io-origin-status: 200
access-control-allow-origin: *
cache-control: max-age=31536000
section-io-origin-time-seconds: 0.026
section-io-id: e5f878a955f9461951111c137e4e64a4
accept-ranges: bytes
content-type: application/javascript
section-origin-responded: true

GET
H2 200 309646199598471 Show response
connect.facebook.net/signals/config/ 524 KB
132 KB 9ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/309646199598471?v=2.9.24&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

010e1a937191be6a5168b8941c548df3aa1bfbf2425b038d67073d8c6aa6e973

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 135015
x-xss-protection: 0
pragma: public
x-fb-debug: 9+3yBnXHQyvBvDDy8YVPrd90lXGjAfCnZnkBe/wpfmNBeAkoW5+1BkJkFdR/YLFnJxQFHA1TDs1u8aSlDvCd7w==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Sat, 26 Sep 2020 19:41:14 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
93 B 105ms
103ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=28110669&Ver=2&mid=ef2f1aec-106f-a8cd-c701-2c44250b7fad&sid=3b71e44245a6efe6f8e9eb02b129d638&vid=db68af84f4fb4bf6aeed3b1ccde47c4c&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Magento%20Credit%20Card%20Stealing%20Malware%3A%20gstaticapi&p=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-card-stealing-malware-gstaticapi.html&r=&lt=238&evt=pageLoad&msclkid=N&sv=1&rn=840670
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Sat, 26 Sep 2020 19:41:13 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: FE7DA0CE0711445E83304F14FCF2DE0C Ref B: FRAEDGE1313 Ref C: 2020-09-26T19:41:14Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK insight.beta.min.js Show response
snap.licdn.com/li.lms-analytics/ 4 KB
2 KB 10ms
9ms Script
application/x-javascript 2a02:26f0:10c:582::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:582::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 26 Sep 2020 19:41:14 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=70325
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1799

GET
H3-Q050 200 js Show response
www.google-analytics.com/gtm/ 94 KB
34 KB 21ms
21ms Script
application/javascript 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-TMKM2TQ&t=gtag_UA_4077922_18&cid=1541455156.1601149274

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

befc775e88a29e4a32e310762dd9d26fdd988ff73f2c649b0a2870870b701608

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34787
x-xss-protection: 0
expires: Sat, 26 Sep 2020 19:41:14 GMT

GET
H2 200 box-469cf41adb11dc78be68c1ae7f9457a4.html
vars.hotjar.com/ Frame 7EE1 0
0 20ms
17ms Document
text/html 147.75.33.229
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1177970.js?sv=6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.33.229 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress12
Software: /
Resource Hash

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-469cf41adb11dc78be68c1ae7f9457a4.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Response headers

status: 200
date: Sat, 26 Sep 2020 19:41:14 GMT
content-type: text/html
content-length: 851
last-modified: Tue, 18 Aug 2020 07:00:06 GMT
etag: "d594f1d4c3e5dbd6b556c60d34e0daea"
cache-control: max-age=31536000
content-encoding: br
section-io-origin-status: 200
section-io-origin-time-seconds: 0.086
section-origin-responded: true
age: 3415111
vary: Accept-Encoding
section-io-cache: Hit
accept-ranges: bytes
section-io-id: 02acc9a3c32a32a6d1559981e96552d5

GET
H2 200 /
www.facebook.com/tr/ 44 B
257 B 9ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=309646199598471&ev=PageView&dl=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-card-stealing-malware-gstaticapi.html&rl=&if=false&ts=1601149274095&sw=1600&sh=1200&v=2.9.24&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1601149274093.2001578291&it=1601149274026&coo=false&rqm=GET

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 26 Sep 2020 19:41:14 GMT

GET
H2 200 app.js Show response
static.olark.com/jsclient/ Frame 1481 54 KB
18 KB 16ms
16ms Script
application/javascript 93.184.220.42
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static.olark.com/jsclient/app.js
Requested by: Host: static.olark.com
URL: https://static.olark.com/jsclient/loader0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.42 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BAE) /
Resource Hash: 98af2497502b64a3d153b30404bc21b8a70aaa94fb0ef3f8b5f95de9f8535a06

