blogs.infoblox.com Open in urlscan Pro
2a04:4e42:8e::765 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://blogs.infoblox.com/cyber-threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-s...
Effective URL:
https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-we...
Submission: On May 12 via api (May 12th 2024, 7:20:32 am UTC) from US — Scanned from DE

Summary HTTP 134 Redirects Links 100 Behaviour Indicators

Summary

This website contacted 29 IPs in 5 countries across 23 domains to perform 134 HTTP transactions. The main IP is 2a04:4e42:8e::765, located in United States and belongs to FASTLY, US. The main domain is blogs.infoblox.com.
TLS certificate: Issued by R3 on March 15th 2024. Valid for: 3 months.

This is the only time blogs.infoblox.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 58	2a04:4e42:8e:... 2a04:4e42:8e::765	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
4	2606:4700::68... 2606:4700::6812:bb1f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:806::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2008	15169 (GOOGLE) (GOOGLE)
5	2a02:26f0:710... 2a02:26f0:7100::1720:ef50	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	3.66.255.135 3.66.255.135	16509 (AMAZON-02) (AMAZON-02)
12	84.53.133.138 84.53.133.138	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2606:4700::68... 2606:4700::6813:9308	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:810::2013	15169 (GOOGLE) (GOOGLE)
7	13.225.78.35 13.225.78.35	16509 (AMAZON-02) (AMAZON-02)
4	152.195.15.58 152.195.15.58	15133 (EDGECAST) (EDGECAST)
1	2a02:26f0:780... 2a02:26f0:780::210:a46a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700:440... 2606:4700:4400::ac40:973c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c1d::9a	15169 (GOOGLE) (GOOGLE)
1	172.217.23.99 172.217.23.99	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:710... 2a02:26f0:7100::1720:ef43	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	34.111.208.231 34.111.208.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.35.58.128 13.35.58.128	16509 (AMAZON-02) (AMAZON-02)
1	18.66.122.74 18.66.122.74	16509 (AMAZON-02) (AMAZON-02)
1	54.195.89.156 54.195.89.156	16509 (AMAZON-02) (AMAZON-02)
1	37.252.171.149 37.252.171.149	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a02:26f0:480... 2a02:26f0:480:23::1726:629c	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2602:816:5001... 2602:816:5001::39	54113 (FASTLY) (FASTLY)
1	162.247.241.14 162.247.241.14	23467 (NEWRELIC-...) (NEWRELIC-AS-1)
134	29

58 2a04:4e42:8e::765 (United States) 1 redirects

ASN54113 (FASTLY, US)

blogs.infoblox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.infoblox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6812:bb1f (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:7100::1720:ef50 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.66.255.135 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-66-255-135.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 84.53.133.138 (Madrid, Spain)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a84-53-133-138.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6813:9308 (United States)

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:810::2013 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

visitor.reactful.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tracking.reactful.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 13.225.78.35 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-35.fra2.r.cloudfront.net

consent.trustarc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 152.195.15.58 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.bizibly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:780::210:a46a (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:973c (United States)

ASN13335 (CLOUDFLARENET, US)

trk.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c1d::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.99 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s45-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:7100::1720:ef43 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.208.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.208.111.34.bc.googleusercontent.com

ibc-flow.techtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.58.128 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-58-128.fra60.r.cloudfront.net

pagestates-tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.122.74 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-74.fra60.r.cloudfront.net

assets-tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.195.89.156 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-195-89-156.eu-west-1.compute.amazonaws.com

tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.171.149 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:23::1726:629c (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2602:816:5001::39 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.247.241.14 (Portland, United States)

ASN23467 (NEWRELIC-AS-1, US)

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
58	infoblox.com 1 redirects blogs.infoblox.com www.infoblox.com — Cisco Umbrella Rank: 618588	2 MB
13	6sc.co j.6sc.co — Cisco Umbrella Rank: 5787 c.6sc.co — Cisco Umbrella Rank: 8716 ipv6.6sc.co — Cisco Umbrella Rank: 5928 b.6sc.co — Cisco Umbrella Rank: 3876	22 KB
9	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2400 pagestates-tracking.crazyegg.com — Cisco Umbrella Rank: 7454 assets-tracking.crazyegg.com — Cisco Umbrella Rank: 7566 tracking.crazyegg.com — Cisco Umbrella Rank: 4579	82 KB
7	trustarc.com consent.trustarc.com — Cisco Umbrella Rank: 3223	165 KB
6	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 9185	2 KB
6	typekit.net use.typekit.net — Cisco Umbrella Rank: 448 p.typekit.net — Cisco Umbrella Rank: 565	140 KB
4	reactful.com visitor.reactful.com — Cisco Umbrella Rank: 138492 tracking.reactful.com — Cisco Umbrella Rank: 157604	107 KB
4	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 310	13 KB
3	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 338 px4.ads.linkedin.com — Cisco Umbrella Rank: 6419	1 KB
3	techtarget.com trk.techtarget.com — Cisco Umbrella Rank: 26104 ibc-flow.techtarget.com — Cisco Umbrella Rank: 23444	2 KB
3	bizible.com cdn.bizible.com — Cisco Umbrella Rank: 7752	26 KB
2	google.com region1.analytics.google.com — Cisco Umbrella Rank: 3095	310 B
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	212 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 33 ajax.googleapis.com — Cisco Umbrella Rank: 380	32 KB
1	nr-data.net bam.nr-data.net — Cisco Umbrella Rank: 245	699 B
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 636	17 KB
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 482	701 B
1	bizibly.com cdn.bizibly.com — Cisco Umbrella Rank: 11942	181 B
1	google.de www.google.de — Cisco Umbrella Rank: 7810	63 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 89	256 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 803	17 KB
0	cloudfront.net Failed des8qu5llanad.cloudfront.net Failed
0	lltrck.com Failed lltrck.com Failed
134	23

	Domain	Requested by
52	blogs.infoblox.com	1 redirects blogs.infoblox.com
9	b.6sc.co	blogs.infoblox.com
7	consent.trustarc.com	blogs.infoblox.com consent.trustarc.com
6	script.crazyegg.com	www.googletagmanager.com script.crazyegg.com
6	epsilon.6sense.com	blogs.infoblox.com cdn.bizible.com
6	www.infoblox.com	blogs.infoblox.com
5	use.typekit.net	blogs.infoblox.com
4	cdn.jsdelivr.net	blogs.infoblox.com
3	cdn.bizible.com	www.googletagmanager.com blogs.infoblox.com cdn.bizible.com
3	visitor.reactful.com	blogs.infoblox.com visitor.reactful.com
2	px.ads.linkedin.com	1 redirects cdn.bizible.com
2	ibc-flow.techtarget.com	trk.techtarget.com
2	region1.analytics.google.com	www.googletagmanager.com
2	j.6sc.co	www.googletagmanager.com j.6sc.co
2	www.googletagmanager.com	blogs.infoblox.com www.googletagmanager.com
1	tracking.reactful.com	cdn.bizible.com
1	bam.nr-data.net	cdn.bizible.com
1	js-agent.newrelic.com	blogs.infoblox.com
1	ipv6.6sc.co	cdn.bizible.com
1	c.6sc.co	cdn.bizible.com
1	secure.adnxs.com	cdn.bizible.com
1	tracking.crazyegg.com	cdn.bizible.com
1	cdn.bizibly.com	blogs.infoblox.com
1	assets-tracking.crazyegg.com	script.crazyegg.com
1	pagestates-tracking.crazyegg.com	script.crazyegg.com
1	px4.ads.linkedin.com	blogs.infoblox.com
1	p.typekit.net	blogs.infoblox.com
1	www.google.de	blogs.infoblox.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	trk.techtarget.com	blogs.infoblox.com
1	snap.licdn.com	www.googletagmanager.com
1	ajax.googleapis.com	blogs.infoblox.com
1	fonts.googleapis.com	blogs.infoblox.com
0	des8qu5llanad.cloudfront.net Failed	blogs.infoblox.com
0	lltrck.com Failed	blogs.infoblox.com
134	35

This site contains links to these domains. Also see Links.

Domain
www.infoblox.com
community.infoblox.com
csp.infoblox.com
support.infoblox.com
partners-infoblox.force.com
info.infoblox.com
status.infoblox.com
diversity.infoblox.com

Subject Issuer	Validity	Valid
blogs.infoblox.com R3	`2024-03-15` - `2024-06-13`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA	`2024-05-04` - `2025-05-04`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-01` - `2025-03-03`	a year	crt.sh
www.infoblox.com R3	`2024-05-09` - `2024-08-07`	3 months	crt.sh
*.6sense.com Amazon RSA 2048 M03	`2024-03-31` - `2025-04-29`	a year	crt.sh
6sc.co R3	`2024-04-09` - `2024-07-08`	3 months	crt.sh
script.crazyegg.com E1	`2024-04-05` - `2024-07-04`	3 months	crt.sh
*.reactful.com Go Daddy Secure Certificate Authority - G2	`2023-05-09` - `2024-06-09`	a year	crt.sh
*.trustarc.com Amazon RSA 2048 M02	`2024-03-16` - `2025-04-14`	a year	crt.sh
io.bizible.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-01` - `2024-07-01`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-06-25` - `2024-06-24`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
*.google.de GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
ibc-flow.techtarget.com GTS CA 1D4	`2024-05-06` - `2024-08-04`	3 months	crt.sh
crazyegg.com Amazon RSA 2048 M02	`2024-04-28` - `2025-05-27`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-03-21` - `2025-04-22`	a year	crt.sh
*.nr-data.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-29` - `2024-10-01`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
Frame ID: 1F41553DA182B84E4FFB8D0F78E736BE
Requests: 128 HTTP requests in this frame

Frame: https://consent.trustarc.com/get?name=crossdomain.html&domain=infoblox.com
Frame ID: E41594DF7DA4A945AC471304631AA7A0
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

VexTrio DDGA Domains Observed Spreading Adware, Spyware, and Scam Web Forms | Infoblox

Page URL History Show full URLs

https://blogs.infoblox.com/cyber-threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-... HTTP 301
https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

TrustArc (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

consent\.trustarc\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

134
Requests

94 %
HTTPS

57 %
IPv6

23
Domains

35
Subdomains

29
IPs

5
Countries

2738 kB
Transfer

4570 kB
Size

28
Cookies

100 Outgoing links

These are links going to different origins than the main page.

URL: https://www.infoblox.com/

Search URL Search Domain Scan URL

URL: https://community.infoblox.com/
Title: Community

Search URL Search Domain Scan URL

URL: https://csp.infoblox.com/
Title: BloxOne® Applications

Search URL Search Domain Scan URL

URL: https://support.infoblox.com/app/utils/login_form/redirect/home
Title: Support

Search URL Search Domain Scan URL

URL: https://community.infoblox.com/t5/user/userloginpage?dest_url=https%3A%2F%2Fcommunity.infoblox.com
Title: Infoblox Community

Search URL Search Domain Scan URL

URL: https://partners-infoblox.force.com/IBPartner/s/login/
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/contact-infoblox/
Title: Contact

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/company/why-infoblox/
Title: Why Infoblox

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/accolades/

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/company/why-infoblox/market-leadership/
Title: Market Leadership

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/dns-mttrs/
Title: DNS MTTRs

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/company/customers/
Title: Customers

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/threat-intel/
Title: Infoblox Threat Intel

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/company/why-infoblox/platform-vision/
Title: Platform Vision

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/company/why-infoblox/bloxone-platform/
Title: BloxOne®

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/company/why-infoblox/nios-platform/
Title: NIOS

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/videos/build-for-a-world-that-never-stops/

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/products/
Title: Products

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/products/core-network-services/
Title: Networking Products

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/products/secure-dns-security/
Title: Security Products

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/products/automation/
Title: Automation Products

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/products/bloxone-ddi/
Title: BloxOne® DDI Simplify networking with automated, cloud-managed DNS, DHCP and IPAM

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/products/ddi/
Title: NIOS DDI Unify DNS, DHCP and IPAM for complex, on-premise networking

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/whitepaper/2023-the-total-economic-impact-of-infoblox-ddi

Search URL Search Domain Scan URL

URL: https://info.infoblox.com/contact-sales.html
Title: Book a Demo

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/infoblox-download-center/
Title: Try an Eval

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/company/contact/
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/products/bloxone-threat-defense/
Title: BloxOne® Threat Defense Quickly deploy hybrid DNS-layer security everywhere

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/products/threat-intelligence/
Title: Threat Intelligence Leverage better DNS and multi-sourced threat intel to improve your total security stack

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/products/advanced-dns-protection/
Title: Advanced DNS Protection Protect enterprise DNS infrastructure to ensure maximum uptime

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/products/cybersecurity-ecosystem/
Title: Cybersecurity Ecosystem Automate SecOps response and efficiency with advanced integrations

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/products/cloud-network-automation/
Title: Cloud Network Automation Centrally manage core network services and security

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/products/network-insight/
Title: Unified Network View Enhance security and efficiency with Network Insight

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/products/dns-traffic-control/
Title: Global Load Balancing Optimize application performance

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/products/reporting-analytics/
Title: Reporting and Analytics Easily analyze your network and automate compliance

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/products/ipam-for-microsoft/
Title: IP Address Management for Microsoft Plug the gaps and extend your investment in Microsoft IPAM

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/products/netmri/
Title: Network Automation and Compliance Simplify and streamline multi-vendor network management with NetMRI

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/
Title: Solutions

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/multi-cloud-networking/
Title: Multi-Cloud Networking Transform hybrid, multi-cloud management of critical network services such as DNS and IPAM

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/saas-enabled-enterprise/
Title: SaaS-Enabled Enterprise Secure cloud-managed, cloud-native network services for distributed enterprises

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/on-premises-cloud-managed-networking/
Title: On-Premises + Cloud-Managed Networking Uniting enterprise grade and cloud native core networking services for the hybrid enterprise

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/hybrid-workplace/
Title: Hybrid Workplace Speed your transition to a secure, multi-cloud organization to support your hybrid workforce

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/cybersecurity-frameworks/
Title: Cybersecurity Frameworks Satisfy requirements for leading security best practices

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/secure-edge-services/
Title: Secure Edge Services Deliver new cloud-managed networking and security services anywhere

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/compliance/
Title: IT Compliance Simplify management of regulatory compliance requirements

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/bloxone-ddi-for-office-365/
Title: Accelerate Office 365 performance Ensure fast, reliable user experiences

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/secure-iot/
Title: Secure IoT Protect devices across IoT environments

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/ipv6-readiness/
Title: Deploy IPv6 Set your network foundation up for success

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/sd-wan/
Title: Optimize SD-WAN Use cloud-managed DNS, DHCP and IPAM for better ROI

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/encrypted-dns/
Title: Support Encrypted DNS Offer DoT/DoH services while maintaining security and performance

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/core-network-integrations
Title: Networking Easily integrate, orchestrate and automate with top networking providers and tools

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/healthcare/
Title: Healthcare Simplify, control and secure vital healthcare services

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/higher-education/
Title: Higher Education Improve network performance while reducing costs

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/public-sector/
Title: Public Sector Scale and secure distributed networking for all

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/sled/
Title: SLED

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/public-health/
Title: Public Health & Human Services

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/government/state-and-local/
Title: State & Local

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/government/federal/
Title: Federal

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/service-providers/
Title: Service Providers Deliver modern core network services and security

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/service-providers/mobile-service-providers/
Title: Mobile Providers

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/service-providers/cable-broadband/
Title: Cable and Broadband

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/service-providers/managed-service-providers/
Title: Managed Service Providers

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/subscriber-services/
Title: Subscriber Services

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/netops/
Title: NetOps Unify DNS, DHCP and IPAM and simplify complex networking

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/devops/
Title: DevOps Use automation and advanced integrations to streamline operations

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/security-operations/
Title: SecOps Leverage automation and multi-source intelligence to stop threats faster

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/solutions/cio/
Title: CIO/CISO Optimize your workforce productivity with a SaaS-enabled enterprise

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/support/
Title: Support & Services

Search URL Search Domain Scan URL

URL: https://support.infoblox.com/

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/support/technical-account-manager-service/
Title: Technical Account Manager

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/covid-19-support-and-services-continuity-plan/
Title: COVID-19 Support Update

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/company/customers/customer-success/
Title: Customer Success Management

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/support/professional-services-overview/
Title: Professional Services

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/infoblox-education/
Title: Education Services

Search URL Search Domain Scan URL

URL: https://status.infoblox.com/
Title: Cloud Services Status

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/developer-portal/
Title: Developer Portal

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/
Title: Resources

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/?resource_types=analyst-report
Title: Analyst Reports

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/?resource_types=brochure
Title: Brochures

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/?resource_types=case-study
Title: Customer Case Studies

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/?resource_types=datasheet
Title: Datasheets

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/?resource_types=deployment-guide
Title: Deployment Guides

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/?resource_types=ebook
Title: eBooks

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/?resource_types=evaluation
Title: Evaluations

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/company/events/
Title: Live Events & Webinars

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/?resource_types=infographic
Title: Infographics

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/?resource_types=podcast
Title: Podcasts

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/?resource_types=report
Title: Reports

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/?resource_types=solution-note
Title: Solution Notes

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/?resource_types=videos
Title: Videos

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/?resource_types=webinar
Title: On-demand Webinars

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/?resource_types=whitepaper
Title: Whitepapers

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/resources/whitepaper/independent-research-20-20-visibility-clarifies-network-security

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/company/
Title: Company

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/company/leadership/
Title: Leadership

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/company/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://diversity.infoblox.com/
Title: Diversity & Inclusion

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/company/environmental-social-and-governance-policy/
Title: Environmental, Social, and Governance Policy

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/partners/
Title: About Infoblox Partners

Search URL Search Domain Scan URL

URL: https://www.infoblox.com/partners/technology-partners
Title: Technology Alliance Partners

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://blogs.infoblox.com/cyber-threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/ HTTP 301
https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 92

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=32346&time=1715498425727&url=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=32346&time=1715498425727&url=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&e_ipv6=AQI1JaNuqRfv-QAAAY9rrJ62L52Kc_p-cfYxmm2JIzPFTvu3Rx8FZIX3vLB5tz6-u_b8_-XR

134 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
Redirect Chain

https://blogs.infoblox.com/cyber-threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