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
content-encoding: gzip
age: 10015
x-cache: HIT
status: 200
content-length: 18461
access-control-allow-origin: *
last-modified: Wed, 16 Sep 2020 19:51:51 GMT
server: ECS (amb/6BAE)
etag: W/"5f626cd7-d90b"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 google
cache-control: max-age=10800
accept-ranges: bytes
expires: Sat, 26 Sep 2020 22:41:14 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1601149274105&url=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-card-stealing-malware-gstaticapi.html
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D179713%26time%3D1601149274105%26url%3Dhttps%253A%252F%252Fblog.sucuri.net%252F202...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1601149274105&url=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-card-stealing-malware-gstaticapi.html&liSync=true

0
80 B

602ms
601ms

Image
application/javascript

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1601149274105&url=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-card-stealing-malware-gstaticapi.html&liSync=true
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:15 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 0
x-li-uuid: 30hOMMhsOBZwttGxoisAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-content-type-options: nosniff
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: asicKMhsOBYAS0IpEisAAA==
pragma: no-cache
x-li-pop: afd-prod-esv5
x-msedge-ref: Ref A: 8570D3A049294970A2AA51CF71FC4BB7 Ref B: FRAEDGE0717 Ref C: 2020-09-26T19:41:14Z
x-frame-options: sameorigin
date: Sat, 26 Sep 2020 19:41:13 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=179713&time=1601149274105&url=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-card-stealing-malware-gstaticapi.html&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 498146.js Show response
js.hs-analytics.net/analytics/1601149200000/ 60 KB
18 KB 51ms
33ms Script
text/javascript 2606:4700::6811:44b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1601149200000/498146.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/498146.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:44b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc66ec94f7cb54623c7d927b4e5662f1af0032fe9a5a0a8df9992c7303f18acf

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
content-encoding: br
cf-cache-status: HIT
age: 27
x-amz-server-side-encryption: AES256
status: 200
x-amz-request-id: 4B22627970BD882D
x-amz-id-2: 766urnvFPo1V4g30t5iu2K4TPDvawzs1QD+oOSfrn0ZHCaQWs+2xVgSoi/ONwqmuE/iNRiGs6XM=
last-modified: Mon, 24 Aug 2020 14:07:57 GMT
server: cloudflare
etag: W/"998265b89bab07f36fb1ab10d606d39a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=300, public
access-control-allow-credentials: false
x-amz-version-id: null
cf-request-id: 056d88200f00002c2ec925d200000001
cf-ray: 5d8f761349082c2e-FRA
expires: Sat, 26 Sep 2020 19:45:47 GMT

GET
H2 200 498146.js Show response
js.hs-banner.com/ 47 KB
12 KB 37ms
19ms Script
text/javascript 2606:4700::6812:14bf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/498146.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/498146.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:14bf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59379e94e34f900fc2572b6a3169859eec9baa369338ed21c70172f9f683dd8b

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-goog-hash: crc32c=ET28/A==, md5=RfrgG8locem6366EcMTa0w==
date: Sat, 26 Sep 2020 19:41:14 GMT
content-encoding: br
cf-cache-status: HIT
age: 168
x-guploader-uploadid: ABg5-Uy2eamPflBIucRkCv-XGZzHspt__QwKCku5jKDPH8MflJCFvBi6G637CtoJTpEJG0Q0hZklqhhagbUpV7fQJNZohCSn9Q
x-goog-storage-class: STANDARD
status: 200
access-control-max-age: 604800
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: text/javascript
cf-request-id: 056d882011000097f68d86f200000001
timing-allow-origin: *
last-modified: Wed, 09 Sep 2020 14:39:42 GMT
server: cloudflare
etag: W/"45fae01bc96871e9badfae8470c4dad3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-goog-generation: 1599662382272445
access-control-allow-origin: https://monitor23.sucuri.net
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300, public
access-control-allow-credentials: true
x-goog-stored-content-length: 48039
cf-ray: 5d8f76134b5f97f6-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
expires: Sat, 26 Sep 2020 19:43:26 GMT

GET
H2 200 adsct
t.co/i/ 43 B
448 B 185ms
136ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nuyl9&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-card-stealing-malware-gstaticapi.html

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 114
pragma: no-cache
last-modified: Sat, 26 Sep 2020 19:41:14 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: e785d6a6d60cc6f87f86164c562d8718
x-transaction: 0092a1390076b452
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
119 B 7ms
6ms Image
image/gif 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&a=569233320&t=pageview&_s=1&dl=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-card-stealing-malware-gstaticapi.html&ul=en-us&de=UTF-8&dt=Magento%20Credit%20Card%20Stealing%20Malware%3A%20gstaticapi&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=qGDACUADRAAAAC~&cid=1541455156.1601149274&tid=UA-4077922-18&_gid=774368928.1601149274&gtm=2ou9g1&z=76151995

Requested by

Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Sep 2020 00:29:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 69109
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 5005-531-10-9691.js Show response
static.olark.com/a/assets/v0/site/ Frame 1481 21 KB
22 KB 16ms
16ms Script
application/javascript 93.184.220.42
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static.olark.com/a/assets/v0/site/5005-531-10-9691.js?cb=1601149274165
Requested by: Host: static.olark.com
URL: https://static.olark.com/jsclient/app.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.42 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6B87) /
Resource Hash: f78020b79d800ac42f5ed5a40a2a87ff2ae2cdd3c98c76cbfb1629102f125877

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
via: 1.1 google
last-modified: Sat, 26 Sep 2020 19:29:36 GMT
server: ECS (amb/6B87)
age: 699
status: 200
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 21950

POST
H2 200 3713 Show response
sucuri.7eer.net/xur/ 46 B
470 B 89ms
33ms XHR
application/json 35.186.240.205
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sucuri.7eer.net/xur/3713
Requested by: Host: d.impactradius-event.com
URL: https://d.impactradius-event.com/A166802-5dda-4f98-aad8-1f58dbc8f1771.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.240.205 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 205.240.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 8db1d5bc67af6a9cc211ce8ce7e9d1fb4720c0cb15374c45822a73f3d1fa9aca

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 26 Sep 2020 19:41:14 GMT
via: 1.1 google
status: 200
p3p: policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
access-control-allow-origin: https://blog.sucuri.net
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
alt-svc: clear
expires: Sat, 26 Sep 2020 19:41:14 GMT

GET
H2 200 c Show response
knrpc.olark.com/nrpc/ Frame 1481 1 KB
2 KB 202ms
153ms XHR
text/javascript 34.96.127.16
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://knrpc.olark.com/nrpc/c?c=create&s=5005-531-10-9691&v=jsgkkUz52EiJcEqY179Br0N0A4AEbaLb&i=iuYbn1ejQDZQwfpd179Br0N0tAAbLaEa&g=45391cb1f368baf79eea4d5fb81dba58&q=precache09391788094187359&j=o0&version=loader-precache&xhttp=1&u=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-card-stealing-malware-gstaticapi.html&r=
Requested by: Host: static.olark.com
URL: https://static.olark.com/jsclient/app.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.127.16 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 16.127.96.34.bc.googleusercontent.com
Software: TwistedWeb/20.3.0 /
Resource Hash: e12f9c49438e925858e46d7d99c11c60b7e7f838b371e3bcc2414cff939a0fca

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Sep 2020 19:41:14 GMT
via: 1.1 google
last-modified: Sat, 26 Sep 2020 19:41:14 UTC
server: TwistedWeb/20.3.0
status: 200
x-rpc: nrpc-http-9bd768f98-klckx
access-control-allow-origin: *
cache-control: post-check=0, pre-check=0
content-disposition: inline; filename="rpc.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: clear
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 application2.js Show response
static.olark.com/jsclient-bucket2/ Frame 1481 2 MB
461 KB 16ms
16ms Script
application/javascript 93.184.220.42
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static.olark.com/jsclient-bucket2/application2.js?v=1600285780122
Requested by: Host: static.olark.com
URL: https://static.olark.com/jsclient/app.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.42 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6B7C) /
Resource Hash: d723516c135719fb9ac539f9370900f5f5a018d038eb2e891cf8762eb97e46a7

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
content-encoding: gzip
age: 9928
x-cache: HIT
status: 200
content-length: 471313
access-control-allow-origin: *
last-modified: Wed, 16 Sep 2020 19:51:44 GMT
server: ECS (amb/6B7C)
etag: "5f626cd0-1afb31"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 google
cache-control: max-age=10800
accept-ranges: bytes
expires: Sat, 26 Sep 2020 22:41:14 GMT

GET
H2 200 storage.html
static.olark.com/jsclient-bucket2/ Frame EACF 0
0 17ms
17ms Document
text/html 93.184.220.42
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static.olark.com/jsclient-bucket2/storage.html?v=1600285780122
Requested by: Host: static.olark.com
URL: https://static.olark.com/jsclient-bucket2/application2.js?v=1600285780122
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.42 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BBD) /
Resource Hash