284 KB
65 KB

158ms
157ms

Document
text/html

2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

70d17ea151f46d31f85bdddba1200b66e5fe6ea21c461544153c0f643e2fca5b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' filesystem: .jsdelivr.net .infoblox.com .pantheonsite.io .infoblox.local .vimeo.com .addthis.com .typekit.net .driftt.com .drift.com .google-analytics.com .eloqua.com .nr-data.net .doubleclick.net .linkedin.com .vidyard.com .google.com .captivate.fm .soundcloud.com .youtube.com .6sense.com .jsdelivr.net .infoblox.com .crazyegg.com .youtube.com .reactful.com .6sc.co .lookbookhq.com .facebook.net .techtarget.com .marketo.net .pathfactory.com .mktoresp.com .google.co.in .adnxs.com https://sites.google.com/infoblox.com https://sites.google.com/infoblox.com/salesworkspace/ https://infoblox.litmos.com/ .use.fontawesome .info.infoblox.com https://internetidentity.com .kaltura.com .hotjar.com cdn.bizible.com cdn.linkedin.oribi.io; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: filesystem: .google.com .addthis.com .addthisedge.com .moatads.com .cookielaw.org .driftt.com .bidr.io .cloudfront.net .bing.com .linkedin.com .licdn.com .typekit.net .googletagmanager.com js.driftt.com .googleadservices.com .doubleclick.net .google-analytics.com .newrelic.com .nr-data.net .vidyard.com .captivate.fm .soundcloud.com https://cdnjs.cloudflare.com .jobvite.com .jsdelivr.net .infoblox.com .lltrck.com lltrck.com https://lltrck.com https://ajax.googleapis.com .jsdelivr.net .infoblox.com .crazyegg.com .youtube.com .reactful.com .6sc.co .lookbookhq.com .facebook.net .techtarget.com .marketo.net .adnxs.com .google.co.in https://infoblox.litmos.com/ .use.fontawesome.com .info.infoblox.com https://internetidentity.com https://widgets.itcentralstation.com .kaltura.com .hotjar.com .trustarc.com cdn.bizible.com cdn.linkedin.oribi.io; style-src 'self' 'unsafe-inline' 'unsafe-eval' filesystem: .google.com .googleapis.com .typekit.net .gstatic.com .googleusercontent.com https://info.infoblox.com/js/forms2/css/ .jsdelivr.net .infoblox.com .jsdelivr.net .infoblox.com .crazyegg.com .youtube.com .reactful.com .6sc.co .lookbookhq.com .facebook.net .techtarget.com .marketo.net .bootstrapcdn.com .google.co.in https://infoblox.litmos.com/ .use.fontawesome.com .info.infoblox.com https://internetidentity.com .kaltura.com .trustarc.com; img-src 'self' https: data: blob: .jsdelivr.net .infoblox.com https://infoblox.com .bing.com .adsymptotic.com .googleusercontent.com .gstatic.com .pantheonsite.io .infoblox.local .linkedin.com .drift.com .eloqua.com .typekit.net .google-analytics.com .google.com .doubleclick.net .gravatar.com https://play.vidyard.com https://cdn.vidyard.com https://i.ytimg.com .vimeocdn.com https://share.vidyard.com/ .googletagmanager.com https://lltrck.com .jsdelivr.net .infoblox.com .crazyegg.com .youtube.com .reactful.com .6sc.co .lookbookhq.com .facebook.net .techtarget.com .marketo.net .facebook.com .google.co.in .snaproute.com snaproute.com https://infoblox.litmos.com/ .use.fontawesome.com .info.infoblox.com https://internetidentity.com .kaltura.com .hotjar.com .trustarc.com cdn.bizible.com cdn.linkedin.oribi.io ; font-src 'self' https: data: filesystem: use.typekit.net .use.fontawesome.com; media-src 'self' mediastream: blob: filesystem: .driftqa.com .kaltura.com .js.driftt.com https://js.driftt.com/conductor/assets/media/notification.d46d7db1.mp3; frame-ancestors 'self' https: data: http://.jsdelivr.net .infoblox.com https://.jsdelivr.net .infoblox.com https://sites.google.com/infoblox.com https://sites.google.com/infoblox.com/salesworkspace/ https://infoblox.litmos.com/ http://infoblox.litmos.com/ https://infoblox.mindtickle.com/ https://infobloxpartners.mindtickle.com/ https://infoblox.litmos.com/ .use.fontawesome.com .info.infoblox.com https://internetidentity.com https://widgets.itcentralstation.com .kaltura.com .hotjar.com .trustarc.com cdn.bizible.com cdn.linkedin.oribi.io; frame-src 'self' https://www.youtube-nocookie.com https://play.vidyard.com https://www.google.com .youtube.com .vimeo.com https://w.soundcloud.com/ https://player.captivate.fm/ jobs.jobvite.com info.infoblox.com .jsdelivr.net .infoblox.com .crazyegg.com .youtube.com .reactful.com .6sc.co .lookbookhq.com .facebook.net .techtarget.com .marketo.net .facebook.com https://infoblox.litmos.com/ .use.fontawesome.com .info.infoblox.com https://internetidentity.com https://widgets.itcentralstation.com .kaltura.com .hotjar.com .trustarc.com https://js.driftt.com/ https://js.driftt.com/conductor/assets/media/notification.d46d7db1.mp3 *.js.driftt.com cdn.bizible.com cdn.linkedin.oribi.io
Strict-Transport-Security	max-age=31622400
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
age: 188
cache-control: public, max-age=600
content-encoding: gzip
content-length: 62036
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' filesystem: *.jsdelivr.net *.infoblox.com *.pantheonsite.io *.infoblox.local *.vimeo.com *.addthis.com *.typekit.net *.driftt.com *.drift.com *.google-analytics.com *.eloqua.com *.nr-data.net *.doubleclick.net *.linkedin.com *.vidyard.com *.google.com *.captivate.fm *.soundcloud.com *.youtube.com *.6sense.com *.jsdelivr.net *.infoblox.com *.crazyegg.com *.youtube.com *.reactful.com *.6sc.co *.lookbookhq.com *.facebook.net *.techtarget.com *.marketo.net *.pathfactory.com *.mktoresp.com *.google.co.in *.adnxs.com https://sites.google.com/infoblox.com https://sites.google.com/infoblox.com/salesworkspace/ https://infoblox.litmos.com/ *.use.fontawesome *.info.infoblox.com https://internetidentity.com *.kaltura.com *.hotjar.com cdn.bizible.com cdn.linkedin.oribi.io; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: filesystem: *.google.com *.addthis.com *.addthisedge.com *.moatads.com *.cookielaw.org *.driftt.com *.bidr.io *.cloudfront.net *.bing.com *.linkedin.com *.licdn.com *.typekit.net *.googletagmanager.com js.driftt.com *.googleadservices.com *.doubleclick.net *.google-analytics.com *.newrelic.com *.nr-data.net *.vidyard.com *.captivate.fm *.soundcloud.com https://cdnjs.cloudflare.com *.jobvite.com *.jsdelivr.net *.infoblox.com *.lltrck.com lltrck.com https://lltrck.com https://ajax.googleapis.com *.jsdelivr.net *.infoblox.com *.crazyegg.com *.youtube.com *.reactful.com *.6sc.co *.lookbookhq.com *.facebook.net *.techtarget.com *.marketo.net *.adnxs.com *.google.co.in https://infoblox.litmos.com/ *.use.fontawesome.com *.info.infoblox.com https://internetidentity.com https://widgets.itcentralstation.com *.kaltura.com *.hotjar.com *.trustarc.com cdn.bizible.com cdn.linkedin.oribi.io; style-src 'self' 'unsafe-inline' 'unsafe-eval' filesystem: *.google.com *.googleapis.com *.typekit.net *.gstatic.com *.googleusercontent.com https://info.infoblox.com/js/forms2/css/ *.jsdelivr.net *.infoblox.com *.jsdelivr.net *.infoblox.com *.crazyegg.com *.youtube.com *.reactful.com *.6sc.co *.lookbookhq.com *.facebook.net *.techtarget.com *.marketo.net *.bootstrapcdn.com *.google.co.in https://infoblox.litmos.com/ *.use.fontawesome.com *.info.infoblox.com https://internetidentity.com *.kaltura.com *.trustarc.com; img-src 'self' https: data: blob: *.jsdelivr.net *.infoblox.com https://infoblox.com *.bing.com *.adsymptotic.com *.googleusercontent.com *.gstatic.com *.pantheonsite.io *.infoblox.local *.linkedin.com *.drift.com *.eloqua.com *.typekit.net *.google-analytics.com *.google.com *.doubleclick.net *.gravatar.com https://play.vidyard.com https://cdn.vidyard.com https://i.ytimg.com *.vimeocdn.com https://share.vidyard.com/ *.googletagmanager.com https://lltrck.com *.jsdelivr.net *.infoblox.com *.crazyegg.com *.youtube.com *.reactful.com *.6sc.co *.lookbookhq.com *.facebook.net *.techtarget.com *.marketo.net *.facebook.com *.google.co.in *.snaproute.com snaproute.com https://infoblox.litmos.com/ *.use.fontawesome.com *.info.infoblox.com https://internetidentity.com *.kaltura.com *.hotjar.com *.trustarc.com cdn.bizible.com cdn.linkedin.oribi.io ; font-src 'self' https: data: filesystem: use.typekit.net *.use.fontawesome.com; media-src 'self' mediastream: blob: filesystem: *.driftqa.com *.kaltura.com *.js.driftt.com https://js.driftt.com/conductor/assets/media/notification.d46d7db1.mp3; frame-ancestors 'self' https: data: http://*.jsdelivr.net *.infoblox.com https://*.jsdelivr.net *.infoblox.com https://sites.google.com/infoblox.com https://sites.google.com/infoblox.com/salesworkspace/ https://infoblox.litmos.com/ http://infoblox.litmos.com/ https://infoblox.mindtickle.com/ https://infobloxpartners.mindtickle.com/ https://infoblox.litmos.com/ *.use.fontawesome.com *.info.infoblox.com https://internetidentity.com https://widgets.itcentralstation.com *.kaltura.com *.hotjar.com *.trustarc.com cdn.bizible.com cdn.linkedin.oribi.io; frame-src 'self' https://www.youtube-nocookie.com https://play.vidyard.com https://www.google.com *.youtube.com *.vimeo.com https://w.soundcloud.com/ https://player.captivate.fm/ jobs.jobvite.com info.infoblox.com *.jsdelivr.net *.infoblox.com *.crazyegg.com *.youtube.com *.reactful.com *.6sc.co *.lookbookhq.com *.facebook.net *.techtarget.com *.marketo.net *.facebook.com https://infoblox.litmos.com/ *.use.fontawesome.com *.info.infoblox.com https://internetidentity.com https://widgets.itcentralstation.com *.kaltura.com *.hotjar.com *.trustarc.com https://js.driftt.com/ https://js.driftt.com/conductor/assets/media/notification.d46d7db1.mp3 *.js.driftt.com cdn.bizible.com cdn.linkedin.oribi.io
content-type: text/html; charset=UTF-8
date: Sun, 12 May 2024 07:20:24 GMT
link: <https://blogs.infoblox.com/wp-json/>; rel="https://api.w.org/" <https://blogs.infoblox.com/wp-json/wp/v2/posts/7801>; rel="alternate"; type="application/json" <https://blogs.infoblox.com/?p=7801>; rel=shortlink
permissions-policy: geolocation=(), microphone=()
referrer-policy: no-referrer
server: nginx
strict-transport-security: max-age=31622400
vary: Accept-Encoding, Cookie, Cookie
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache: HIT, MISS, MISS
x-cache-hits: 1, 0, 0
x-content-type-options: nosniff
x-frame-options: sameorigin
x-pantheon-styx-hostname: styx-fe1-a-548957645b-hrjk6
x-served-by: cache-chi-klot8100061-CHI, cache-fra-etou8220042-FRA, cache-fra-etou8220083-FRA
x-styx-req-id: a8cbe84d-102f-11ef-ae6e-6299bb9686bb
x-timer: S1715498424.107516,VS0,VE109
x-xss-protection

Redirect headers

accept-ranges: bytes
age: 189
cache-control: max-age=3600
content-length: 0
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' filesystem: *.jsdelivr.net *.infoblox.com *.pantheonsite.io *.infoblox.local *.vimeo.com *.addthis.com *.typekit.net *.driftt.com *.drift.com *.google-analytics.com *.eloqua.com *.nr-data.net *.doubleclick.net *.linkedin.com *.vidyard.com *.google.com *.captivate.fm *.soundcloud.com *.youtube.com *.6sense.com *.jsdelivr.net *.infoblox.com *.crazyegg.com *.youtube.com *.reactful.com *.6sc.co *.lookbookhq.com *.facebook.net *.techtarget.com *.marketo.net *.pathfactory.com *.mktoresp.com *.google.co.in *.adnxs.com https://sites.google.com/infoblox.com https://sites.google.com/infoblox.com/salesworkspace/ https://infoblox.litmos.com/ *.use.fontawesome *.info.infoblox.com https://internetidentity.com *.kaltura.com *.hotjar.com cdn.bizible.com cdn.linkedin.oribi.io; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: filesystem: *.google.com *.addthis.com *.addthisedge.com *.moatads.com *.cookielaw.org *.driftt.com *.bidr.io *.cloudfront.net *.bing.com *.linkedin.com *.licdn.com *.typekit.net *.googletagmanager.com js.driftt.com *.googleadservices.com *.doubleclick.net *.google-analytics.com *.newrelic.com *.nr-data.net *.vidyard.com *.captivate.fm *.soundcloud.com https://cdnjs.cloudflare.com *.jobvite.com *.jsdelivr.net *.infoblox.com *.lltrck.com lltrck.com https://lltrck.com https://ajax.googleapis.com *.jsdelivr.net *.infoblox.com *.crazyegg.com *.youtube.com *.reactful.com *.6sc.co *.lookbookhq.com *.facebook.net *.techtarget.com *.marketo.net *.adnxs.com *.google.co.in https://infoblox.litmos.com/ *.use.fontawesome.com *.info.infoblox.com https://internetidentity.com https://widgets.itcentralstation.com *.kaltura.com *.hotjar.com *.trustarc.com cdn.bizible.com cdn.linkedin.oribi.io; style-src 'self' 'unsafe-inline' 'unsafe-eval' filesystem: *.google.com *.googleapis.com *.typekit.net *.gstatic.com *.googleusercontent.com https://info.infoblox.com/js/forms2/css/ *.jsdelivr.net *.infoblox.com *.jsdelivr.net *.infoblox.com *.crazyegg.com *.youtube.com *.reactful.com *.6sc.co *.lookbookhq.com *.facebook.net *.techtarget.com *.marketo.net *.bootstrapcdn.com *.google.co.in https://infoblox.litmos.com/ *.use.fontawesome.com *.info.infoblox.com https://internetidentity.com *.kaltura.com *.trustarc.com; img-src 'self' https: data: blob: *.jsdelivr.net *.infoblox.com https://infoblox.com *.bing.com *.adsymptotic.com *.googleusercontent.com *.gstatic.com *.pantheonsite.io *.infoblox.local *.linkedin.com *.drift.com *.eloqua.com *.typekit.net *.google-analytics.com *.google.com *.doubleclick.net *.gravatar.com https://play.vidyard.com https://cdn.vidyard.com https://i.ytimg.com *.vimeocdn.com https://share.vidyard.com/ *.googletagmanager.com https://lltrck.com *.jsdelivr.net *.infoblox.com *.crazyegg.com *.youtube.com *.reactful.com *.6sc.co *.lookbookhq.com *.facebook.net *.techtarget.com *.marketo.net *.facebook.com *.google.co.in *.snaproute.com snaproute.com https://infoblox.litmos.com/ *.use.fontawesome.com *.info.infoblox.com https://internetidentity.com *.kaltura.com *.hotjar.com *.trustarc.com cdn.bizible.com cdn.linkedin.oribi.io ; font-src 'self' https: data: filesystem: use.typekit.net *.use.fontawesome.com; media-src 'self' mediastream: blob: filesystem: *.driftqa.com *.kaltura.com *.js.driftt.com https://js.driftt.com/conductor/assets/media/notification.d46d7db1.mp3; frame-ancestors 'self' https: data: http://*.jsdelivr.net *.infoblox.com https://*.jsdelivr.net *.infoblox.com https://sites.google.com/infoblox.com https://sites.google.com/infoblox.com/salesworkspace/ https://infoblox.litmos.com/ http://infoblox.litmos.com/ https://infoblox.mindtickle.com/ https://infobloxpartners.mindtickle.com/ https://infoblox.litmos.com/ *.use.fontawesome.com *.info.infoblox.com https://internetidentity.com https://widgets.itcentralstation.com *.kaltura.com *.hotjar.com *.trustarc.com cdn.bizible.com cdn.linkedin.oribi.io; frame-src 'self' https://www.youtube-nocookie.com https://play.vidyard.com https://www.google.com *.youtube.com *.vimeo.com https://w.soundcloud.com/ https://player.captivate.fm/ jobs.jobvite.com info.infoblox.com *.jsdelivr.net *.infoblox.com *.crazyegg.com *.youtube.com *.reactful.com *.6sc.co *.lookbookhq.com *.facebook.net *.techtarget.com *.marketo.net *.facebook.com https://infoblox.litmos.com/ *.use.fontawesome.com *.info.infoblox.com https://internetidentity.com https://widgets.itcentralstation.com *.kaltura.com *.hotjar.com *.trustarc.com https://js.driftt.com/ https://js.driftt.com/conductor/assets/media/notification.d46d7db1.mp3 *.js.driftt.com cdn.bizible.com cdn.linkedin.oribi.io
content-type: text/html; charset=UTF-8
date: Sun, 12 May 2024 07:20:24 GMT
expires: Sun, 12 May 2024 08:17:14 GMT
location: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
permissions-policy: geolocation=(), microphone=()
referrer-policy: no-referrer
server: nginx
strict-transport-security: max-age=31622400
vary: Cookie, Cookie
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache: HIT, MISS, MISS
x-cache-hits: 1, 0, 0
x-content-type-options: nosniff
x-frame-options: sameorigin
x-pantheon-styx-hostname: styx-fe1-b-668bdc8fc7-5gvzj
x-redirect-by: WordPress
x-served-by: cache-chi-kigq8000156-CHI, cache-fra-eddf8230050-FRA, cache-fra-etou8220083-FRA
x-styx-req-id: a8299e78-102f-11ef-952a-8269ef160f14
x-timer: S1715498424.886422,VS0,VE114
x-xss-protection

GET
H2 200 style.css
blogs.infoblox.com/wp-content/themes/infoblox-blog/ 30 KB
9 KB 50ms
50ms Stylesheet
text/css 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/infoblox-blog/style.css?ver=2.10.0

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

526d676a40f3d7b45aa46213e63602a7ea7e2906505a99df3bd593c94e94e1cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 837, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231236
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-2snzw
content-length: 8497
x-served-by: cache-chi-kigq8000050-CHI, cache-fra-etou8220052-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:58 GMT
server: nginx
x-timer: S1715498424.286443,VS0,VE4
etag: W/"663ce656-7723"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: b55c79fb-0e15-11ef-bb1b-e6711c542c27
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
BLOB 200
OK 5bee66e6-7e0d-422a-ad57-ba513c3bfef1
https://blogs.infoblox.com/ 1 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://blogs.infoblox.com/5bee66e6-7e0d-422a-ad57-ba513c3bfef1
Requested by: Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b9f9afe7621ec465573f58064f5bef3a229e5e19362351168fd211f6a28bb5c

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Length: 1185
Content-Type: text/javascript

GET
H2 200 style.min.css
blogs.infoblox.com/wp-includes/css/dist/block-library/ 111 KB
19 KB 56ms
56ms Stylesheet
text/css 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-includes/css/dist/block-library/style.min.css

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

98cecf88a23542fa047ce46eedb650b5c5128761ed4386c0977b847094ddfa20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 846, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231236
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-5wssg
content-length: 19341
x-served-by: cache-chi-klot8100171-CHI, cache-fra-etou8220125-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:57 GMT
server: nginx
x-timer: S1715498424.297136,VS0,VE5
etag: W/"663ce655-1bae5"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: b56c9c60-0e15-11ef-a9ed-f2f52e1bfc3f
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 public.css
blogs.infoblox.com/wp-content/plugins/custom-related-posts/dist/ 766 B
521 B 57ms
52ms Stylesheet
text/css 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/plugins/custom-related-posts/dist/public.css?ver=1.7.2