Request headers

:method: GET
:authority: static.olark.com
:scheme: https
:path: /jsclient-bucket2/storage.html?v=1600285780122
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html

Response headers

status: 200
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
age: 9934
cache-control: max-age=10800
content-type: text/html; charset=utf-8
date: Sat, 26 Sep 2020 19:41:14 GMT
etag: "5f626cdb-b4"
expires: Sat, 26 Sep 2020 22:41:14 GMT
last-modified: Wed, 16 Sep 2020 19:51:55 GMT
server: ECS (amb/6BBD)
vary: Accept-Encoding
via: 1.1 google
x-cache: HIT
content-length: 157

GET
H2 200 visits Show response
api.olark.com/2.0/sites/5005-531-10-9691/ Frame 1481 112 B
382 B 185ms
133ms Script
application/json 34.96.127.16
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.olark.com/2.0/sites/5005-531-10-9691/visits?_callback=_olark_callback_342af33b_2616_4669_bb2a_2f8b73194441&_method=POST&_data=%7B%22conversation_id%22%3A%22iuYbn1ejQDZQwfpd179Br0N0tAAbLaEa%22%2C%22cache%22%3A%220.3503378173511529%22%7D
Requested by: Host: static.olark.com
URL: https://static.olark.com/jsclient-bucket2/application2.js?v=1600285780122
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.127.16 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 16.127.96.34.bc.googleusercontent.com
Software: NotARealServer/1.33.7 /
Resource Hash: b7b7fca138e7680fdbf6b2d135fac56eadb275c2fdd8328195e89f4782be03bb

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
via: 1.1 google
server: NotARealServer/1.33.7
access-control-allow-headers: X-Access-Token, X-CSRF-Token, Content-Type, Authorization
status: 200
access-control-max-age: 432000
access-control-allow-methods: GET, POST, PUT, DELETE, PATCH
content-type: application/json
access-control-allow-origin: *
content-disposition: inline; filename="api.txt"
alt-svc: clear

GET
H2 200 jquery.js Show response
static.olark.com/jsclient/ Frame 1481 92 KB
33 KB 17ms
16ms Script
application/javascript 93.184.220.42
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static.olark.com/jsclient/jquery.js
Requested by: Host: static.olark.com
URL: https://static.olark.com/jsclient-bucket2/application2.js?v=1600285780122
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.42 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6B81) /
Resource Hash: d8627e4cab88368fa35cf514910c6b868745b98620e25a2a577d2fe5d743ccef

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
content-encoding: gzip
age: 10009
x-cache: HIT
status: 200
content-length: 33211
access-control-allow-origin: *
last-modified: Wed, 16 Sep 2020 19:52:03 GMT
server: ECS (amb/6B81)
etag: W/"5f626ce3-170a0"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 google
cache-control: max-age=10800
accept-ranges: bytes
expires: Sat, 26 Sep 2020 22:41:14 GMT

GET
H2 206 olark-chimes.ogg
static.olark.com/jsclient/sounds/ Frame 1481 11 KB
11 KB 16ms
16ms Media
audio/ogg 93.184.220.42
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static.olark.com/jsclient/sounds/olark-chimes.ogg
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.42 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BC5) /
Resource Hash: b1fa55944d393c97b9d9c938e639e532e95ccb046440b9adfffca4e1b0a2bcae

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
via: 1.1 google
last-modified: Wed, 16 Sep 2020 19:51:51 GMT
server: ECS (amb/6BC5)
age: 9993
etag: "5f626cd7-2a35"
status: 206
x-cache: HIT
content-type: audio/ogg
access-control-allow-origin: *
cache-control: max-age=10800
Content-Range: bytes 0-10804/10805
accept-ranges: bytes
Content-Length: 10805
expires: Sat, 26 Sep 2020 22:41:14 GMT

POST
H2 200 /
www.facebook.com/tr/ 0
83 B 7ms
7ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykTazpueXg4nWj065

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Sat, 26 Sep 2020 19:41:14 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://blog.sucuri.net
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0

GET
H2 200 theme.css
static.olark.com/jsclient/styles/artsy-albatross/ 127 KB
15 KB 17ms
16ms Stylesheet
text/css 93.184.220.42
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://static.olark.com/jsclient/styles/artsy-albatross/theme.css
Requested by: Host: static.olark.com
URL: https://static.olark.com/jsclient-bucket2/application2.js?v=1600285780122
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.42 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BAC) /
Resource Hash: f005cfa64df81c70c019966e3f17f8aae7cef15d33593ff0f7c958379d1ce7e8

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:14 GMT
content-encoding: gzip
age: 10011
x-cache: HIT
status: 200
content-length: 15205
access-control-allow-origin: *
last-modified: Wed, 16 Sep 2020 19:51:51 GMT
server: ECS (amb/6BAC)
etag: W/"5f626cd7-1fb88"
vary: Accept-Encoding
content-type: text/css
via: 1.1 google
cache-control: max-age=10800
accept-ranges: bytes
expires: Sat, 26 Sep 2020 22:41:14 GMT

GET
H2 200 log.png
log.olark.com/jslog/ 67 B
243 B 180ms
130ms Image
image/png 130.211.38.145
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://log.olark.com/jslog/log.png?version=-bucket2&location=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-car&message=%23chatbox-size-md%20%23using_theme.bouncing_buzzard%20%23using_theme%20&tabname=oktab9797807594929231&conversation_id=iuYbn1ejQDZQwfpd179Br0N0tAAbLaEa&visitor_id=jsgkkUz52EiJcEqY179Br0N0A4AEbaLb&site_id=5005-531-10-9691&bucket=bucket2&level=count&timestamp=1601149274966&properties=%7B%7D&recent_logs=%5B%5D
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.38.145 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 145.38.211.130.bc.googleusercontent.com
Software: nginx /
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:15 GMT
via: 1.1 google
server: nginx
p3p: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
status: 200
x-rpc: nrpc3.gcp.olark.net
content-type: image/png
alt-svc: clear

GET
H2 200 057d0ac1c1b45d6961b649587914834a.png
static.olark.com/imageservice/ 21 KB
21 KB 18ms
18ms Image
image/png 93.184.220.42
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.olark.com/imageservice/057d0ac1c1b45d6961b649587914834a.png
Requested by: Host: blog.sucuri.net
URL: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.42 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6B77) /
Resource Hash: 8948933316fa31e71d1880229f157a6e471ae5445c456b8c9cc40b52029fffa6

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:15 GMT
via: 1.1 google
last-modified: Wed, 15 Mar 2017 23:01:40 GMT
server: ECS (amb/6B77)
age: 1674140
etag: "58c9c7d4-54dc"
x-cache: HIT
content-type: image/png
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 21724
expires: Sun, 26 Sep 2021 19:41:15 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
651 B 186ms
138ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nuyl9&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-card-stealing-malware-gstaticapi.html

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 26 Sep 2020 19:41:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 116
pragma: no-cache
last-modified: Sat, 26 Sep 2020 19:41:15 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 93e73d5fdb25df2caff7534052f148e3
x-transaction: 00cde8c700465927
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
529 B 54ms
39ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2017058934&v=1.1&a=498146&rcu=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-card-stealing-malware-gstaticapi.html&pu=https%3A%2F%2Fblog.sucuri.net%2F2020%2F09%2Fmagento-credit-card-stealing-malware-gstaticapi.html&t=Magento+Credit+Card+Stealing+Malware%3A+gstaticapi&cts=1601149275227&vi=91fd9ef9fa8643797c9ebb81da42f73c&nc=true&u=166519265.91fd9ef9fa8643797c9ebb81da42f73c.1601149275223.1601149275223.1601149275223.1&b=166519265.1.1601149275223

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://blog.sucuri.net/2020/09/magento-credit-card-stealing-malware-gstaticapi.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray: 5d8f761a4b6bd6f5-FRA
date: Sat, 26 Sep 2020 19:41:15 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CUR ADM OUR NOR STA NID"
status: 200
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/gif
content-length: 45
cf-request-id: 056d8824710000d6f5dbbad200000001
x-robots-tag: none