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

774e962975f775218ab0d77b8881b02ccb9b80889bb7a126d85d9e44218c848a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 829, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231236
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-z9j9j
content-length: 224
x-served-by: cache-chi-kigq8000152-CHI, cache-fra-etou8220064-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:56 GMT
server: nginx
x-timer: S1715498424.299796,VS0,VE3
etag: W/"663ce654-2fe"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: b56bd772-0e15-11ef-8fa0-3a3f3276620e
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 csbwfs.css
blogs.infoblox.com/wp-content/plugins/custom-share-buttons-with-floating-sidebar/css/ 6 KB
2 KB 57ms
53ms Stylesheet
text/css 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/plugins/custom-share-buttons-with-floating-sidebar/css/csbwfs.css

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

34988554893009eb1f64d49b96d6dd472699ad46e71557eab757bcfcecee4342

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 661, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231237
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-2w9x6
content-length: 1727
x-served-by: cache-chi-kigq8000136-CHI, cache-fra-etou8220159-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:55 GMT
server: nginx
x-timer: S1715498424.299885,VS0,VE4
etag: W/"663ce653-19c3"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: b56c8793-0e15-11ef-aa80-eaad830a048d
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 jquery.ui.css
blogs.infoblox.com/wp-content/plugins/miniorange-saml-20-single-sign-on/includes/css/ 22 KB
5 KB 58ms
54ms Stylesheet
text/css 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/plugins/miniorange-saml-20-single-sign-on/includes/css/jquery.ui.css

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

d198aa686d1152dea61220e984befd325376330286ffbeb9bba9d43347c2f065

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 839, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231237
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-z9j9j
content-length: 4865
x-served-by: cache-chi-kigq8000088-CHI, cache-fra-etou8220132-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:55 GMT
server: nginx
x-timer: S1715498424.299973,VS0,VE4
etag: W/"663ce653-5940"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: b56c5a5d-0e15-11ef-8fa0-3a3f3276620e
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 front_style.css
blogs.infoblox.com/wp-content/plugins/profile-extra-fields/css/ 269 B
369 B 98ms
94ms Stylesheet
text/css 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/plugins/profile-extra-fields/css/front_style.css?ver=1.2.4

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

532af117d969ca8bd0ff019ce150f9c109d44c362f9eabe7ef8ff9d82c227bd3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 825, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231237
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-stjgw
content-length: 147
x-served-by: cache-chi-klot8100159-CHI, cache-fra-eddf8230071-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:55 GMT
server: nginx
x-timer: S1715498424.301922,VS0,VE5
etag: W/"663ce653-10d"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: b57c839e-0e15-11ef-b9bf-564b3e61d328
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 widget-options.css
blogs.infoblox.com/wp-content/plugins/widget-options/assets/css/ 3 KB
752 B 61ms
57ms Stylesheet
text/css 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/plugins/widget-options/assets/css/widget-options.css?ver=4.0.5.1

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5664ef27a425a799226cc5b4a9ce3f663f5dd9060ab7b19326515ae6a78933c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 835, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231237
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-5c5f5
content-length: 482
x-served-by: cache-chi-klot8100091-CHI, cache-fra-etou8220060-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:06:00 GMT
server: nginx
x-timer: S1715498424.302362,VS0,VE4
etag: W/"663ce658-ae8"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: b580bc56-0e15-11ef-9701-0a542e043f50
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 wp-ulike.min.css
blogs.infoblox.com/wp-content/plugins/wp-ulike/assets/css/ 26 KB
5 KB 59ms
55ms Stylesheet
text/css 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/plugins/wp-ulike/assets/css/wp-ulike.min.css?ver=4.7.0

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

9838b2f0b70eed858474cf429e7b3a9e74b7a968547b9b43151b3d3417942c17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 842, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231237
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-6zx56
content-length: 4770
x-served-by: cache-chi-kigq8000049-CHI, cache-fra-etou8220064-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:06:00 GMT
server: nginx
x-timer: S1715498424.302144,VS0,VE3
etag: W/"663ce658-676d"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: b58f0caa-0e15-11ef-9eb1-3a8be9a6877a
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 dashicons.min.css
blogs.infoblox.com/wp-includes/css/ 58 KB
36 KB 62ms
58ms Stylesheet
text/css 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-includes/css/dashicons.min.css

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 841, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231237
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-7p2sd
content-length: 36701
x-served-by: cache-chi-klot8100172-CHI, cache-fra-etou8220136-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:56 GMT
server: nginx
x-timer: S1715498424.302379,VS0,VE4
etag: W/"663ce654-e688"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: b58fdb3a-0e15-11ef-9e44-6609e5b21e96
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 css
fonts.googleapis.com/ 9 KB
1 KB 140ms
47ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro%3A400%2C400i%2C600%2C700&ver=2.10.0

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

140237201b8d9ee83abd909ec616d622cd03bdbdb68e2f509e8f522518b7eef3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Sun, 12 May 2024 07:20:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 12 May 2024 07:19:31 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 12 May 2024 07:20:24 GMT

GET
H2 200 front-end.css
blogs.infoblox.com/wp-content/themes/infoblox-blog/lib/gutenberg/ 9 KB
2 KB 96ms
93ms Stylesheet
text/css 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/infoblox-blog/lib/gutenberg/front-end.css?ver=2.10.0

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

47bb48dbb60985f6c3925bcf32c14d6c586edcad7b629b9c97fe3705d1660279

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 826, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231237
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-m45gq
content-length: 2205
x-served-by: cache-chi-kigq8000150-CHI, cache-fra-eddf8230032-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:06:00 GMT
server: nginx
x-timer: S1715498424.302109,VS0,VE5
etag: W/"663ce658-23d0"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: b5903b24-0e15-11ef-bcae-de9f5536d504
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 jquery.sidr.dark.min.css
cdn.jsdelivr.net/jquery.sidr/2.2.1/stylesheets/ 3 KB
2 KB 173ms
57ms Stylesheet
text/css 2606:4700::6812:bb1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/jquery.sidr/2.2.1/stylesheets/jquery.sidr.dark.min.css

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

780929714861ca223c2893799ec20e113d5cd9d3dcae15be3aca5db440ea1db2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 659336
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1401
x-served-by: cache-fra-etou8220041-FRA, cache-lga21976-LGA
server: cloudflare
etag: W/"ddb-6HgE8UA45Z+BAXCB3SXpxOmIsUw"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GMCj4SdsNe%2BeC%2BtrFoCwA2J5XwLZbRptOK5w3eUZ5UIPElC5j1vAG9Q5uac5905KjbMoP9zhfnay7m%2Fuuv54HV1TnuE%2BMFAk9ttmmkpDXrcEhl%2B3ECLy18SXtgg%2F9E3JMi%2BK%2F8z9j44ASGgvr4g%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8828a5608d962be5-FRA

GET
H2 200 infoblox-custom.css
blogs.infoblox.com/wp-content/themes/infoblox-blog/ 67 KB
17 KB 99ms
96ms Stylesheet
text/css 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c7f46df91d74501f7ee85f7ce9b32e1e4f8d413b525366a24a7a036ca75952f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 836, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231236
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-rvvcb
content-length: 17244
x-served-by: cache-chi-kigq8000130-CHI, cache-fra-eddf8230030-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:58 GMT
server: nginx
x-timer: S1715498424.332781,VS0,VE4
etag: W/"663ce656-10ab7"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: b5916a69-0e15-11ef-85cf-0ae317fe726a
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 slider-hp.css
blogs.infoblox.com/wp-content/themes/infoblox-blog/ 2 KB
1 KB 107ms
104ms Stylesheet
text/css 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/infoblox-blog/slider-hp.css

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

d0ff37ec6455fc98cf29d6e3d6a6117c260e2623f9f8238519a6570b7081daaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 836, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231237
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-zpn9k
content-length: 881
x-served-by: cache-chi-klot8100114-CHI, cache-fra-etou8220027-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:58 GMT
server: nginx
x-timer: S1715498424.333225,VS0,VE4
etag: W/"663ce656-975"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: b59f0616-0e15-11ef-b039-fe9735e210a3
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 lity.min.css
blogs.infoblox.com/wp-content/themes/infoblox-blog/ 4 KB
1 KB 110ms
107ms Stylesheet
text/css 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/infoblox-blog/lity.min.css

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

708ac71ed8728392391eb1d7c3fdb816dedb96bfcd4a1ab9238647623b9528c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 839, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231237
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-sp4l8
content-length: 1197
x-served-by: cache-chi-klot8100047-CHI, cache-fra-eddf8230108-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:55 GMT
server: nginx
x-timer: S1715498424.333232,VS0,VE8
etag: W/"663ce653-f11"
vary: Accept-Encoding
content-type: text/css
x-styx-req-id: b5a42b3a-0e15-11ef-96b1-5e6873469e9c
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 jquery.min.js Show response
blogs.infoblox.com/wp-includes/js/jquery/ 86 KB
35 KB 98ms
95ms Script
application/x-javascript 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 861, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231236
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-5c5f5
content-length: 35438
x-served-by: cache-chi-klot8100049-CHI, cache-fra-etou8220043-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:57 GMT
server: nginx
x-timer: S1715498424.332731,VS0,VE4
etag: W/"663ce655-15601"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: b5b22a63-0e15-11ef-9701-0a542e043f50
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 jquery-migrate.min.js Show response
blogs.infoblox.com/wp-includes/js/jquery/ 13 KB
5 KB 101ms
99ms Script
application/x-javascript 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 853, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231236
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-5j69z
content-length: 5342
x-served-by: cache-chi-kigq8000088-CHI, cache-fra-eddf8230099-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:57 GMT
server: nginx
x-timer: S1715498424.332741,VS0,VE4
etag: W/"663ce655-3509"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: b5b3f055-0e15-11ef-9426-16ab02f7e8e2
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 settings.js Show response
blogs.infoblox.com/wp-content/plugins/miniorange-saml-20-single-sign-on/includes/js/ 20 KB
5 KB 108ms
106ms Script
application/x-javascript 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/plugins/miniorange-saml-20-single-sign-on/includes/js/settings.js

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

fab34cb0ba670abf20ae82b55e7c44b38f240c0b257d4193833e7ac2c11117eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 853, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231236
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-5j69z
content-length: 5091
x-served-by: cache-chi-klot8100034-CHI, cache-fra-etou8220086-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:06:00 GMT
server: nginx
x-timer: S1715498424.332724,VS0,VE5
etag: W/"663ce658-4ffc"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: b5b892df-0e15-11ef-9426-16ab02f7e8e2
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 jquery.bxslider.css
cdn.jsdelivr.net/bxslider/4.2.12/ 4 KB
2 KB 170ms
55ms Stylesheet
text/css 2606:4700::6812:bb1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/bxslider/4.2.12/jquery.bxslider.css

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

55ddd1f80cec627f624b79cea24ccd18fb38180c3bff6757ffe56be7c1a6445d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 671980
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1187
x-served-by: cache-fra-etou8220056-FRA, cache-lga21959-LGA
server: cloudflare
etag: W/"f5e-9CY+ZfG2D1tXr+G8dDrQnwbBEmY"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2vZrn%2FKjxyTKUr9JNxq301RgvnNt8IsCoYAEubVvSsEtf2Fht24qn7YFdDW%2FKLTsKU0BzkMdWbkMRbvZv2kvrsZxpI1SLU1uiKuO2AxB9pc%2BpgFjELMg63%2BUOb3EIm%2Bqxo%2FaCvT38fxuwLXadcQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8828a5608d972be5-FRA

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.7.1/ 85 KB
30 KB 137ms
39ms Script
text/javascript 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 04:14:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11147
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30462
x-xss-protection: 0
last-modified: Tue, 12 Sep 2023 02:38:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 12 May 2025 04:14:37 GMT

GET
H2 200 jquery.bxslider.min.js Show response
cdn.jsdelivr.net/bxslider/4.2.12/ 23 KB
6 KB 173ms
59ms Script
application/javascript 2606:4700::6812:bb1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/bxslider/4.2.12/jquery.bxslider.min.js

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7731d577c5dfa5f38e9bf82dedae51174c9ddd4d3d4668eea9d1e51d6ce13d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 671981
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230029-FRA, cache-lga21974-LGA
server: cloudflare
etag: W/"5bf7-z6ox3Bc9Kcb0lQd4zMXLOxqRM5Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XZTpviLNv7I0yYcOehaf%2BKD7Av81jaCPyPpwpt4H4oY23Sf7BnJsThQaj47%2F03NLI0e%2F1tTgA2MOlamZN4wk02e8u4Zy8kNumJuXo5QE3NC9kRD3IZ9pnJSzkbmUJy5t9xdKmOGguCD%2Fy1U5v9Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 8828a5608d982be5-FRA

GET
H2 200 infoblox-logo-2.svg
blogs.infoblox.com/wp-content/uploads/ 5 KB
3 KB 96ms
95ms Image
image/svg+xml 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/infoblox-logo-2.svg

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5e532f2001bd715ac2458b017f00e83297416f11297bb68a50d13e84f497b16b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 0, 684, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231236
x-cache: MISS, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-59dfbff8c8-qrk82
content-length: 2265
x-served-by: cache-chi-klot8100041-CHI, cache-fra-etou8220071-FRA, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:23:31 GMT
server: nginx
x-timer: S1715498424.332724,VS0,VE4
etag: W/"661ff783-1558"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: 48e4ec64-fcd7-11ee-b1af-ca8eaf5e6450
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 18 Apr 2025 16:26:46 GMT

GET
H2 200 search.png
blogs.infoblox.com/wp-content/uploads/ 1 KB
2 KB 109ms
108ms Image
image/png 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/search.png

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5f27ff5fc0da5cefdc57dd9e79a91efdd46903e83bd6c86643aafd686430ffb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-pantheon-styx-hostname: styx-fe1-a-59dfbff8c8-xndfq
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231235
x-cache: HIT, HIT, MISS, MISS
expires: Fri, 18 Apr 2025 16:26:46 GMT
content-length: 1228
x-served-by: cache-chi-klot8100114-CHI, cache-ams21038-AMS, cache-ams12783-AMS, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:24:38 GMT
server: nginx
x-timer: S1715498424.332755,VS0,VE13
etag: "661ff7c6-4cc"
content-type: image/png
x-styx-req-id: 48e47884-fcd7-11ee-b03b-aae3bc202774
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 559, 0, 0

GET
H2 200 category-cyber-threat-advisory.svg
blogs.infoblox.com/wp-content/uploads/ 8 KB
3 KB 53ms
52ms Image
image/svg+xml 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/category-cyber-threat-advisory.svg

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

f9f7ff183d86cda77ec548473949359e842a6963e6457ebccaaa700c22702012

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 0, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 224327
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-7p2sd
content-length: 2480
x-served-by: cache-chi-kigq8000020-CHI, cache-fra-eddf8230042-FRA, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:21:47 GMT
server: nginx
x-timer: S1715498424.399268,VS0,VE6
etag: W/"661ff71b-1eee"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: cbd24416-0e25-11ef-9e44-6609e5b21e96
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 17:01:36 GMT

GET
H2 200 FB.svg
blogs.infoblox.com/wp-content/uploads/ 446 B
589 B 60ms
57ms Image
image/svg+xml 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/FB.svg

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cddede585f1ce388062b874c8ed32e1bbe2a0ffa258e85ff334ec7d1b673200f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 2, 501, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231230
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-59dfbff8c8-xndfq
content-length: 328
x-served-by: cache-chi-kigq8000172-CHI, cache-fra-eddf8230020-FRA, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:20:08 GMT
server: nginx
x-timer: S1715498425.505214,VS0,VE5
etag: W/"661ff6b8-1be"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: 9a339659-fcd6-11ee-b03b-aae3bc202774
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 18 Apr 2025 16:21:53 GMT

GET
H2 200 x-logo.svg
blogs.infoblox.com/wp-content/uploads/ 2 KB
2 KB 56ms
53ms Image
image/svg+xml 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/x-logo.svg

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5cbff7c70efe6b8a6877e92b8b0c60564dfa64dace120d3a85b4ea24d5a5dba6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 0, 506, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231230
x-cache: MISS, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-5648cff58c-vkj9v
content-length: 1283
x-served-by: cache-chi-klot8100064-CHI, cache-fra-etou8220111-FRA, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:25:19 GMT
server: nginx
x-timer: S1715498425.505563,VS0,VE4
etag: W/"661ff7ef-708"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: 4c23c21a-fcd7-11ee-9e9a-4a74e5450a1f
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 18 Apr 2025 16:26:52 GMT

GET
H2 200 LI.svg
blogs.infoblox.com/wp-content/uploads/ 604 B
716 B 55ms
52ms Image
image/svg+xml 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/LI.svg

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

868503219c7ca2afd9cab62a466011d4e99684a725dd287e55b1b57fbe78febd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 2, 505, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231230
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-5648cff58c-spmnw
content-length: 406
x-served-by: cache-chi-kigq8000104-CHI, cache-fra-etou8220120-FRA, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:20:22 GMT
server: nginx
x-timer: S1715498425.505793,VS0,VE3
etag: W/"661ff6c6-25c"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: 9a33dd99-fcd6-11ee-8b8f-f65684b07a0e
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 18 Apr 2025 16:21:53 GMT

GET
H2 200 a-typical-vextrio-attack.png
blogs.infoblox.com/wp-content/uploads/ 106 KB
106 KB 62ms
61ms Image
image/png 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/a-typical-vextrio-attack.png

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cce25d26533d03769ddb04d54482b596a16d98cf9bf7dea2df2b071ebf415e10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-pantheon-styx-hostname: styx-fe1-a-59dfbff8c8-9zxgs
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 224265
x-cache: HIT, HIT, MISS, MISS
expires: Fri, 18 Apr 2025 16:55:54 GMT
content-length: 108705
x-served-by: cache-chi-kigq8000026-CHI, cache-ams21040-AMS, cache-ams21074-AMS, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:20:52 GMT
server: nginx
x-timer: S1715498424.413788,VS0,VE14
etag: "661ff6e4-1a8a1"
content-type: image/png
x-styx-req-id: 5aa3a91f-fcdb-11ee-a91a-ea0d7a2f4d29
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 0, 0, 0

GET
H2 200 javascript-redirect-code.png
blogs.infoblox.com/wp-content/uploads/ 188 KB
188 KB 62ms
61ms Image
image/png 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/javascript-redirect-code.png

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

382eec6a06d36e61ea966510e1fe3f52428e0bc44c329dbaa888f14d59955a74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-m45gq
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 224266
x-cache: HIT, HIT, MISS, MISS
expires: Fri, 02 May 2025 00:20:48 GMT
content-length: 192243
x-served-by: cache-chi-klot8100105-CHI, cache-ams21063-AMS, cache-ams21036-AMS, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:23:52 GMT
server: nginx
x-timer: S1715498424.454640,VS0,VE14
etag: "661ff798-2eef3"
content-type: image/png
x-styx-req-id: a930ec8f-0750-11ef-9cb5-de9f5536d504
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 0, 0, 0

GET
H2 200 avatar_user_397_1714162589.png
blogs.infoblox.com/wp-content/uploads/ 4 KB
4 KB 64ms
62ms Image
image/png 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/avatar_user_397_1714162589.png

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

8d9524269f77bfe9bb2dfa87e6d3dca4c0ab1545e94533c69fda779b3797874a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-qk47f
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231101
x-cache: HIT, HIT, MISS, MISS
expires: Sun, 27 Apr 2025 20:16:31 GMT
content-length: 4273
x-served-by: cache-chi-klot8100095-CHI, cache-ams21073-AMS, cache-ams21044-AMS, cache-fra-etou8220083-FRA
last-modified: Fri, 26 Apr 2024 20:16:29 GMT
server: nginx
x-timer: S1715498425.505544,VS0,VE15
etag: "662c0b9d-10b1"
content-type: image/png
x-styx-req-id: df1e878f-0409-11ef-bdb8-ce1bcc5ca899
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 0, 0, 0

GET
H2 200 arrow_link-v2.jpg
blogs.infoblox.com/wp-content/uploads/ 24 KB
24 KB 63ms
61ms Image
image/jpeg 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/arrow_link-v2.jpg

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

465ca9e432168f0604aed9d539fe96f4338bdd69d0850760d64240066ab03c51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-wwn9v
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231236
x-cache: HIT, HIT, MISS, MISS
expires: Thu, 01 May 2025 14:02:23 GMT
content-length: 24660
x-served-by: cache-chi-klot8100161-CHI, cache-ams21036-AMS, cache-ams12766-AMS, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:20:55 GMT
server: nginx
x-timer: S1715498425.505916,VS0,VE13
etag: "661ff6e7-6054"
content-type: image/jpeg
x-styx-req-id: 4454cd08-06fa-11ef-96e8-7ad7a55b083e
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 7, 0, 0

GET
H2 200 slider-hp.js Show response
blogs.infoblox.com/wp-content/themes/genesis-sample/ 116 KB
34 KB 51ms
51ms Script
application/x-javascript 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/genesis-sample/slider-hp.js

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

b663370b2ecf34db611eaba1d1064a9c0f08f8047c18c59f5ffd16caf58ef6b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 401, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231237
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-z9j9j
content-length: 34566
x-served-by: cache-chi-klot8100144-CHI, cache-fra-eddf8230054-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:06:00 GMT
server: nginx
x-timer: S1715498424.497230,VS0,VE5
etag: W/"663ce658-1cfb8"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: b5b92bcf-0e15-11ef-8fa0-3a3f3276620e
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 FB-icon-2023.svg
blogs.infoblox.com/wp-content/uploads/ 464 B
627 B 58ms
56ms Image
image/svg+xml 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/FB-icon-2023.svg

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

f6e17a06cf57ba1c1e00d705cc0ea44d42dc095c01327f5c8b800ac5c10b534c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 2, 671, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231235
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-5648cff58c-w9lhf
content-length: 343
x-served-by: cache-chi-kigq8000066-CHI, cache-fra-etou8220023-FRA, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:20:08 GMT
server: nginx
x-timer: S1715498425.505933,VS0,VE4
etag: W/"661ff6b8-1d0"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: 9a349892-fcd6-11ee-a9c7-1e40e364ecfa
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 18 Apr 2025 16:21:53 GMT

GET
H2 200 X-icon-2023.svg
blogs.infoblox.com/wp-content/uploads/ 747 B
747 B 60ms
58ms Image
image/svg+xml 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/X-icon-2023.svg

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

70469df2c7c60dd0fd471dd98076939866edce268ed114c33ad8c0309fd81d2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 2, 664, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231235
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-5648cff58c-gzv2p
content-length: 499
x-served-by: cache-chi-klot8100080-CHI, cache-fra-eddf8230105-FRA, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:20:49 GMT
server: nginx
x-timer: S1715498425.505883,VS0,VE4
etag: W/"661ff6e1-2eb"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: 9a34e001-fcd6-11ee-9f7b-82a76dbf96c7
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 18 Apr 2025 16:21:53 GMT

GET
H2 200 YT-icon-2023.svg
blogs.infoblox.com/wp-content/uploads/ 747 B
744 B 59ms
56ms Image
image/svg+xml 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/YT-icon-2023.svg

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e5f87052ae30bfd71b5b59b70267de5895ae2133a05e40104eaebb15b149b1ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 2, 668, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231234
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-5648cff58c-spmnw
content-length: 448
x-served-by: cache-chi-klot8100032-CHI, cache-fra-etou8220052-FRA, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:20:49 GMT
server: nginx
x-timer: S1715498425.506323,VS0,VE4
etag: W/"661ff6e1-2eb"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: 9a35195e-fcd6-11ee-8b8f-f65684b07a0e
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 18 Apr 2025 16:21:55 GMT

GET
H2 200 LI-icon-2023.svg
blogs.infoblox.com/wp-content/uploads/ 806 B
768 B 60ms
58ms Image
image/svg+xml 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/LI-icon-2023.svg

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c05e26befde7722134ba6666c70090b4442f804ab3cc0b72260a862fafa70055

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 2, 666, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231234
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-5648cff58c-9jg6z
content-length: 484
x-served-by: cache-chi-kigq8000173-CHI, cache-fra-etou8220091-FRA, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:20:22 GMT
server: nginx
x-timer: S1715498425.506334,VS0,VE4
etag: W/"661ff6c6-326"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-styx-req-id: 9a34caa2-fcd6-11ee-927a-7264cc17a67b
cache-control: max-age=31622400
accept-ranges: bytes
expires: Fri, 18 Apr 2025 16:21:53 GMT

GET
H2 200 wp-ulike.min.js Show response
blogs.infoblox.com/wp-content/plugins/wp-ulike/assets/js/ 15 KB
5 KB 54ms
49ms Script
application/x-javascript 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/plugins/wp-ulike/assets/js/wp-ulike.min.js?ver=4.7.0

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

62c46fc4b22fb535a4de0337b9830b1c7506887e42156e43ca8bcb210578280b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 847, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231237
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-vj962
content-length: 5090
x-served-by: cache-chi-kigq8000131-CHI, cache-fra-etou8220049-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:56 GMT
server: nginx
x-timer: S1715498425.504329,VS0,VE4
etag: W/"663ce654-3d70"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: b5c28f7f-0e15-11ef-b3d9-fad2edf62dbb
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 hoverIntent.min.js Show response
blogs.infoblox.com/wp-includes/js/ 1 KB
1022 B 56ms
51ms Script
application/x-javascript 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-includes/js/hoverIntent.min.js?ver=1.10.2

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

ed5b5df9ceacfe76857ac51964972b0b417a215b2f50e837fd6b64bad7339c40

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 847, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231237
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-5wssg
content-length: 721
x-served-by: cache-chi-kigq8000162-CHI, cache-fra-etou8220147-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:57 GMT
server: nginx
x-timer: S1715498425.504403,VS0,VE4
etag: W/"663ce655-5db"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: b5c71ec2-0e15-11ef-a9ed-f2f52e1bfc3f
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:27 GMT

GET
H2 200 superfish.min.js Show response
blogs.infoblox.com/wp-content/themes/genesis/lib/js/menu/ 4 KB
2 KB 55ms
50ms Script
application/x-javascript 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/genesis/lib/js/menu/superfish.min.js?ver=1.7.10

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

ece565a1f66a32347dfed83562c428ff7736648de72b0027dd8f0e0f27e0c327

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 850, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231237
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-x5bd7
content-length: 2000
x-served-by: cache-chi-kigq8000144-CHI, cache-fra-etou8220072-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:56 GMT
server: nginx
x-timer: S1715498425.504850,VS0,VE4
etag: W/"663ce654-1193"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: b5e65e55-0e15-11ef-a5c0-0a204bd69ae8
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:28 GMT

GET
H2 200 superfish.args.min.js Show response
blogs.infoblox.com/wp-content/themes/genesis/lib/js/menu/ 132 B
330 B 56ms
52ms Script
application/x-javascript 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/genesis/lib/js/menu/superfish.args.min.js?ver=3.5.0

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

20550f7bcb2a817ac9a5879e04260da8268e971c0b8031a6b7a2f48a55ee60d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 849, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231237
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-x5bd7
content-length: 132
x-served-by: cache-chi-kigq8000034-CHI, cache-fra-etou8220021-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:06:00 GMT
server: nginx
x-timer: S1715498425.504679,VS0,VE4
etag: W/"663ce658-84"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: b5dd8031-0e15-11ef-a5c0-0a204bd69ae8
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:28 GMT

GET
H2 200 skip-links.min.js Show response
blogs.infoblox.com/wp-content/themes/genesis/lib/js/ 386 B
543 B 54ms
50ms Script
application/x-javascript 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/genesis/lib/js/skip-links.min.js?ver=3.5.0

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

ade38136058fcd75880d3673855aff859ee377d5915e59cccf24a973d418bebb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 841, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231237
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-zpn9k
content-length: 252
x-served-by: cache-chi-klot8100077-CHI, cache-fra-etou8220041-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:55 GMT
server: nginx
x-timer: S1715498425.504674,VS0,VE4
etag: W/"663ce653-182"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: b5dd3b47-0e15-11ef-b039-fe9735e210a3
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:28 GMT

GET
H2 200 responsive-menus.min.js Show response
blogs.infoblox.com/wp-content/themes/infoblox-blog/js/ 4 KB
2 KB 58ms
54ms Script
application/x-javascript 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/infoblox-blog/js/responsive-menus.min.js?ver=2.10.0

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

6fd951519999c4f446db71f347635025addb27c21d3b5915d498732ea1eec927

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 838, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231236
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-sp4l8
content-length: 1527
x-served-by: cache-chi-klot8100156-CHI, cache-fra-eddf8230061-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:55 GMT
server: nginx
x-timer: S1715498425.505037,VS0,VE4
etag: W/"663ce653-e64"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: b5e1495e-0e15-11ef-96b1-5e6873469e9c
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:28 GMT

GET
H2 200 genesis-sample.js Show response
blogs.infoblox.com/wp-content/themes/infoblox-blog/js/ 1 KB
905 B 59ms
55ms Script
application/x-javascript 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/infoblox-blog/js/genesis-sample.js?ver=2.10.0

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

a1c4a7fc8d5baa9d1b5e4d8c55c3229442dbf98430024e9b008cd3cd99c72fbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 841, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231236
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-vj962
content-length: 637
x-served-by: cache-chi-klot8100140-CHI, cache-fra-etou8220135-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:58 GMT
server: nginx
x-timer: S1715498425.505016,VS0,VE4
etag: W/"663ce656-4e1"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: b5f8c304-0e15-11ef-b3d9-fad2edf62dbb
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:28 GMT

GET
H2 200 lity.min.js Show response
blogs.infoblox.com/wp-content/themes/infoblox-blog/js/ 7 KB
3 KB 62ms
58ms Script
application/x-javascript 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/infoblox-blog/js/lity.min.js

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

576e529ab8a4f6521f8aff687e04e47ca0e165585dfe6b82d1758fd99ff03336

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 833, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231236
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-wwn9v
content-length: 3184
x-served-by: cache-chi-kigq8000140-CHI, cache-fra-eddf8230028-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:55 GMT
server: nginx
x-timer: S1715498425.505109,VS0,VE5
etag: W/"663ce653-1c1a"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: b5eca331-0e15-11ef-8ed9-7ad7a55b083e
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:28 GMT

GET
H2 200 jquery.sidr.min.js Show response
cdn.jsdelivr.net/jquery.sidr/2.2.1/ 7 KB
3 KB 63ms
59ms Script
application/javascript 2606:4700::6812:bb1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/jquery.sidr/2.2.1/jquery.sidr.min.js

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd57ae7228574a83527cb8917ec5a0ff944aa787934ee5b85a7976f259b7ae31

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5145617
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230092-FRA, cache-lga21972-LGA
server: cloudflare
etag: W/"1b7a-V8NZ9CJQc1jNZn9BGb1UCGoehC0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=quR8cPPG1XMYJQP1hD6a2bM8TjzQkfQqa1HgzWiWLbrzFtVydhrJbsGnS%2FwUYpCJCXCAvaUE%2B7Hx2SH6dqg%2Bgq18WSBI95YQzHX%2Bme3ntaAQAbnxRcSHTtaI7FxF57e7cTNRLKvmvSHpm6EXpNQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 8828a5611e322be5-FRA

GET
H2 200 maxmegamenu.js Show response
blogs.infoblox.com/wp-content/plugins/megamenu/js/ 33 KB
7 KB 58ms
55ms Script
application/x-javascript 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/plugins/megamenu/js/maxmegamenu.js?ver=3.3.1

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

a875e1d5f8cfe252cc8f5e04d750dd8c771fb8aceabd435d548425a445ab61d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 849, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231237
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-5wssg
content-length: 6691
x-served-by: cache-chi-kigq8000047-CHI, cache-fra-eddf8230036-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:55 GMT
server: nginx
x-timer: S1715498425.505395,VS0,VE4
etag: W/"663ce653-82aa"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: b603683c-0e15-11ef-a9ed-f2f52e1bfc3f
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:28 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 339 KB
109 KB 849ms
66ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-F7RMF

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

466532d720469eab15683075d0681b23248bd0638a3b77b8b672760a7f4ec521

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110863
x-xss-protection: 0
last-modified: Sun, 12 May 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 12 May 2024 07:20:25 GMT

GET
H2 200 wks0kwv.js Show response
use.typekit.net/ 17 KB
7 KB 831ms
49ms Script
text/javascript 2a02:26f0:7100::1720:ef50
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/wks0kwv.js

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:7100::1720:ef50 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

35667f94f5d8ceaac265ab0ee16d50ef3fc5b04b9ce6f770a8b57b0b8313450a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
date: Sun, 12 May 2024 07:20:25 GMT
server: nginx
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6739

GET
H2 200 ciu-banner.jpg
blogs.infoblox.com/wp-content/uploads/ 135 KB
136 KB 59ms
59ms Image
image/jpeg 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/ciu-banner.jpg

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

945c284f98ebab78bcdccb6711ebc2340756345a312a8fcad4da1871505029bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-pantheon-styx-hostname: styx-fe1-b-5648cff58c-9jg6z
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 227481
x-cache: HIT, HIT, MISS, MISS
expires: Fri, 18 Apr 2025 16:41:29 GMT
content-length: 138471
x-served-by: cache-chi-klot8100088-CHI, cache-ams21066-AMS, cache-ams21042-AMS, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:21:48 GMT
server: nginx
x-timer: S1715498425.512772,VS0,VE13
etag: "661ff71c-21ce7"
content-type: image/jpeg
x-styx-req-id: 56d7d56c-fcd9-11ee-927a-7264cc17a67b
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 0, 0, 0

GET
H2 200 icon-kudo.png
blogs.infoblox.com/wp-content/uploads/ 3 KB
4 KB 98ms
98ms Image
image/png 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/icon-kudo.png

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

658414418ebba65bb3d94f37b93ce4245b29d3b900897c923eeffd56ace0d381

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-pantheon-styx-hostname: styx-fe1-b-5648cff58c-2x8zb
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231230
x-cache: MISS, HIT, MISS, MISS
expires: Fri, 18 Apr 2025 16:26:58 GMT
content-length: 3483
x-served-by: cache-chi-klot8100023-CHI, cache-ams21055-AMS, cache-ams12731-AMS, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:22:45 GMT
server: nginx
x-timer: S1715498425.543489,VS0,VE13
etag: "661ff755-d9b"
content-type: image/png
x-styx-req-id: 4ff0df9d-fcd7-11ee-af57-2ef2abb1ce44
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 0, 0, 0

GET
H2 200 search_icon.jpg
blogs.infoblox.com/wp-content/uploads/ 24 KB
25 KB 88ms
88ms Image
image/jpeg 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.infoblox.com/wp-content/uploads/search_icon.jpg

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

d80f9badc08b8777ce9133f8bfa898576eaac335a195355a410f34e83c26311d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-pantheon-styx-hostname: styx-fe1-a-59dfbff8c8-52wxp
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231229
x-cache: HIT, HIT, MISS, MISS
expires: Fri, 18 Apr 2025 16:26:58 GMT
content-length: 24824
x-served-by: cache-chi-klot8100092-CHI, cache-ams21032-AMS, cache-ams12730-AMS, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:24:38 GMT
server: nginx
x-timer: S1715498425.543480,VS0,VE13
etag: "661ff7c6-60f8"
content-type: image/jpeg
x-styx-req-id: 50233a0d-fcd7-11ee-9e4b-4291a5bfddfd
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 4, 0, 0

GET
H2 200 37386212-b105-4f4d-9d7c-472fc2ad1568.woff2
blogs.infoblox.com/wp-content/themes/infoblox-blog/fonts/6061553/ 36 KB
37 KB 52ms
50ms Font
font/woff2 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/infoblox-blog/fonts/6061553/37386212-b105-4f4d-9d7c-472fc2ad1568.woff2

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

b7b9f2c0ab617f6860d1e08fb1b98c31859c4a12fd7836a62ad2b594097a5150

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css
Origin: https://blogs.infoblox.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 779, 0
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231229
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-5wssg
content-length: 37308
x-served-by: cache-chi-klot8100110-CHI, cache-fra-etou8220150-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:56 GMT
server: nginx
x-timer: S1715498425.551952,VS0,VE4
etag: "663ce654-91bc"
content-type: font/woff2
access-control-allow-origin: *
x-styx-req-id: b9f57971-0e15-11ef-a9ed-f2f52e1bfc3f
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:34 GMT

GET
H2 200 35c87a49-7655-4531-a835-5f0957f5c223.woff2
blogs.infoblox.com/wp-content/themes/infoblox-blog/fonts/6061585/ 39 KB
39 KB 55ms
54ms Font
font/woff2 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/infoblox-blog/fonts/6061585/35c87a49-7655-4531-a835-5f0957f5c223.woff2

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

763c90a60f06998d0e5496b960fb880f1d28405fb9040e879d1e2328458c9001

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css
Origin: https://blogs.infoblox.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 709, 0
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231229
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-z9j9j
content-length: 39536
x-served-by: cache-chi-klot8100137-CHI, cache-fra-eddf8230069-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:58 GMT
server: nginx
x-timer: S1715498425.551948,VS0,VE4
etag: "663ce656-9a70"
content-type: font/woff2
access-control-allow-origin: *
x-styx-req-id: b9e9c25a-0e15-11ef-8fa0-3a3f3276620e
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:34 GMT

GET
H2 200 588e728d-3266-4845-996e-87629b61bda2.woff2
blogs.infoblox.com/wp-content/themes/infoblox-blog/fonts/6061769/ 40 KB
40 KB 53ms
52ms Font
font/woff2 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/infoblox-blog/fonts/6061769/588e728d-3266-4845-996e-87629b61bda2.woff2

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e254222dccac85dc391b811a0177bbe48a6ce70dd48ccc1e7112881eaf4ae870

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css
Origin: https://blogs.infoblox.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 779, 0
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231229
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-x5bd7
content-length: 40696
x-served-by: cache-chi-kigq8000154-CHI, cache-fra-etou8220070-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:56 GMT
server: nginx
x-timer: S1715498425.551930,VS0,VE4
etag: "663ce654-9ef8"
content-type: font/woff2
access-control-allow-origin: *
x-styx-req-id: b9ea1208-0e15-11ef-a5c0-0a204bd69ae8
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:34 GMT