Verdicts & Comments Add Verdict or Comment

65 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

30 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.sucuri.net/	1970-01-19 12:45:51	Name: __hssc Value: 166519265.1.1601149275223
.sucuri.net/	1970-01-19 22:07:25	Name: hubspotutk Value: 91fd9ef9fa8643797c9ebb81da42f73c
.sucuri.net/	1970-01-19 22:07:25	Name: __hstc Value: 166519265.91fd9ef9fa8643797c9ebb81da42f73c.1601149275223.1601149275223.1601149275223.1
.sucuri.net/	1969-12-31 23:59:59	Name: _okbk Value: cd4%3Dtrue%2Cvi5%3D0%2Cvi4%3D1601149274469%2Cvi3%3Dactive%2Cvi2%3Dfalse%2Cvi1%3Dfalse%2Ccd8%3Dchat%2Ccd6%3D0%2Ccd5%3Daway%2Ccd3%3Dfalse%2Ccd2%3D0%2Ccd1%3D0%2C
.sucuri.net/	1970-01-20 06:17:01	Name: hblid Value: jsgkkUz52EiJcEqY179Br0N0A4AEbaLb
.sucuri.net/	1969-12-31 23:59:59	Name: wcsid Value: iuYbn1ejQDZQwfpd179Br0N0tAAbLaEa
.sucuri.net/	1969-12-31 23:59:59	Name: IR_3713 Value: 1601149274176%7C0%7C1601149274173%7C%7C
.sucuri.net/	1970-01-20 06:17:01	Name: olfsk Value: olfsk7162508604418718
.sucuri.net/	1969-12-31 23:59:59	Name: _okdetect Value: %7B%22token%22%3A%2216011492743290%22%2C%22proto%22%3A%22https%3A%22%2C%22host%22%3A%22blog.sucuri.net%22%7D
.sucuri.net/	1970-01-19 12:47:15	Name: _gid Value: GA1.2.774368928.1601149274
.sucuri.net/	1969-12-31 23:59:59	Name: IR_gbd Value: sucuri.net
.sucuri.net/	1970-01-19 12:45:51	Name: _hjAbsoluteSessionInProgress Value: 0
.sucuri.net/	1969-12-31 23:59:59	Name: _oklv Value: 1601149274195%2CiuYbn1ejQDZQwfpd179Br0N0tAAbLaEa
.sucuri.net/	1969-12-31 23:59:59	Name: _okac Value: aed0aa5790c27def178eec4a4fda5798
.sucuri.net/	1970-01-20 06:02:37	Name: IR_PI Value: 3cbf1daa-0030-11eb-9115-42010a24661d%7C1601235674173
.sucuri.net/	1969-12-31 23:59:59	Name: _ok Value: 5005-531-10-9691
.sucuri.net/	1969-12-31 23:59:59	Name: _hjTLDTest Value: 1
.blog.sucuri.net/	1970-01-19 12:47:15	Name: _gid Value: GA1.3.774368928.1601149274
.blog.sucuri.net/	1970-01-20 06:17:01	Name: _ga Value: GA1.3.1541455156.1601149274
.sucuri.net/	1970-01-19 21:31:25	Name: utag_main Value: v_id:0174cbef076c00190d1fe42b3ba300078005407000b08$_sn:1$_ss:1$_st:1601151073965$ses_id:1601149273965%3Bexp-session$_pn:1%3Bexp-session
.sucuri.net/	1969-12-31 23:59:59	Name: _okla Value: 1
.sucuri.net/	1970-01-19 21:31:25	Name: mp_c59343135653bd9019d29f1db79e348b_mixpanel Value: %7B%22distinct_id%22%3A%20%22174cbef07974d7-01e51e56d0cb0b-1b396256-1d4c00-174cbef07987fa%22%2C%22%24device_id%22%3A%20%22174cbef07974d7-01e51e56d0cb0b-1b396256-1d4c00-174cbef07987fa%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
.sucuri.net/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.sucuri.net/	1970-01-19 13:09:13	Name: _uetvid Value: db68af84f4fb4bf6aeed3b1ccde47c4c
.sucuri.net/	1970-01-19 14:55:25	Name: _fbp Value: fb.1.1601149274093.2001578291
.sucuri.net/	1970-01-19 14:55:28	Name: CONSENTMGR Value: c1:1%7Cc2:1%7Cc3:1%7Cc4:1%7Cc5:1%7Cc6:1%7Cc7:1%7Cc8:1%7Cc9:1%7Cc10:1%7Cc11:1%7Cc12:1%7Cc13:1%7Cc14:1%7Cc15:1%7Cts:1601149273963%7Cconsent:true
.sucuri.net/	1970-01-19 12:47:15	Name: _uetsid Value: 3b71e44245a6efe6f8e9eb02b129d638
.sucuri.net/	1970-01-20 06:17:01	Name: _ga Value: GA1.2.1541455156.1601149274
.sucuri.net/	1970-01-19 12:45:49	Name: _gat Value: 1
.sucuri.net/	1970-01-19 21:31:25	Name: _hjid Value: e28358df-2f3d-4ef3-9657-85b04d123c84