GET
H2 200 e2a3cca5-8801-42b6-aca3-9db65304f1f6.woff2
blogs.infoblox.com/wp-content/themes/infoblox-blog/fonts/6061569/ 38 KB
38 KB 56ms
55ms Font
font/woff2 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/infoblox-blog/fonts/6061569/e2a3cca5-8801-42b6-aca3-9db65304f1f6.woff2

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

4284fc67b001b14223b3605043e1340e0542ddf1aad34b5277dd6eceba15d3b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css
Origin: https://blogs.infoblox.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 779, 0
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231229
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-x5bd7
content-length: 39204
x-served-by: cache-chi-klot8100031-CHI, cache-fra-eddf8230144-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:06:00 GMT
server: nginx
x-timer: S1715498425.552158,VS0,VE4
etag: "663ce658-9924"
content-type: font/woff2
access-control-allow-origin: *
x-styx-req-id: b9ea3961-0e15-11ef-a5c0-0a204bd69ae8
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:34 GMT

GET
H2 200 e8c1b536-91d7-43a4-bd6a-4810cb086b1c.woff2
blogs.infoblox.com/wp-content/themes/infoblox-blog/fonts/6061737/ 39 KB
39 KB 56ms
56ms Font
font/woff2 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/themes/infoblox-blog/fonts/6061737/e8c1b536-91d7-43a4-bd6a-4810cb086b1c.woff2

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

4991ede4040bc4d71a9d4ad513a09b717f5290ab6ca74807ec5cb61811847307

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css
Origin: https://blogs.infoblox.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 1, 776, 0
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:24 GMT
age: 231229
x-cache: HIT, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-m45gq
content-length: 39512
x-served-by: cache-chi-kigq8000134-CHI, cache-fra-eddf8230144-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:56 GMT
server: nginx
x-timer: S1715498425.552085,VS0,VE5
etag: "663ce654-9a58"
content-type: font/woff2
access-control-allow-origin: *
x-styx-req-id: b9eae491-0e15-11ef-bcae-de9f5536d504
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:34 GMT

GET
H2 200 promo-crn-security-100-2023.jpg
www.infoblox.com/wp-content/uploads/ 38 KB
39 KB 801ms
61ms Image
image/jpeg 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.infoblox.com/wp-content/uploads/promo-crn-security-100-2023.jpg

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

34eee5dcfb0c64df2cfdff05f322ce9a24f2e19fec6c4fed55a6a803ed28597b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 0, 7683, 0, 0
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:25 GMT
age: 230987
x-cache: HIT, HIT, MISS, MISS
expires: Fri, 04 Apr 2025 17:15:19 GMT
content-length: 39099
x-served-by: cache-chi-kigq8000147-CHI, cache-ams21038-AMS, cache-ams12762-AMS, cache-fra-etou8220071-FRA
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05
last-modified: Fri, 14 Apr 2023 22:26:18 GMT
server: nginx
x-timer: S1715498425.290344,VS0,VE12
etag: "6439d30a-98bb"
content-type: image/jpeg
x-styx-req-id: bf9b599a-f1dd-11ee-b900-62d8d57276c4
cache-control: max-age=31622400
accept-ranges: bytes
x-pantheon-styx-hostname: styx-fe1-b-69554747b9-6v4d5

GET
H2 200 infoblox-video-build-for-a-world-that-never-stops.png
www.infoblox.com/wp-content/uploads/ 389 KB
389 KB 801ms
62ms Image
image/png 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.infoblox.com/wp-content/uploads/infoblox-video-build-for-a-world-that-never-stops.png

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

6a1fdce4e2f209d018014e05c230d279fc2ed26c2241737650fb23413fe16001

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 0, 673, 0, 0
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:25 GMT
age: 230987
x-cache: HIT, HIT, MISS, MISS
expires: Wed, 11 Dec 2024 17:46:44 GMT
content-length: 397957
x-served-by: cache-chi-klot8100155-CHI, cache-ams21055-AMS, cache-ams12765-AMS, cache-fra-etou8220071-FRA
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05
last-modified: Fri, 14 Apr 2023 22:26:18 GMT
server: nginx
x-timer: S1715498425.290369,VS0,VE12
etag: "6439d30a-61285"
content-type: image/png
x-styx-req-id: 3fb18247-984d-11ee-8dd1-3a5483c22dce
cache-control: max-age=31622400
accept-ranges: bytes
x-pantheon-styx-hostname: styx-fe1-b-56cc4f6c87-d4ssm

GET
H2 200 infoblox-navigation-promo-2023-the-total-economic-impact-of-infoblox-ddi.jpg
www.infoblox.com/wp-content/uploads/ 34 KB
34 KB 901ms
162ms Image
image/jpeg 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.infoblox.com/wp-content/uploads/infoblox-navigation-promo-2023-the-total-economic-impact-of-infoblox-ddi.jpg

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

4d90a12415ab9eec636222e0c8bfd9a579c4fe7cf784b063b6b331107d633de6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-5c5f5
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:25 GMT
age: 230988
x-cache: MISS, HIT, MISS, MISS
expires: Wed, 07 May 2025 13:41:18 GMT
content-length: 34640
x-served-by: cache-chi-kigq8000152-CHI, cache-ams21052-AMS, cache-ams21039-AMS, cache-fra-etou8220071-FRA
last-modified: Wed, 15 Nov 2023 17:15:02 GMT
server: nginx
x-timer: S1715498425.290316,VS0,VE16
etag: "6554fc96-8750"
content-type: image/jpeg
x-styx-req-id: 50f0422f-0bae-11ef-9701-0a542e043f50
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 10248, 0, 0

GET
H2 200 promo-support-portal-menu-v2.jpg
www.infoblox.com/wp-content/uploads/ 62 KB
63 KB 892ms
153ms Image
image/jpeg 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.infoblox.com/wp-content/uploads/promo-support-portal-menu-v2.jpg

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

685032dc6cc8d888d62fc0f0228a47aac0a06f1f468ad7269c7622f83a302d5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 0, 104, 0, 0
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:25 GMT
age: 230986
x-cache: HIT, HIT, MISS, MISS
expires: Sun, 16 Mar 2025 01:43:32 GMT
content-length: 63910
x-served-by: cache-chi-kigq8000161-CHI, cache-ams21030-AMS, cache-ams21044-AMS, cache-fra-etou8220071-FRA
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05
last-modified: Fri, 14 Apr 2023 22:26:18 GMT
server: nginx
x-timer: S1715498425.290353,VS0,VE13
etag: "6439d30a-f9a6"
content-type: image/jpeg
x-styx-req-id: 6e0d6ce2-e26d-11ee-a02b-8edc111b1847
cache-control: max-age=31622400
accept-ranges: bytes
x-pantheon-styx-hostname: styx-fe1-b-844f6bb94f-6hcqt

GET
H2 200 infoblox-whitepaper-independent-research-20-20-visibility-clarifies-network-security-home-page-navigation-promo-v2.jpg
www.infoblox.com/wp-content/uploads/ 30 KB
30 KB 844ms
106ms Image
image/jpeg 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.infoblox.com/wp-content/uploads/infoblox-whitepaper-independent-research-20-20-visibility-clarifies-network-security-home-page-navigation-promo-v2.jpg

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5f9bbcaf6ac8a93b61e3d94ac3639fdff2222c9a4d3f3b8bd4dc2c620331bddb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 0, 10180, 0, 0
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:25 GMT
age: 230987
x-cache: HIT, HIT, MISS, MISS
expires: Fri, 04 Apr 2025 17:23:10 GMT
content-length: 30931
x-served-by: cache-chi-klot8100111-CHI, cache-ams21026-AMS, cache-ams21054-AMS, cache-fra-etou8220071-FRA
backend-ip-port: 6cecXOA5eq1mdycR8IETIO--F_styx_fe1_b_sharedvpc_dmz_05
last-modified: Fri, 14 Apr 2023 22:26:18 GMT
server: nginx
x-timer: S1715498425.290405,VS0,VE12
etag: "6439d30a-78d3"
content-type: image/jpeg
x-styx-req-id: d8374c76-f1de-11ee-b900-62d8d57276c4
cache-control: max-age=31622400
accept-ranges: bytes
x-pantheon-styx-hostname: styx-fe1-b-69554747b9-6v4d5

GET
H2 200 Intersect-cta-graphic.png
www.infoblox.com/wp-content/themes/infoblox-2023/images/ 378 KB
378 KB 894ms
161ms Image
image/png 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.infoblox.com/wp-content/themes/infoblox-2023/images/Intersect-cta-graphic.png

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/wp-content/themes/infoblox-blog/infoblox-custom.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

ec804c0b664c15e3ffe885c3b8101526fe2c386f0bb66eec9066dcea261acf29

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blogs.infoblox.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-6zx56
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:25 GMT
age: 230979
x-cache: MISS, HIT, MISS, MISS
expires: Sat, 10 May 2025 15:10:46 GMT
content-length: 386738
x-served-by: cache-chi-kigq8000085-CHI, cache-ams21053-AMS, cache-ams12753-AMS, cache-fra-etou8220071-FRA
last-modified: Thu, 09 May 2024 15:09:55 GMT
server: nginx
x-timer: S1715498425.290305,VS0,VE14
etag: "663ce743-5e6b2"
content-type: image/png
x-styx-req-id: 501b388f-0e16-11ef-9eb1-3a8be9a6877a
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 8, 0, 0

GET
H2 200 wp-emoji-release.min.js Show response
blogs.infoblox.com/wp-includes/js/ 18 KB
6 KB 57ms
56ms Script
application/x-javascript 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-includes/js/wp-emoji-release.min.js

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-cache-hits: 0, 548, 0
strict-transport-security: max-age=31622400
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:25 GMT
age: 231225
x-cache: MISS, HIT, MISS
x-pantheon-styx-hostname: styx-fe1-b-66d79b4b7-7p2sd
content-length: 5857
x-served-by: cache-chi-klot8100072-CHI, cache-fra-eddf8230124-FRA, cache-fra-etou8220083-FRA
last-modified: Thu, 09 May 2024 15:05:56 GMT
server: nginx
x-timer: S1715498425.317228,VS0,VE9
etag: W/"663ce654-4926"
vary: Accept-Encoding
content-type: application/x-javascript
x-styx-req-id: bd3de39c-0e15-11ef-9e44-6609e5b21e96
cache-control: max-age=31622400
accept-ranges: bytes
expires: Sat, 10 May 2025 15:06:40 GMT

GET
H2 200 l
use.typekit.net/af/71f83c/00000000000000003b9b093b/27/ 33 KB
33 KB 160ms
41ms Font
application/font-woff2 2a02:26f0:7100::1720:ef50
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/71f83c/00000000000000003b9b093b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100::1720:ef50 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: a2b997da567762896061490c3c08e506b2e5b936978560fc12251dd245140b32

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blogs.infoblox.com/
Origin: https://blogs.infoblox.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:25 GMT
server: nginx
etag: "a0f35f91fdc2ca0a90c8288c08c20681c1aecfcf"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 33660

GET
H2 200 l
use.typekit.net/af/86b539/00000000000000003b9b093a/27/ 34 KB
35 KB 220ms
102ms Font
application/font-woff2 2a02:26f0:7100::1720:ef50
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/86b539/00000000000000003b9b093a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i7&v=3
Requested by: Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100::1720:ef50 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 40b87680850d61dff26f2280eaac2487e2261e8771cca1f4eba69dc366cd1fe2

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blogs.infoblox.com/
Origin: https://blogs.infoblox.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:25 GMT
server: nginx
etag: "7419d3e31dff61919238b7104d975fb9f66eb724"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 35128

GET
H2 200 l
use.typekit.net/af/4838bd/00000000000000003b9b0934/27/ 32 KB
32 KB 216ms
100ms Font
application/font-woff2 2a02:26f0:7100::1720:ef50
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/4838bd/00000000000000003b9b0934/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100::1720:ef50 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 9b99ce50d05750058143cb93936075ad5107f9a3e5b03f2d4872c0ebe753a9f7

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blogs.infoblox.com/
Origin: https://blogs.infoblox.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:25 GMT
server: nginx
etag: "852dacc5cd2685c187708b882b28635465e17bd0"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 32688

GET
H2 200 l
use.typekit.net/af/6aec08/00000000000000003b9b0935/27/ 34 KB
34 KB 165ms
50ms Font
application/font-woff2 2a02:26f0:7100::1720:ef50
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/6aec08/00000000000000003b9b0935/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3
Requested by: Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100::1720:ef50 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: a0acc524b541f57df4024b039206425fbcc49c7b3cba369bc0b4a57cfc0e9629

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blogs.infoblox.com/
Origin: https://blogs.infoblox.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:25 GMT
server: nginx
etag: "98ea2e3888e90196090ca6bc7ddc5345e1871a7a"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 34380

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 162ms
44ms Preflight 3.66.255.135
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.66.255.135 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-255-135.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-forwarded-for
Access-Control-Request-Method: GET
Origin: https://blogs.infoblox.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,content-type,x-forwarded-for
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://blogs.infoblox.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Sun, 12 May 2024 07:20:25 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: eu-central-1a
x-trace-id: 2094264219800628867

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 312 KB
103 KB 61ms
60ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-D4JXVXQTYG&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-F7RMF

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a8ab087f9b9387b26e1f331867effa23c3fadd5dd9c7b77d5e8210b76793d028

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 105513
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 12 May 2024 07:20:25 GMT

GET
H2 200 772bac9a-83fb-47c1-818d-7bda3c1f0e56.js Show response
j.6sc.co/j/ 4 KB
2 KB 709ms
465ms Script
application/javascript 84.53.133.138
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/772bac9a-83fb-47c1-818d-7bda3c1f0e56.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-F7RMF
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 84.53.133.138 Madrid, Spain, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a84-53-133-138.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2acbb91b42306467ea03c580e2fa361fcd61fb79d599718c2a949c0dad15c90d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: qcUNagqHUPmA5RGIYIavHgEKMt4vkyig
content-encoding: gzip
date: Sun, 12 May 2024 07:20:26 GMT
x-amz-cf-pop: MAD53-P4
x-amz-server-side-encryption: AES256
x-amz-meta-content-type: application/json
content-length: 1458
pragma: no-cache
last-modified: Mon, 04 Dec 2023 16:45:27 GMT
server: AmazonS3
etag: "a369266ea10e59a9037b2dd9ee1dd541"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: FTFrkV78TGfSsgkcsQt8F8SzuOpf4p-TJivx5nGHesO-AxlnwM7YOw==
expires: Sun, 12 May 2024 07:20:26 GMT

GET
H2 200 5835.js Show response
script.crazyegg.com/pages/scripts/0042/ 6 KB
2 KB 176ms
50ms Script
text/javascript 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0042/5835.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-F7RMF
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 535f1e8f0acb7c4f04fa24122fe140844f1d22e2b69a99efd0aec415fa4ec237

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 112210
cf-polished: origSize=6229
ce-version: 11.5.210
cf-bgj: minify
last-modified: Sat, 11 May 2024 00:10:15 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8828a56819f02c71-FRA

GET
H2 200 main.rtfl.js Show response
visitor.reactful.com/dist/ 275 KB
106 KB 304ms
53ms Script
application/javascript 2a00:1450:4001:810::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://visitor.reactful.com/dist/main.rtfl.js
Requested by: Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:810::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: b4a9abdcbfeca0fdfbde625c8fc01582fde3f1ff5c5189c38d58a6ce2cec061f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 01:49:32 GMT
content-encoding: gzip
server: Google Frontend
age: 19853
etag: "rYMvAw"
content-type: application/javascript; charset=UTF-8
x-cloud-trace-context: f18279b7a57508958a52583f2b6d478e
cache-control: public,public, max-age=432000
content-length: 108588
expires: Fri, 17 May 2024 01:49:32 GMT

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 725 B
708 B 52ms
51ms XHR
application/json 3.66.255.135
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.66.255.135 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-255-135.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: d454566fbbab8fcbc70a1c3139be25be5205712442564fe24a5e0258e3337a98

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
Authorization: Token 482f94f5ef8419c30131ca99e9837fa458cb3174
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
X-Forwarded-For: null
Content-Type: application/json
Referer
sec-ch-ua-platform: "Win32"

Response headers

x-trace-id: 3274632403460617405
date: Sun, 12 May 2024 07:20:25 GMT
content-encoding: gzip
server: nginx
vary: Origin, Accept-Encoding
content-type: application/json
x-6si-region: eu-central-1a
access-control-allow-origin: https://blogs.infoblox.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 387

GET
H2 200 notice Show response
consent.trustarc.com/ 33 KB
11 KB 182ms
79ms Script
text/javascript 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/notice?domain=infoblox.com&c=teconsent&js=nj&noticeType=bb&pcookie&gtm=1&text=true&language=en

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

85209302deaf80a2a3e0f612eee743053c5d1b14e656cde8079dd543fc6830f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Origin: https://blogs.infoblox.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:25 GMT
content-encoding: gzip
via: 1.1 eb1a8c1b1275e33a016e623478052110.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA2-C2
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: max-age=3600
x-amz-cf-id: 3Tbv87ltDbjuyJmNA9us2A5RjS4OjefyISZujSfMQFFfavXrpoHp7g==

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 67 KB
25 KB 208ms
43ms Script
application/x-javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/scripts/bizible.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-F7RMF

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67D4) /

Resource Hash

724ee0d315af0ab32498db3591516c82dce11772cd4153e30fd7b6a40917bec5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:25 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSub
last-modified: Fri, 10 May 2024 05:17:58 GMT
server: ECS (frb/67D4)
age: 36301
etag: "8f37ad6b99a2da1:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 25393

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 144ms
44ms Preflight 3.66.255.135
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.66.255.135 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-255-135.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-forwarded-for
Access-Control-Request-Method: GET
Origin: https://blogs.infoblox.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,content-type,x-forwarded-for
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://blogs.infoblox.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Sun, 12 May 2024 07:20:25 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: eu-central-1a
x-trace-id: 1276990494116842202

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 47 KB
17 KB 226ms
65ms Script
application/javascript 2a02:26f0:780::210:a46a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-F7RMF

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:780::210:a46a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

899d1ec3c095342571d3be2091ec6f984d4cc82390d1f61945c391fa035b00d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 06 May 2024 17:20:18 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=70731
accept-ranges: bytes
content-length: 16683

GET lt-v3.js
lltrck.com/scripts/ 0
0

GET pix.js
des8qu5llanad.cloudfront.net/js/tracker/ 0
0

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 725 B
710 B 99ms
46ms XHR
application/json 3.66.255.135
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.66.255.135 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-255-135.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 09decd6c261342f90598b3c29ef086f2e9cfe4351ba843dfd2f68a3396f47cee

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
Authorization: Token 482f94f5ef8419c30131ca99e9837fa458cb3174
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
X-Forwarded-For: null
Content-Type: application/json
Referer
sec-ch-ua-platform: "Win32"

Response headers

x-trace-id: 7669045193785696532
date: Sun, 12 May 2024 07:20:25 GMT
content-encoding: gzip
server: nginx
vary: Origin, Accept-Encoding
content-type: application/json
x-6si-region: eu-central-1a
access-control-allow-origin: https://blogs.infoblox.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 389

GET
H2 200 tracking.js Show response
trk.techtarget.com/ 3 KB
2 KB 183ms
73ms Script
text/javascript 2606:4700:4400::ac40:973c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.techtarget.com/tracking.js

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:973c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:25 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Tue, 13 Dec 2022 15:01:39 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
age: 56768
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1200
cf-ray: 8828a5681cbb1963-FRA
expires: Sun, 12 May 2024 07:40:25 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
256 B 153ms
48ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-D4JXVXQTYG&gtm=45je4580v888272530z86172957za200&_p=1715498424466&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=285419076.1715498426&ul=de-de&sr=1600x1200&ir=1&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1715498425&sct=1&seg=0&dl=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&dt=VexTrio%20DDGA%20Domains%20Observed%20Spreading%20Adware%2C%20Spyware%2C%20and%20Scam%20Web%20Forms%20%7C%20Infoblox&en=page_view&_fv=1&_nsi=1&_ss=1&ep.cookieDomain=auto&ep.allowLinker=true&tfd=2083
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-D4JXVXQTYG&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:25 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blogs.infoblox.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
256 B 154ms
48ms Ping
text/plain 2a00:1450:400c:c1d::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-D4JXVXQTYG&cid=285419076.1715498426&gtm=45je4580v888272530z86172957za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-D4JXVXQTYG&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c1d::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:25 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blogs.infoblox.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 107ms
53ms Image
image/gif 172.217.23.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-D4JXVXQTYG&cid=285419076.1715498426&gtm=45je4580v888272530z86172957za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&frm=0&z=180891470

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 p.gif
p.typekit.net/ 35 B
205 B 313ms
41ms Image
image/gif 2a02:26f0:7100::1720:ef43
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.typekit.net/p.gif?s=1&k=wks0kwv&ht=tk&h=blogs.infoblox.com&f=139.140.175.176&a=6646607&js=1.21.0&app=typekit&e=js&_=1715498425657
Requested by: Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100::1720:ef43 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:25 GMT
last-modified: Sat, 09 Oct 2021 02:10:03 GMT
server: nginx
etag: "6160f9fb-23"
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 35

GET
H2 200 blogs.infoblox.com.json Show response
script.crazyegg.com/pages/data-scripts/0042/5835/site/ 85 KB
9 KB 140ms
54ms XHR
application/json 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0042/5835/site/blogs.infoblox.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0042/5835.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 68d587586668442fec1aba02e2f1106cba96923d9045b4f9e952d9266e0094b4

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 88703
ce-version: 11.5.210
content-length: 8914
last-modified: Sat, 11 May 2024 06:42:02 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8828a5690d081c9f-FRA

GET
H2 200 get
consent.trustarc.com/ Frame E415 0
0 133ms
41ms Document
text/html 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/get?name=crossdomain.html&domain=infoblox.com

Requested by

Host: consent.trustarc.com
URL: https://consent.trustarc.com/notice?domain=infoblox.com&c=teconsent&js=nj&noticeType=bb&pcookie&gtm=1&text=true&language=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

age: 1590
cache-control: max-age=2592000
content-encoding: gzip
content-type: text/html
date: Sun, 12 May 2024 06:53:55 GMT
pragma: public
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding Origin
via: 1.1 2fcedcc055e24d7ac99fbc19ed8fc8ec.cloudfront.net (CloudFront)
x-amz-cf-id: ghKABywbla-3gABQXDtxczi2JVYMhnQV3mnFZ3-noclEfqsFzRqojQ==
x-amz-cf-pop: FRA2-C2
x-cache: Hit from cloudfront

GET
H2 200 v1.7-3281 Show response
consent.trustarc.com/asset/notice.js/v/ 93 KB
27 KB 50ms
46ms Script
text/javascript 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/asset/notice.js/v/v1.7-3281

Requested by

Host: consent.trustarc.com
URL: https://consent.trustarc.com/notice?domain=infoblox.com&c=teconsent&js=nj&noticeType=bb&pcookie&gtm=1&text=true&language=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

5eeb76abbd17b81bc8a7f6722be1f0b980897bce2c1fe38bbe9f126573486d25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Origin: https://blogs.infoblox.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: public
date: Sun, 12 May 2024 06:33:05 GMT
content-encoding: gzip
via: 1.1 eb1a8c1b1275e33a016e623478052110.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 2 May 2024 01:55:11 GMT
x-amz-cf-pop: FRA2-C2
age: 2841
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: max-age=2592000
x-amz-cf-id: LWIWA-yqKIHYhcpobWLD0aDhTh5CspLK6XR1CXk2hJ36nDkSbFeWdw==

GET
H2 200 log
consent.trustarc.com/ 43 B
1 KB 157ms
70ms Image
image/gif 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent.trustarc.com/log?domain=infoblox.com&country=de&state=&behavior=implied&session=4c8153aa-7a18-4fb5-aebd-d59fa4edffcd&userType=NEW&c=4b95

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'; frame-ancestors https://.trustarc.com https://.prod.internal.trustarc.com https://.trustarc.eu https://.prod.internal.trustarc.eu https://.staging.internal.trustarc.com https://.trustarc-svc.net https://.truste-svc.net https://.qa.truste-svc.net https://.dev.truste-svc.net http://localhost: https://.nymity.com https://.qanym;; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp-reporter.tools.trustarc-svc.net/report
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:25 GMT
content-security-policy: object-src 'none'; frame-ancestors https://*.trustarc.com https://*.prod.internal.trustarc.com https://*.trustarc.eu https://*.prod.internal.trustarc.eu https://*.staging.internal.trustarc.com https://*.trustarc-svc.net https://*.truste-svc.net https://*.qa.truste-svc.net https://*.dev.truste-svc.net http://localhost:* https://*.nymity.com https://*.qanym;; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp-reporter.tools.trustarc-svc.net/report
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e1e056e45a0f8d6bc22b223900511170.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: FRA2-C2
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
cross-origin-opener-policy: cross-origin
expect-ct: enforce, max-age=60
x-frame-options: SAMEORIGIN
vary: Origin
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: geolocation=(), camera=(), speaker=(), microphone=(), vibrate=()
x-amz-cf-id: gtrcOfVkW3ewGi473aOES-_uk95IRlMjkk_g24FgtwOUpqe18jsWGw==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 gif.gif Show response
ibc-flow.techtarget.com/a/ 43 B
456 B 156ms
154ms XHR
image/gif 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1253438&r=1715498425723&ref=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&version=2.4
Requested by: Host: trk.techtarget.com
URL: https://trk.techtarget.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

ibc_rate_tier: 1253438
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:26 GMT
via: 1.1 google
x-guploader-uploadid: ABPtcPpIS67JuQqPye9IoHiJiow62pvDL9HsZ9ft0NT9pFVLloIfRG7dntCyICCDd3uTfcIY5S_DTiyYJQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
last-modified: Thu, 08 Dec 2022 21:19:29 GMT
server: nginx/1.20.2
etag: "fc94fb0c3ed8a8f909dbc7630a0987ff"
vary: Origin
x-goog-generation: 1670534369365034
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
cache-control: public, max-age=3600
access-control-allow-methods: GET, POST, OPTIONS
x-goog-stored-content-length: 43
accept-ranges: bytes
access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
expires: Sun, 12 May 2024 08:20:26 GMT

OPTIONS
H2 200 gif.gif
ibc-flow.techtarget.com/a/ Frame 0
0 350ms
148ms Preflight
text/html 34.111.208.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=1253438&r=1715498425723&ref=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&version=2.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.208.111.34.bc.googleusercontent.com
Software: nginx/1.20.2 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: ibc_rate_tier
Access-Control-Request-Method: GET
Origin: https://blogs.infoblox.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 12 May 2024 07:20:26 GMT
expires: Sun, 12 May 2024 07:20:26 GMT
server: nginx/1.20.2
vary: Origin
via: 1.1 google
x-guploader-uploadid: ABPtcPor4dy6eTWIyY6nPkvAMQSIL0KYwq77XJn70YjJgLMElqpYmnrg_wiERNXPzKZSkE07rDWUAWeFrQ

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=32346&time=1715498425727&url=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-s...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=32346&time=1715498425727&url=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-...

0
265 B

382ms
250ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=32346&time=1715498425727&url=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&e_ipv6=AQI1JaNuqRfv-QAAAY9rrJ62L52Kc_p-cfYxmm2JIzPFTvu3Rx8FZIX3vLB5tz6-u_b8_-XR
Requested by: Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Sun, 12 May 2024 07:20:26 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 38CB3C636BED4F3C99A7F82F369450DC Ref B: FRAEDGE1414 Ref C: 2024-05-12T07:20:26Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYYPJpRJi6c1fzirV9uRQ==

Redirect headers

date: Sun, 12 May 2024 07:20:26 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: E92A2373AFB64B5BB9B8A930749C4CC7 Ref B: FRAEDGE1410 Ref C: 2024-05-12T07:20:25Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=32346&time=1715498425727&url=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&e_ipv6=AQI1JaNuqRfv-QAAAY9rrJ62L52Kc_p-cfYxmm2JIzPFTvu3Rx8FZIX3vLB5tz6-u_b8_-XR
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYYPJpL3vBQqudaOa6E5w==

GET
H2 200 2e23b996f30aa45a4331ff625e76329e.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 95 KB
31 KB 49ms
49ms Script
text/javascript 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/2e23b996f30aa45a4331ff625e76329e.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0042/5835.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dd63265ed07d13fa2b0422ae4b2324ba4a8ff29bf5460b90c09d7cdaa8bd568b

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:25 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 30 Apr 2024 18:50:58 GMT
server: cloudflare
age: 117041
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8828a5696b102c71-FRA
content-length: 31432

OPTIONS
H2 200 /
visitor.reactful.com/config/247745/ Frame 0
0 405ms
312ms Preflight
text/javascript 2a00:1450:4001:810::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://visitor.reactful.com/config/247745/?page=%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&hash=&referer=&user_id=&hshkgid=c7cdb49a-4923-4d2a-aafd-86bf9e745bb0&cb_rtfl=_rtfl_jsonp_0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:810::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: six-sense-data,url-params-data
Access-Control-Request-Method: GET
Origin: https://blogs.infoblox.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Six-Sense-Data, Custom-Vars-Data, Url-Params-Data
access-control-allow-methods: GET
access-control-allow-origin: https://blogs.infoblox.com
cache-control: no-cache
content-length: 0
content-type: text/javascript
date: Sun, 12 May 2024 07:20:26 GMT
expires: Sun, 12 May 2024 07:20:26 GMT
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
server: Google Frontend
x-cloud-trace-context: c2a519f7c948ad1b225084b06fc5cb1b

GET
H2 200 / Show response
visitor.reactful.com/config/247745/ 911 B
788 B 679ms
678ms XHR
text/html 2a00:1450:4001:810::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://visitor.reactful.com/config/247745/?page=%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&hash=&referer=&user_id=&hshkgid=c7cdb49a-4923-4d2a-aafd-86bf9e745bb0&cb_rtfl=_rtfl_jsonp_0
Requested by: Host: visitor.reactful.com
URL: https://visitor.reactful.com/dist/main.rtfl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:810::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: e9f98a22a9c2b3d07f045d2ded3da0622f8d06f666609e3e0a65986d3f8081e1

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer
Six-Sense-Data: eyJjb21wYW55Ijp7ImRvbWFpbiI6IiIsIm5hbWUiOiIiLCJyZWdpb24iOiIiLCJjb3VudHJ5IjoiR2VybWFueSIsInN0YXRlIjoiQmVybGluIiwiY2l0eSI6IkJlcmxpbiIsImluZHVzdHJ5IjoiIiwiY291bnRyeV9pc29fY29kZSI6IkRFIiwiYWRkcmVzcyI6IiIsInppcCI6IiIsInBob25lIjoiIiwiZW1wbG95ZWVfcmFuZ2UiOiIiLCJyZXZlbnVlX3JhbmdlIjoiIiwiZW1wbG95ZWVfY291bnQiOiIiLCJhbm51YWxfcmV2ZW51ZSI6IiIsImlzX2JsYWNrbGlzdGVkIjpmYWxzZSwic3RhdGVfY29kZSI6IiIsImlzXzZxYSI6ZmFsc2UsImdlb0lQX2NvdW50cnkiOiJHZXJtYW55IiwiZ2VvSVBfc3RhdGUiOiJCZXJsaW4iLCJnZW9JUF9jaXR5IjoiQmVybGluIiwiY29tcGFueV9tYXRjaCI6Ik5vbi1hY3Rpb25hYmxlIE1hdGNoIiwiYWRkaXRpb25hbF9jb21tZW50IjoiVGhlcmUgaXMgbm8gdmFsaWQgQjJCIHVzZSBjYXNlIGFzIHRoaXMgd2FzIG1hdGNoZWQgdG8gc29tZXRoaW5nIG90aGVyIHRoYW4gYSBjb21wYW55IG5hbWUvZG9tYWluIChpLmUuIGJvdCwgaG9zdCwgbm9pc3kgc2lnbmFsLCBldGMuKSIsIm5haWNzIjoiIiwibmFpY3NfZGVzY3JpcHRpb24iOiIiLCJzaWMiOiIiLCJpbmR1c3RyeV92MiI6W10sInNpY19kZXNjcmlwdGlvbiI6IiJ9LCJzY29yZXMiOltdLCJzZWdtZW50cyI6W10sImNvbmZpZGVuY2UiOiJOQSJ9
Url-Params-Data: e30=
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:26 GMT
content-encoding: gzip
server: Google Frontend
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: https://blogs.infoblox.com
content-type: text/html; charset=utf-8
cache-control: no-cache
access-control-allow-credentials: true
x-cloud-trace-context: 135d80d75134da91a016277ce2d028a7
access-control-allow-headers: Six-Sense-Data,Custom-Vars-Data,Url-Params-Data
content-length: 465
expires: Sun, 12 May 2024 07:20:26 GMT

GET
H2 200 blogs.infoblox.com.json Show response
script.crazyegg.com/pages/data-scripts/0042/5835/sampling/ 158 B
238 B 54ms
53ms XHR
application/json 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0042/5835/sampling/blogs.infoblox.com.json?t=476527
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/2e23b996f30aa45a4331ff625e76329e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aeca7cb7462506fd077810dbd1ccd58af233fd5ef2f02cfecbc22138cdd2e4e2

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 8062
ce-version: 11.5.210
content-length: 146
last-modified: Sun, 12 May 2024 05:06:03 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8828a56a4e2e1c9f-FRA

GET
H2 200 get
consent.trustarc.com/ 61 KB
62 KB 47ms
47ms Font
application/octet-stream 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/get?name=MuseoSans-300.otf

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

ecc24f40f565ce3d863f4ab0fe3258c6d92ca796776a4cae7d68fb52fdddeb7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blogs.infoblox.com/
Origin: https://blogs.infoblox.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: public
date: Sun, 12 May 2024 06:29:07 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052110.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA2-C2
age: 3079
x-cache: Hit from cloudfront
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: max-age=2592000
content-length: 62924
x-amz-cf-id: 3FKCiEZgTgdlC8Hd7f0Uhtiiu2CDXzrVQkQVoRKlKh-ft27KC0EXGQ==

GET
H2 200 get
consent.trustarc.com/ 62 KB
62 KB 87ms
87ms Font
application/octet-stream 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/get?name=MuseoSans_700.otf

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

c36ca8cd5566c156e23f38dde55efa9767270c732ddcb7ed915ea44b2295601e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blogs.infoblox.com/
Origin: https://blogs.infoblox.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: public
date: Sun, 12 May 2024 07:00:35 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052110.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA2-C2
age: 1191
x-cache: Hit from cloudfront
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: max-age=2592000
content-length: 63568
x-amz-cf-id: OVbSgdssbPCN-dGPqUWREMVUUg6Z9WZnaEJ6H16RwGNDSxJfsvzcRw==

GET
H2 200 bannermsg
consent.trustarc.com/ 43 B
1 KB 71ms
71ms Image
image/gif 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent.trustarc.com/bannermsg?action=views&domain=infoblox.com&behavior=implied&country=de&language=en&rand=0.0785359953833975&session=4c8153aa-7a18-4fb5-aebd-d59fa4edffcd&userType=NEW

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'; frame-ancestors https://.trustarc.com https://.prod.internal.trustarc.com https://.trustarc.eu https://.prod.internal.trustarc.eu https://.staging.internal.trustarc.com https://.trustarc-svc.net https://.truste-svc.net https://.qa.truste-svc.net https://.dev.truste-svc.net http://localhost: https://.nymity.com https://.qanym;; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp-reporter.tools.trustarc-svc.net/report
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:26 GMT
content-security-policy: object-src 'none'; frame-ancestors https://*.trustarc.com https://*.prod.internal.trustarc.com https://*.trustarc.eu https://*.prod.internal.trustarc.eu https://*.staging.internal.trustarc.com https://*.trustarc-svc.net https://*.truste-svc.net https://*.qa.truste-svc.net https://*.dev.truste-svc.net http://localhost:* https://*.nymity.com https://*.qanym;; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp-reporter.tools.trustarc-svc.net/report
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e1e056e45a0f8d6bc22b223900511170.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: none
x-amz-cf-pop: FRA2-C2
cross-origin-embedder-policy: unsafe-none
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
cross-origin-opener-policy: cross-origin
expect-ct: enforce, max-age=60
x-frame-options: SAMEORIGIN
vary: Origin
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: geolocation=(), camera=(), speaker=(), microphone=(), vibrate=()
x-amz-cf-id: iyfjMZ1Z8pctQaJcXlYTigpmb_WRla0lnC-h9Qo-zHnysXWqFe34sw==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 healthcheck Show response
pagestates-tracking.crazyegg.com/ 19 B
462 B 137ms
41ms XHR
application/json 13.35.58.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pagestates-tracking.crazyegg.com/healthcheck
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/2e23b996f30aa45a4331ff625e76329e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.58.128 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-58-128.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 20 Sep 2023 01:43:28 GMT
via: 1.1 83f879b9257b55a619d0b5d3165412a6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P10
age: 20324219
x-cache: Hit from cloudfront
content-length: 19
last-modified: Fri, 08 Jul 2022 22:25:51 GMT
server: AmazonS3
etag: "d06f04fccf68d0b228a5923187ce1afd"
access-control-max-age: 31536000
access-control-allow-methods: GET, HEAD
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin
accept-ranges: bytes
x-amz-cf-id: pLkyuD6ACX6etoO2_5vRl15gJYgD-A_itIk7XX6K-Npi9V8-DxvOEQ==

GET
H2 200 healthcheck Show response
assets-tracking.crazyegg.com/ 19 B
460 B 140ms
41ms XHR
application/json 18.66.122.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-tracking.crazyegg.com/healthcheck
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/2e23b996f30aa45a4331ff625e76329e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.74 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-74.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 20 Dec 2023 01:23:29 GMT
via: 1.1 4b07e670df891a80bcae1d5be052af3c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 12463018
x-cache: Hit from cloudfront
content-length: 19
last-modified: Fri, 08 Jul 2022 22:25:51 GMT
server: AmazonS3
etag: "d06f04fccf68d0b228a5923187ce1afd"
access-control-max-age: 31536000
access-control-allow-methods: GET, HEAD
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin
accept-ranges: bytes
x-amz-cf-id: etsh2ayNjxKHqatwJGKY_924T_Sw6fqA-5GFzn5-y8bqxOd8m2KO6A==