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://blog.sucuri.net/wp-content/plugins/mashsharer/assets/js/mashsb.min.js?ver=3.7.2(Line 1) Message: rate limited: 1601132422

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000 max-age=300 max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.twitter.com
api-js.mixpanel.com
api.olark.com
bat.bing.com
blog.sucuri.net
cdn.mxpnl.com
connect.facebook.net
d.impactradius-event.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
knrpc.olark.com
log.olark.com
px.ads.linkedin.com
script.hotjar.com
secure.gravatar.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
static.olark.com
stats.g.doubleclick.net
sucuri.7eer.net
t.co
tags.tiqcdn.com
track.hubspot.com
vars.hotjar.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
104.111.215.136
104.244.42.195
104.244.42.5
107.178.240.159
130.211.38.145
147.75.33.229
147.75.80.95
147.75.84.91
151.101.112.157
2600:1901:0:498c::
2606:4700::6811:44b0
2606:4700::6811:d3cc
2606:4700::6812:14bf
2606:4700::6813:9b53
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:800::2003
2a00:1450:4001:808::2003
2a00:1450:4001:814::2002
2a00:1450:4001:818::2003
2a00:1450:4001:818::200a
2a00:1450:4001:819::2004
2a00:1450:4001:81a::2008
2a00:1450:4001:820::200e
2a00:1450:4001:821::200e
2a00:1450:400c:c0c::9c
2a02:26f0:10c:582::25ea
2a02:fe80:1010::5
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a04:fa87:fffe::c000:4902
2a05:f500:11:101::b93f:9005
34.96.127.16
35.186.240.205
35.186.249.72
93.184.220.42
010e1a937191be6a5168b8941c548df3aa1bfbf2425b038d67073d8c6aa6e973
0556982c2b3cf8fc78bc3d5d3c1e98b7861a0a8150ef7ecf2f3c7a733e4e0cf8
097afea517679d2e0b986d77cb3fe7808026882b52ca074a050e03e7a4a6996b
1070146f1b2cb4e54ca9e3f69ac79861ae0d56279a131fea20e64175c06ce318
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
17d649130448f0a91601e534cf7a6bcfdb89b707f062094bab0f283ceac25714
1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
20550f7bcb2a817ac9a5879e04260da8268e971c0b8031a6b7a2f48a55ee60d5
22bb0c5bd8a734570e15845cab2c13fab934924e44dc353a344ceeda1a830ff1
28aae72cc297372e89cf023bce6310cd1d7239a1b6612cdffdbb0fb04e10a6ec
30097a6ad85bc38bc929ca5bc8cddcf5ccf19c22e3abb94dd0e349f4c740bc1a
36d47eadbca93ee9613695d80ee179247a0b6bd78b503a549778dbcbe46b0815
38b9f4b74b3797dc9319885e24d25a91753d5b11a1dc2253296f78678b49d4c1
4232e3c12b3860ed86f62ab38ee1a711ba7393218593d61cefa8100c28afdd6f
5036d77bc45902a3567f499ebf981076387d71995d6fab43c9be0cd0b962b230
52e26c085124647627c42c2cbce9a619b220a28420761233ea649d320f7c5518
54255469b8af99948eb1636aa77fa443ae0666fd4cceb9fc3adcbdcd06eba89a
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
554d100d54f2568605ab859cc66f6611b2bc7669aac1191dbce8b1be3f5c434b
59379e94e34f900fc2572b6a3169859eec9baa369338ed21c70172f9f683dd8b
5aafcc6bf2a5538e40efb22b67dee2fb1f1809b846853b69df489d70cac45a36
5b888d5fe8064f7da845fc4b35a98b40600db773f04dd327fab5ffed447d9b82
5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b
5cd565b7dfb57b49ef6196a50e3de30828ca53b5935f29c3cf5e9f3b0f8f2969
5fcb16854bcf34558fc9100ea313b2f61a3394ca23e65719553f09c902b2476e
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
63a6d926d277a3d64d30e349fa0ea2b0630e9801d173e1947ff3bd6060147ef4
68f2b0a3381830c544349d5df116c2b96ba1d8efa46cf0c15e3a130d91bf6ab4