GET
BLOB 200
OK dd804d5c-69a2-4791-bc50-5b34c7123b17
https://blogs.infoblox.com/ 45 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://blogs.infoblox.com/dd804d5c-69a2-4791-bc50-5b34c7123b17
Requested by: Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Length: 45
Content-Type: text/javascript

GET
H2 200 6si.min.js Show response
j.6sc.co/ 66 KB
18 KB 66ms
66ms Script
application/javascript 84.53.133.138
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/772bac9a-83fb-47c1-818d-7bda3c1f0e56.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

84.53.133.138 Madrid, Spain, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a84-53-133-138.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dc93c5b3243e66c7b2e27c51b76fa6a11bd7a6d7546c5fa26bbffa001f885305

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 09 May 2024 06:01:25 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "663c66b5-106b3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 18038
expires: Sun, 12 May 2024 07:20:26 GMT

GET
H2 200 ipv
cdn.bizible.com/ 43 B
327 B 41ms
41ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizible.com/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=eb4720fc55794352e84f64613ed233ff&_biz_l=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&_biz_t=1715498426183&_biz_i=VexTrio%20DDGA%20Domains%20Observed%20Spreading%20Adware%2C%20Spyware%2C%20and%20Scam%20Web%20Forms%20%7C%20Infoblox&_biz_n=0&rnd=149924&cdn_o=a&_biz_z=1715498426185

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67BA) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:26 GMT
strict-transport-security: max-age=31536000; includeSub
last-modified: Fri, 10 May 2024 21:15:25 GMT
server: ECS (frb/67BA)
age: 122701
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H2 200 u
cdn.bizibly.com/ 43 B
181 B 53ms
40ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizibly.com/u?_biz_u=eb4720fc55794352e84f64613ed233ff&_biz_l=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&_biz_t=1715498426190&_biz_i=VexTrio%20DDGA%20Domains%20Observed%20Spreading%20Adware%2C%20Spyware%2C%20and%20Scam%20Web%20Forms%20%7C%20Infoblox&rnd=996799&cdn_o=a&_biz_z=1715498426190

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6752) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:26 GMT
strict-transport-security: max-age=31536000; includeSub
last-modified: Fri, 10 May 2024 21:15:25 GMT
server: ECS (frb/6752)
age: 122701
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/gif
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H2 200 clock Show response
tracking.crazyegg.com/ 38 B
145 B 216ms
85ms XHR
text/plain 54.195.89.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?t=1715498426194&tk=94c1298a9befcde50aad42a699da8ca2&s=237558&p=%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&u=425835&v=5adfa4f0654ed215b9ae829436e69c2e9ba917f2&f=blogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms&ul=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.195.89.156 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-195-89-156.eu-west-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: 192c65c1ab99993da5595f9e6ab27fe04aac5bd5e0515ce076e2b1f1e600fcef

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
date: Sun, 12 May 2024 07:20:26 GMT
cache-control: no-store
server: awselb/2.0
content-length: 38
content-type: text/plain

GET
BLOB 200
OK d115c72b-01f2-4f66-9631-439b8b2560f1
https://blogs.infoblox.com/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://blogs.infoblox.com/d115c72b-01f2-4f66-9631-439b8b2560f1
Requested by: Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Length: 43
Content-Type: image/gif

GET
H2 200 xdc.js Show response
cdn.bizible.com/ 79 B
291 B 159ms
158ms Script
text/javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/xdc.js?_biz_u=eb4720fc55794352e84f64613ed233ff&_biz_h=-1906410348&cdn_o=a&jsVer=4.24.05.09

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.195.15.58 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6711) /

Resource Hash

f920491d697fadb52d78fdb399b4bab60ef9bb6f42b73daa90279a4a93ae63a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:26 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSub
server: ECS (frb/6711)
etag: AA04BD74
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: text/javascript; charset=utf-8
cache-control: private, must-revalidate, max-age=21600
content-length: 183

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
701 B 162ms
46ms XHR
application/json 37.252.171.149
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.149 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:26 GMT
an-x-request-uuid: 47f4d150-c59b-4e2a-848a-7ce0a8efc3f3
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://blogs.infoblox.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.7.123; 80.255.7.123; 984.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 11
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
195 B 94ms
69ms XHR
text/html 84.53.133.138
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 84.53.133.138 Madrid, Spain, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a84-53-133-138.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:26 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://blogs.infoblox.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 20 B
313 B 206ms
42ms XHR
text/html 2a02:26f0:480:23::1726:629c
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:23::1726:629c Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: d83f73562c5fedb0c3086617e16fd47c91832f0de8d01fcc638dc2ed0c8bd978

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:26 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://blogs.infoblox.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a01:4a0:1338:93::11
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715498426369_388391900_738224231_24_1149_40_83_219";dur=1
content-length: 20
expires: Sun, 12 May 2024 07:20:26 GMT

GET
H2 200 dda53996456118190a640875fa0663b1.js Show response
script.crazyegg.com/pages/versioned/trackingpagestate-scripts/ 20 KB
8 KB 59ms
58ms Script
text/javascript 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/trackingpagestate-scripts/dda53996456118190a640875fa0663b1.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0042/5835.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ac3da9cfd5c1a08a07b9b3a69d4baf42d25ff62dcc6b65789b94a770091fe30

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:26 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 08 May 2024 20:11:58 GMT
server: cloudflare
age: 117043
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8828a56d8f422c71-FRA
content-length: 8015

GET
BLOB 200
OK 002ceba3-a1bf-4680-8cc7-ebbd95bf05cf
https://blogs.infoblox.com/ 241 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://blogs.infoblox.com/002ceba3-a1bf-4680-8cc7-ebbd95bf05cf
Requested by: Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 49dd51efa6cf7deacbe8ffc88e4d1149f6a69a5d6da403ea5f97dda990a0fe00

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Length: 241
Content-Type: text/javascript

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 323ms
172ms Image
image/gif 84.53.133.138
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=65a5821f1ffef41888301786d2737e6c&svisitor=null&visitor=eecc2cd3-c20f-4f8b-8e1e-662abaa8e73c&session=2dab7815-d005-4830-8ea0-aa8b8340c193&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Sun%2C%2012%20May%202024%2007%3A20%3A26%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20VexTrio%20DDGA%20is%20being%20used%20by%20malicious%20actors%20who%20take%20advantage%20of%20cheap%2C%20private%20domain%20registrations%20to%20create%20complex%20attack%20infrastructure%20that%20remain%20undetected%20for%20a%20long%20time.%20Learn%20about%20it%20in%20this%20comprehensive%20report.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VexTrio%20DDGA%20Domains%20Observed%20Spreading%20Adware%2C%20Spyware%2C%20and%20Scam%20Web%20Forms%20%7C%20Infoblox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&pageViewId=ed0d5ff8-25fc-49aa-8cc8-cdd960a5a0ce&an_uid=0&webTagId=772bac9a-83fb-47c1-818d-7bda3c1f0e56&v=1.1.20

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

84.53.133.138 Madrid, Spain, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a84-53-133-138.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:26 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sun, 12 May 2024 07:20:26 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 317ms
166ms Image
image/gif 84.53.133.138
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=65a5821f1ffef41888301786d2737e6c&svisitor=null&visitor=eecc2cd3-c20f-4f8b-8e1e-662abaa8e73c&session=2dab7815-d005-4830-8ea0-aa8b8340c193&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%2265a5821f1ffef41888301786d2737e6c%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2012%20May%202024%2007%3A20%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2012%20May%202024%2007%3A20%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%229052c9c10fd26409839ad846d89224303dc5fc60%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2012%20May%202024%2007%3A20%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2012%20May%202024%2007%3A20%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2012%20May%202024%2007%3A20%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2012%20May%202024%2007%3A20%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2012%20May%202024%2007%3A20%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2012%20May%202024%2007%3A20%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%22772bac9a-83fb-47c1-818d-7bda3c1f0e56%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2012%20May%202024%2007%3A20%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2012%20May%202024%2007%3A20%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2012%20May%202024%2007%3A20%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableMapCookieCapture%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2012%20May%202024%2007%3A20%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2012%20May%202024%2007%3A20%3A26%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20VexTrio%20DDGA%20is%20being%20used%20by%20malicious%20actors%20who%20take%20advantage%20of%20cheap%2C%20private%20domain%20registrations%20to%20create%20complex%20attack%20infrastructure%20that%20remain%20undetected%20for%20a%20long%20time.%20Learn%20about%20it%20in%20this%20comprehensive%20report.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VexTrio%20DDGA%20Domains%20Observed%20Spreading%20Adware%2C%20Spyware%2C%20and%20Scam%20Web%20Forms%20%7C%20Infoblox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&pageViewId=ed0d5ff8-25fc-49aa-8cc8-cdd960a5a0ce&an_uid=0&webTagId=772bac9a-83fb-47c1-818d-7bda3c1f0e56&v=1.1.20

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

84.53.133.138 Madrid, Spain, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a84-53-133-138.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:26 GMT
x-content-type-options: nosniff
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sun, 12 May 2024 07:20:26 GMT

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 725 B
709 B 132ms
48ms XHR
application/json 3.66.255.135
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.66.255.135 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-255-135.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: d454566fbbab8fcbc70a1c3139be25be5205712442564fe24a5e0258e3337a98

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
Authorization: Token 9052c9c10fd26409839ad846d89224303dc5fc60
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
X-6s-CustomID: WebTag 772bac9a-83fb-47c1-818d-7bda3c1f0e56
Referer
sec-ch-ua-platform: "Win32"

Response headers

x-trace-id: 1998619426832281433
date: Sun, 12 May 2024 07:20:26 GMT
content-encoding: gzip
server: nginx
vary: Origin, Accept-Encoding
content-type: application/json
x-6si-region: eu-central-1a
access-control-allow-origin: https://blogs.infoblox.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 387

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 43ms
42ms Preflight 3.66.255.135
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.66.255.135 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-255-135.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://blogs.infoblox.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://blogs.infoblox.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Sun, 12 May 2024 07:20:26 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: eu-central-1a
x-trace-id: 1209303357044742883

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 306ms
165ms Image
image/gif 84.53.133.138
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=65a5821f1ffef41888301786d2737e6c&svisitor=null&visitor=eecc2cd3-c20f-4f8b-8e1e-662abaa8e73c&session=2dab7815-d005-4830-8ea0-aa8b8340c193&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A93%3A%3A11%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20VexTrio%20DDGA%20is%20being%20used%20by%20malicious%20actors%20who%20take%20advantage%20of%20cheap%2C%20private%20domain%20registrations%20to%20create%20complex%20attack%20infrastructure%20that%20remain%20undetected%20for%20a%20long%20time.%20Learn%20about%20it%20in%20this%20comprehensive%20report.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VexTrio%20DDGA%20Domains%20Observed%20Spreading%20Adware%2C%20Spyware%2C%20and%20Scam%20Web%20Forms%20%7C%20Infoblox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&pageViewId=ed0d5ff8-25fc-49aa-8cc8-cdd960a5a0ce&an_uid=0&webTagId=772bac9a-83fb-47c1-818d-7bda3c1f0e56&v=1.1.20

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

84.53.133.138 Madrid, Spain, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a84-53-133-138.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:26 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sun, 12 May 2024 07:20:26 GMT

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
197 B 219ms
218ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: *
Referer
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:26 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 6EC2AB7BD6B44E90ABB0C060B5B14DDD Ref B: FRAEDGE1410 Ref C: 2024-05-12T07:20:26Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
access-control-allow-origin: https://blogs.infoblox.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYYPJpVBppxypcVIjsnfw==

GET
H2 200 bd3cf4fdad82d5b7119c9bb8c5d92327.js Show response
script.crazyegg.com/pages/versioned/tracking-scripts/ 95 KB
30 KB 49ms
49ms Script
text/javascript 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/tracking-scripts/bd3cf4fdad82d5b7119c9bb8c5d92327.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0042/5835.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ef774bedbe77e522d4744a3309c90dbbc745df5253eb4972485898ba8ccf9bdd

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:26 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 08 May 2024 20:11:55 GMT
server: cloudflare
age: 117042
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8828a56dff952c71-FRA
content-length: 30761

GET
H2 200 nr-rum-1.259.0.min.js Show response
js-agent.newrelic.com/ 50 KB
17 KB 130ms
40ms Script
application/javascript 2602:816:5001::39
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-rum-1.259.0.min.js

Requested by

Host: blogs.infoblox.com
URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2602:816:5001::39 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

ee0479b1679cab0a529e7ad7ee5eaa2cbeba64b35d07cfaa669565314d5abd2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Origin: https://blogs.infoblox.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: PXxRwWE67J7UtCe1Uge_eTeAnBy2P711
content-encoding: br
via: 1.1 varnish
date: Sun, 12 May 2024 07:20:26 GMT
strict-transport-security: max-age=300
x-amz-request-id: K6PXMD9VRYTAQPJS
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 17401
x-amz-id-2: QQz1K4rLxQyMnM//Gt/APzp/LGaz9j2zdOEr3eCxtyIZsKvd5uu6vpQgUr8S9UrROwaVepbTfJ0=
x-served-by: cache-cph2320044-CPH
last-modified: Wed, 08 May 2024 16:12:10 GMT
server: AmazonS3
etag: "396af382d45bc1644e0b8215ba7c42b3"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 36853

GET
H2 200 infoblox-favicon.png
blogs.infoblox.com/wp-content/uploads/ 769 B
1 KB 60ms
60ms Other
image/png 2a04:4e42:8e::765
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.infoblox.com/wp-content/uploads/infoblox-favicon.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:8e::765 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

2497fed5d20961b72c0464044bdce3efa2cf1d11fbd458d8344f36ad0e2141b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31622400

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-pantheon-styx-hostname: styx-fe1-a-867f44b44b-z9kn6
strict-transport-security: max-age=31622400
via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date: Sun, 12 May 2024 07:20:26 GMT
age: 231231
x-cache: HIT, HIT, MISS, MISS
expires: Thu, 01 May 2025 14:02:29 GMT
content-length: 769
x-served-by: cache-chi-kigq8000085-CHI, cache-ams21045-AMS, cache-ams12734-AMS, cache-fra-etou8220083-FRA
last-modified: Wed, 17 Apr 2024 16:23:24 GMT
server: nginx
x-timer: S1715498427.839549,VS0,VE13
etag: "661ff77c-301"
content-type: image/png
x-styx-req-id: 482d2a83-06fa-11ef-b06b-3246cedab68e
cache-control: max-age=31622400
accept-ranges: bytes
x-cache-hits: 0, 49, 0, 0

POST
H/1.1 200
OK NRJS-6edc3240d96015af6f2 Show response
bam.nr-data.net/1/ 150 B
699 B 477ms
381ms XHR
text/plain 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-6edc3240d96015af6f2?a=564313520&v=1.259.0&to=bwEDMBNWWUICWkxeW1ZLIAcVXlhfTEpRWVNUAQ%3D%3D&rst=3406&ck=0&s=92b13860ad1ebb55&ref=https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/&ptid=d140def3d3b227dc&ap=1223&be=695&fe=2559&dc=1066&at=Q0YARltMSkw%3D&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1715498423542,%22n%22:0,%22r%22:0,%22re%22:536,%22f%22:536,%22dn%22:536,%22dne%22:536,%22c%22:536,%22s%22:536,%22ce%22:536,%22rq%22:539,%22rp%22:695,%22rpe%22:757,%22di%22:1748,%22ds%22:1748,%22de%22:1761,%22dc%22:3250,%22l%22:3250,%22le%22:3254%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=1113&fcp=1113
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fa73690522b04e6df899152023bbd9f87577f8507e96c5bda8e309eca2b0ff9d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
content-type: text/plain

Response headers

Date: Sun, 12 May 2024 07:20:27 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Transfer-Encoding: chunked
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://blogs.infoblox.com
access-control-expose-headers: Date
Vary: Accept-Encoding
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
Connection: keep-alive
CF-Ray: 8828a5712cd96a74-TXL
timing-allow-origin: https://blogs.infoblox.com

GET
BLOB 200
OK 86b409d2-4a8b-4db0-b579-b5be1896ae31 Show response
https://blogs.infoblox.com/ 911 B
0 Script
text/html

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://blogs.infoblox.com/86b409d2-4a8b-4db0-b579-b5be1896ae31
Requested by: Host: visitor.reactful.com
URL: https://visitor.reactful.com/dist/main.rtfl.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e9f98a22a9c2b3d07f045d2ded3da0622f8d06f666609e3e0a65986d3f8081e1

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Length: 911
Content-Type: text/html

POST
H2 200 / Show response
tracking.reactful.com/tracking/247745/ 6 B
117 B 254ms
218ms XHR
text/html 2a00:1450:4001:810::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.reactful.com/tracking/247745/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:810::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: cf8646fc48648f5a6d806df8f757007e6398a55ddccc3d8c2046a4c014cf1b56

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
Referer
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 12 May 2024 07:20:27 GMT
content-encoding: gzip
server: Google Frontend
vary: Accept-Encoding
content-type: text/html; charset=utf-8
access-control-allow-origin: *
x-cloud-trace-context: 7a529ef89c85d415682c6b6617f7e01e
cache-control: no-cache
content-length: 26

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 166ms
165ms Image
image/gif 84.53.133.138
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=65a5821f1ffef41888301786d2737e6c&svisitor=null&visitor=eecc2cd3-c20f-4f8b-8e1e-662abaa8e73c&session=2dab7815-d005-4830-8ea0-aa8b8340c193&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2012%20May%202024%2007%3A20%3A27%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2012%20May%202024%2007%3A20%3A26%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20VexTrio%20DDGA%20is%20being%20used%20by%20malicious%20actors%20who%20take%20advantage%20of%20cheap%2C%20private%20domain%20registrations%20to%20create%20complex%20attack%20infrastructure%20that%20remain%20undetected%20for%20a%20long%20time.%20Learn%20about%20it%20in%20this%20comprehensive%20report.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VexTrio%20DDGA%20Domains%20Observed%20Spreading%20Adware%2C%20Spyware%2C%20and%20Scam%20Web%20Forms%20%7C%20Infoblox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&pageViewId=ed0d5ff8-25fc-49aa-8cc8-cdd960a5a0ce&an_uid=0&webTagId=772bac9a-83fb-47c1-818d-7bda3c1f0e56&v=1.1.20

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

84.53.133.138 Madrid, Spain, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a84-53-133-138.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:27 GMT
x-content-type-options: nosniff
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sun, 12 May 2024 07:20:27 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 173ms
173ms Image
image/gif 84.53.133.138
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=65a5821f1ffef41888301786d2737e6c&svisitor=null&visitor=eecc2cd3-c20f-4f8b-8e1e-662abaa8e73c&session=2dab7815-d005-4830-8ea0-aa8b8340c193&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2012%20May%202024%2007%3A20%3A28%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2012%20May%202024%2007%3A20%3A27%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222004%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20VexTrio%20DDGA%20is%20being%20used%20by%20malicious%20actors%20who%20take%20advantage%20of%20cheap%2C%20private%20domain%20registrations%20to%20create%20complex%20attack%20infrastructure%20that%20remain%20undetected%20for%20a%20long%20time.%20Learn%20about%20it%20in%20this%20comprehensive%20report.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VexTrio%20DDGA%20Domains%20Observed%20Spreading%20Adware%2C%20Spyware%2C%20and%20Scam%20Web%20Forms%20%7C%20Infoblox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&pageViewId=ed0d5ff8-25fc-49aa-8cc8-cdd960a5a0ce&an_uid=0&webTagId=772bac9a-83fb-47c1-818d-7bda3c1f0e56&v=1.1.20