6adc93d57c52b77bcc3708e245a23b8fb397c9628a2e25faa2ab332bb5be0252
6ae8162fefa27a4c1b69440f19e997af99d94d2e3fef9265e0c44c4caf7cbbda
6f18655609294ac138a2f8b6d5303b55c9f86bfbaf53a0ab12fe00bea0ccafbd
702966ec0cdc77b9ab5b5024c5aa8011b1ee2219a3935261ae3f30d3d4161e80
73ebb43f30785b38f3cc876da2e3fa065258efb16bd4ce672daa4b470b7c7a09
745caffca4b97cf5cf2374d82c6dfb6fb7c7b694e85432f92ec4dcb35f4418c9
8235aa051c240d36805f28bb37173c4e2a40cf4b347e1d99d96db420caba3aa0
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8948933316fa31e71d1880229f157a6e471ae5445c456b8c9cc40b52029fffa6
8be5c6301da1b9998a2eda72be2f3fa24ae903241e176be45031da127cb7f4ac
8c626f0f9b5c109539b256b73e72c02b300a184f46b4535c2eb86599215c78af
8db1d5bc67af6a9cc211ce8ce7e9d1fb4720c0cb15374c45822a73f3d1fa9aca
9172040efe51c9a2e174d2f6e3ce5fedd8730f79735d33de4fb4da1274cebef6
962c88e8518bf26a936523951920e67cb36acd16e1e2c8dc0cd841d66d5e7836
98af2497502b64a3d153b30404bc21b8a70aaa94fb0ef3f8b5f95de9f8535a06
a13a1fe4a87c09c6e9122834b5351f80012e2c539b32bc1d33c6982efab21b4b
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
a5e260f8d1d46595c71cf35eb09243ef8ee32453ff9fe49ea9c5ac6d3919f721
a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b0e361433106aeb2b9c3a67e642c6d42a404883b9ed29fa5894f0e000b7813a1
b1fa55944d393c97b9d9c938e639e532e95ccb046440b9adfffca4e1b0a2bcae
b7b7fca138e7680fdbf6b2d135fac56eadb275c2fdd8328195e89f4782be03bb
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
befc775e88a29e4a32e310762dd9d26fdd988ff73f2c649b0a2870870b701608
cc07dc22acd75d21ea2a03ced344d13aeeea586029288b1d7004739f8ce3c7be
cc1eb1d903e776e996b31757ee8b1bbc6406de1f5fef0a776b6a429dd4ea6839
d723516c135719fb9ac539f9370900f5f5a018d038eb2e891cf8762eb97e46a7
d7c595b31aa44f6c9127b95f20e207e6b82036ea86a80ac1e8af9f5aef645f76
d8627e4cab88368fa35cf514910c6b868745b98620e25a2a577d2fe5d743ccef
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dc66ec94f7cb54623c7d927b4e5662f1af0032fe9a5a0a8df9992c7303f18acf
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
df5cda54d69e7d5514fa0b279c9d6e5a3572ccecdaa27d04eef5c9ecb3425ac7
e12f9c49438e925858e46d7d99c11c60b7e7f838b371e3bcc2414cff939a0fca
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a
ed026fedc8b8130aecd7be55e134a42efcaa8e90a5f2f8ec88aa9a1a5ab934ec
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f005cfa64df81c70c019966e3f17f8aae7cef15d33593ff0f7c958379d1ce7e8
f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093
f78020b79d800ac42f5ed5a40a2a87ff2ae2cdd3c98c76cbfb1629102f125877
ff4832891f440eef69f6db3572ef7fc3e69f6635bf0d56af126b3930c0a5070e
ff6377c5173c4ee30318481c90cb7cc19987f2f5304871236266df11b0f48696
ffcde34efda55a63cb66dbec4bf10acb531014d581e2d8e511836b84e08c2305

blog.sucuri.net Open in urlscan Pro 2a02:fe80:1010::5 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

82 Requests

100 %HTTPS

64 %IPv6

28 Domains

35 Subdomains

35 IPs

7 Countries

1728 kBTransfer

4634 kBSize

30 Cookies

58 Outgoing links

Redirected requests

82 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

blog.sucuri.net Open in urlscan Pro
2a02:fe80:1010::5 Public Scan

Screenshot
Live screenshot

Full Image

82
Requests

100 %
HTTPS

64 %
IPv6

28
Domains

35
Subdomains

35
IPs

7
Countries

1728 kB
Transfer

4634 kB
Size

30
Cookies

82 HTTP transactions
2 data transactions