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

84.53.133.138 Madrid, Spain, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a84-53-133-138.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:28 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sun, 12 May 2024 07:20:28 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 166ms
165ms Image
image/gif 84.53.133.138
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=65a5821f1ffef41888301786d2737e6c&svisitor=null&visitor=eecc2cd3-c20f-4f8b-8e1e-662abaa8e73c&session=2dab7815-d005-4830-8ea0-aa8b8340c193&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2012%20May%202024%2007%3A20%3A29%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2012%20May%202024%2007%3A20%3A28%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223005%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20VexTrio%20DDGA%20is%20being%20used%20by%20malicious%20actors%20who%20take%20advantage%20of%20cheap%2C%20private%20domain%20registrations%20to%20create%20complex%20attack%20infrastructure%20that%20remain%20undetected%20for%20a%20long%20time.%20Learn%20about%20it%20in%20this%20comprehensive%20report.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VexTrio%20DDGA%20Domains%20Observed%20Spreading%20Adware%2C%20Spyware%2C%20and%20Scam%20Web%20Forms%20%7C%20Infoblox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&pageViewId=ed0d5ff8-25fc-49aa-8cc8-cdd960a5a0ce&an_uid=0&webTagId=772bac9a-83fb-47c1-818d-7bda3c1f0e56&v=1.1.20

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

84.53.133.138 Madrid, Spain, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a84-53-133-138.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:29 GMT
x-content-type-options: nosniff
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sun, 12 May 2024 07:20:29 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 172ms
172ms Image
image/gif 84.53.133.138
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=65a5821f1ffef41888301786d2737e6c&svisitor=null&visitor=eecc2cd3-c20f-4f8b-8e1e-662abaa8e73c&session=2dab7815-d005-4830-8ea0-aa8b8340c193&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2012%20May%202024%2007%3A20%3A30%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2012%20May%202024%2007%3A20%3A29%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224006%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20VexTrio%20DDGA%20is%20being%20used%20by%20malicious%20actors%20who%20take%20advantage%20of%20cheap%2C%20private%20domain%20registrations%20to%20create%20complex%20attack%20infrastructure%20that%20remain%20undetected%20for%20a%20long%20time.%20Learn%20about%20it%20in%20this%20comprehensive%20report.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VexTrio%20DDGA%20Domains%20Observed%20Spreading%20Adware%2C%20Spyware%2C%20and%20Scam%20Web%20Forms%20%7C%20Infoblox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&pageViewId=ed0d5ff8-25fc-49aa-8cc8-cdd960a5a0ce&an_uid=0&webTagId=772bac9a-83fb-47c1-818d-7bda3c1f0e56&v=1.1.20

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

84.53.133.138 Madrid, Spain, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a84-53-133-138.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:30 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sun, 12 May 2024 07:20:30 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 172ms
172ms Image
image/gif 84.53.133.138
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=65a5821f1ffef41888301786d2737e6c&svisitor=null&visitor=eecc2cd3-c20f-4f8b-8e1e-662abaa8e73c&session=2dab7815-d005-4830-8ea0-aa8b8340c193&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2012%20May%202024%2007%3A20%3A31%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2012%20May%202024%2007%3A20%3A30%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225007%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20VexTrio%20DDGA%20is%20being%20used%20by%20malicious%20actors%20who%20take%20advantage%20of%20cheap%2C%20private%20domain%20registrations%20to%20create%20complex%20attack%20infrastructure%20that%20remain%20undetected%20for%20a%20long%20time.%20Learn%20about%20it%20in%20this%20comprehensive%20report.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VexTrio%20DDGA%20Domains%20Observed%20Spreading%20Adware%2C%20Spyware%2C%20and%20Scam%20Web%20Forms%20%7C%20Infoblox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&pageViewId=ed0d5ff8-25fc-49aa-8cc8-cdd960a5a0ce&an_uid=0&webTagId=772bac9a-83fb-47c1-818d-7bda3c1f0e56&v=1.1.20

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

84.53.133.138 Madrid, Spain, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a84-53-133-138.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:31 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sun, 12 May 2024 07:20:31 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 50ms
49ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-D4JXVXQTYG&gtm=45je4580v888272530z86172957za200&_p=1715498424466&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=285419076.1715498426&ul=de-de&sr=1600x1200&ir=1&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&_eu=EA&_s=2&sid=1715498425&sct=1&seg=0&dl=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&dt=VexTrio%20DDGA%20Domains%20Observed%20Spreading%20Adware%2C%20Spyware%2C%20and%20Scam%20Web%20Forms%20%7C%20Infoblox&en=company_details_6si&ep.cookieDomain=auto&ep.allowLinker=true&_et=1028&up.confidence_6si=NA&up.company_name_6si=(Non-company%20Visit)&up.country_6si=Germany&up.state_6si=Berlin&up.city_6si=Berlin&up.country_iso_code_6si=DE&up.geoIP_country_6si=Germany&up.geoIP_state_6si=Berlin&up.geoIP_city_6si=Berlin&up.company_match_6si=Non-actionable%20Match&up.additional_comment_6si=There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)&up.industry_v2_6si=&up.segment_568791_6si=false&up.segment_568783_6si=false&up.segment_568782_6si=false&up.segment_568780_6si=false&up.segment_362653_6si=false&up.segment_362641_6si=false&tfd=8113
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-D4JXVXQTYG&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:31 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blogs.infoblox.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 166ms
166ms Image
image/gif 84.53.133.138
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=65a5821f1ffef41888301786d2737e6c&svisitor=null&visitor=eecc2cd3-c20f-4f8b-8e1e-662abaa8e73c&session=2dab7815-d005-4830-8ea0-aa8b8340c193&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2012%20May%202024%2007%3A20%3A32%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2012%20May%202024%2007%3A20%3A31%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226008%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20VexTrio%20DDGA%20is%20being%20used%20by%20malicious%20actors%20who%20take%20advantage%20of%20cheap%2C%20private%20domain%20registrations%20to%20create%20complex%20attack%20infrastructure%20that%20remain%20undetected%20for%20a%20long%20time.%20Learn%20about%20it%20in%20this%20comprehensive%20report.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22VexTrio%20DDGA%20Domains%20Observed%20Spreading%20Adware%2C%20Spyware%2C%20and%20Scam%20Web%20Forms%20%7C%20Infoblox%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblogs.infoblox.com%2Fthreat-intelligence%2Fcyber-threat-advisory%2Fvextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms%2F&pageViewId=ed0d5ff8-25fc-49aa-8cc8-cdd960a5a0ce&an_uid=0&webTagId=772bac9a-83fb-47c1-818d-7bda3c1f0e56&v=1.1.20

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

84.53.133.138 Madrid, Spain, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a84-53-133-138.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 12 May 2024 07:20:32 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Sun, 12 May 2024 07:20:32 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: lltrck.com
URL: https://lltrck.com/scripts/lt-v3.js?llid=10235

Domain: des8qu5llanad.cloudfront.net
URL: https://des8qu5llanad.cloudfront.net/js/tracker/pix.js

Verdicts & Comments Add Verdict or Comment

93 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

28 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.infoblox.com/	1970-01-21 06:07:38	Name: _ga Value: GA1.1.285419076.1715498426
.infoblox.com/	1970-01-20 20:31:40	Name: TAsessionID Value: 4c8153aa-7a18-4fb5-aebd-d59fa4edffcd\|NEW
.infoblox.com/	1969-12-31 23:59:59	Name: notice_behavior Value: implied,eu
.techtarget.com/	1970-01-20 20:31:40	Name: __cf_bm Value: qRzEoPCW7IR1XIOZNVdjhmzxo0TVze5WievImIAG9Yc-1715498425-1.0.1.1-sm2c9s1Sv05kKBG7DgNqybxpZfN4.2u9Vo_cBMbbfVs5PFkBXU.k.huD2L7QefqokvYXDwivQU8Oh44XTY91Cg
.blogs.infoblox.com/	1970-01-21 06:07:38	Name: _rtfl_s_handshake_guid Value: c7cdb49a-4923-4d2a-aafd-86bf9e745bb0
.infoblox.com/	1969-12-31 23:59:59	Name: _ce.irv Value: new
.infoblox.com/	1969-12-31 23:59:59	Name: cebs Value: 1
.linkedin.com/	1970-01-21 05:17:14	Name: bcookie Value: "v=2&d96ebfc8-7c8a-4862-8d89-7ad4a2d79d81"
.linkedin.com/	1970-01-21 00:50:50	Name: li_gc Value: MTswOzE3MTU0OTg0MjY7MjswMjH2E0NEop4EcVhPMvVfF5a0mhsIte7WRgqIRuy3zcZC+A==
.linkedin.com/	1970-01-20 20:33:04	Name: lidc Value: "b=OGST08:s=O:r=O:a=O:p=O:g=2861:u=1:x=1:i=1715498426:t=1715584826:v=2:sig=AQFwxtGsQvuH8LRoCm9UvhyHE9hZasCv"
.infoblox.com/	1970-01-21 05:17:14	Name: _biz_uid Value: eb4720fc55794352e84f64613ed233ff
.infoblox.com/	1970-01-21 05:17:14	Name: _biz_nA Value: 1
.infoblox.com/	1970-01-20 20:33:04	Name: _ce.clock_event Value: 1
.bizible.com/	1970-01-21 05:17:14	Name: _BUID Value: eb4720fc55794352e84f64613ed233ff
.infoblox.com/	1970-01-21 05:17:14	Name: _biz_pendingA Value: %5B%5D
.bizibly.com/	1970-01-21 05:17:14	Name: _BUID Value: 22aa5f49fec4165d34fb58d436301b0b
.infoblox.com/	1970-01-21 05:17:14	Name: _biz_flagsA Value: %7B%22Version%22%3A1%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
.infoblox.com/	1970-01-20 20:33:04	Name: _ce.clock_data Value: 47%2C80.255.7.123%2C1%2Ca16ddaab909d2cf27fce353f26dd2ff2
.infoblox.com/	1969-12-31 23:59:59	Name: cebsp_ Value: 1
.adnxs.com/	1970-01-21 06:07:38	Name: receive-cookie-deprecation Value: 1
.infoblox.com/	1970-01-21 05:17:14	Name: _ce.s Value: v~5adfa4f0654ed215b9ae829436e69c2e9ba917f2~lcw~1715498426463~lva~1715498426019~vpv~0~v11.fhb~1715498426418~v11.lhb~1715498426418~v11.cs~237558~v11.s~1ab9bef0-1030-11ef-ac17-17d599839940~lcw~1715498426464
blogs.infoblox.com/	1970-01-20 20:41:43	Name: _an_uid Value: 0
blogs.infoblox.com/	1970-01-21 06:07:38	Name: _gd_visitor Value: eecc2cd3-c20f-4f8b-8e1e-662abaa8e73c
blogs.infoblox.com/	1970-01-20 20:31:52	Name: _gd_session Value: 2dab7815-d005-4830-8ea0-aa8b8340c193
.infoblox.com/	1970-01-21 06:07:38	Name: _ga_D4JXVXQTYG Value: GS1.1.1715498425.1.0.1715498426.59.0.0
.infoblox.com/	1970-01-21 06:07:38	Name: _rtfl_s_247745_specific_site_session Value: XzRZMWVhTXYyTWdOQVl4dkZBNjdoTnJfM2JmM2Y2MDRmOGI4NjczNmRmMzczMjc5MjUwNGMyNjM3ZTA3Y2U5NQ==
.infoblox.com/	1970-01-21 06:07:38	Name: _rtfl_s_unique_visitor_session Value: X0dETm9pZVlGdFFyY2EwMEdocXBQazNfNjMzODA3OTNkOWRhN2MxZmM1ZWViNWYyY2VhNGE4NjFiZDJmNmJiNQ==
blogs.infoblox.com/	1970-01-21 06:07:38	Name: _rtfl_s_specific_site_sessions_count Value: 1

14 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://des8qu5llanad.cloudfront.net/js/tracker/pix.js Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
other	warning	URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blogs.infoblox.com/threat-intelligence/cyber-threat-advisory/vextrio-ddga-domains-spread-adware-spyware-and-scam-web-forms/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' filesystem: .jsdelivr.net .infoblox.com .pantheonsite.io .infoblox.local .vimeo.com .addthis.com .typekit.net .driftt.com .drift.com .google-analytics.com .eloqua.com .nr-data.net .doubleclick.net .linkedin.com .vidyard.com .google.com .captivate.fm .soundcloud.com .youtube.com .6sense.com .jsdelivr.net .infoblox.com .crazyegg.com .youtube.com .reactful.com .6sc.co .lookbookhq.com .facebook.net .techtarget.com .marketo.net .pathfactory.com .mktoresp.com .google.co.in .adnxs.com https://sites.google.com/infoblox.com https://sites.google.com/infoblox.com/salesworkspace/ https://infoblox.litmos.com/ .use.fontawesome .info.infoblox.com https://internetidentity.com .kaltura.com .hotjar.com cdn.bizible.com cdn.linkedin.oribi.io; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: filesystem: .google.com .addthis.com .addthisedge.com .moatads.com .cookielaw.org .driftt.com .bidr.io .cloudfront.net .bing.com .linkedin.com .licdn.com .typekit.net .googletagmanager.com js.driftt.com .googleadservices.com .doubleclick.net .google-analytics.com .newrelic.com .nr-data.net .vidyard.com .captivate.fm .soundcloud.com https://cdnjs.cloudflare.com .jobvite.com .jsdelivr.net .infoblox.com .lltrck.com lltrck.com https://lltrck.com https://ajax.googleapis.com .jsdelivr.net .infoblox.com .crazyegg.com .youtube.com .reactful.com .6sc.co .lookbookhq.com .facebook.net .techtarget.com .marketo.net .adnxs.com .google.co.in https://infoblox.litmos.com/ .use.fontawesome.com .info.infoblox.com https://internetidentity.com https://widgets.itcentralstation.com .kaltura.com .hotjar.com .trustarc.com cdn.bizible.com cdn.linkedin.oribi.io; style-src 'self' 'unsafe-inline' 'unsafe-eval' filesystem: .google.com .googleapis.com .typekit.net .gstatic.com .googleusercontent.com https://info.infoblox.com/js/forms2/css/ .jsdelivr.net .infoblox.com .jsdelivr.net .infoblox.com .crazyegg.com .youtube.com .reactful.com .6sc.co .lookbookhq.com .facebook.net .techtarget.com .marketo.net .bootstrapcdn.com .google.co.in https://infoblox.litmos.com/ .use.fontawesome.com .info.infoblox.com https://internetidentity.com .kaltura.com .trustarc.com; img-src 'self' https: data: blob: .jsdelivr.net .infoblox.com https://infoblox.com .bing.com .adsymptotic.com .googleusercontent.com .gstatic.com .pantheonsite.io .infoblox.local .linkedin.com .drift.com .eloqua.com .typekit.net .google-analytics.com .google.com .doubleclick.net .gravatar.com https://play.vidyard.com https://cdn.vidyard.com https://i.ytimg.com .vimeocdn.com https://share.vidyard.com/ .googletagmanager.com https://lltrck.com .jsdelivr.net .infoblox.com .crazyegg.com .youtube.com .reactful.com .6sc.co .lookbookhq.com .facebook.net .techtarget.com .marketo.net .facebook.com .google.co.in .snaproute.com snaproute.com https://infoblox.litmos.com/ .use.fontawesome.com .info.infoblox.com https://internetidentity.com .kaltura.com .hotjar.com .trustarc.com cdn.bizible.com cdn.linkedin.oribi.io ; font-src 'self' https: data: filesystem: use.typekit.net .use.fontawesome.com; media-src 'self' mediastream: blob: filesystem: .driftqa.com .kaltura.com .js.driftt.com https://js.driftt.com/conductor/assets/media/notification.d46d7db1.mp3; frame-ancestors 'self' https: data: http://.jsdelivr.net .infoblox.com https://.jsdelivr.net .infoblox.com https://sites.google.com/infoblox.com https://sites.google.com/infoblox.com/salesworkspace/ https://infoblox.litmos.com/ http://infoblox.litmos.com/ https://infoblox.mindtickle.com/ https://infobloxpartners.mindtickle.com/ https://infoblox.litmos.com/ .use.fontawesome.com .info.infoblox.com https://internetidentity.com https://widgets.itcentralstation.com .kaltura.com .hotjar.com .trustarc.com cdn.bizible.com cdn.linkedin.oribi.io; frame-src 'self' https://www.youtube-nocookie.com https://play.vidyard.com https://www.google.com .youtube.com .vimeo.com https://w.soundcloud.com/ https://player.captivate.fm/ jobs.jobvite.com info.infoblox.com .jsdelivr.net .infoblox.com .crazyegg.com .youtube.com .reactful.com .6sc.co .lookbookhq.com .facebook.net .techtarget.com .marketo.net .facebook.com https://infoblox.litmos.com/ .use.fontawesome.com .info.infoblox.com https://internetidentity.com https://widgets.itcentralstation.com .kaltura.com .hotjar.com .trustarc.com https://js.driftt.com/ https://js.driftt.com/conductor/assets/media/notification.d46d7db1.mp3 *.js.driftt.com cdn.bizible.com cdn.linkedin.oribi.io
Strict-Transport-Security	max-age=31622400
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
assets-tracking.crazyegg.com
b.6sc.co
bam.nr-data.net
blogs.infoblox.com
c.6sc.co
cdn.bizible.com
cdn.bizibly.com
cdn.jsdelivr.net
consent.trustarc.com
des8qu5llanad.cloudfront.net
epsilon.6sense.com
fonts.googleapis.com
ibc-flow.techtarget.com
ipv6.6sc.co
j.6sc.co
js-agent.newrelic.com
lltrck.com
p.typekit.net
pagestates-tracking.crazyegg.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
script.crazyegg.com
secure.adnxs.com
snap.licdn.com
stats.g.doubleclick.net
tracking.crazyegg.com
tracking.reactful.com
trk.techtarget.com
use.typekit.net
visitor.reactful.com
www.google.de
www.googletagmanager.com
www.infoblox.com
des8qu5llanad.cloudfront.net
lltrck.com
13.107.42.14
13.225.78.35
13.35.58.128
152.195.15.58
162.247.241.14
172.217.23.99
18.66.122.74
2001:4860:4802:32::36
2602:816:5001::39
2606:4700:4400::ac40:973c
2606:4700::6812:bb1f
2606:4700::6813:9308
2620:1ec:21::14
2a00:1450:4001:806::200a
2a00:1450:4001:810::2013
2a00:1450:4001:812::200a
2a00:1450:4001:813::2008
2a00:1450:400c:c1d::9a
2a02:26f0:480:23::1726:629c
2a02:26f0:7100::1720:ef43
2a02:26f0:7100::1720:ef50
2a02:26f0:780::210:a46a
2a04:4e42:8e::765
3.66.255.135
34.111.208.231
37.252.171.149
54.195.89.156
84.53.133.138
09decd6c261342f90598b3c29ef086f2e9cfe4351ba843dfd2f68a3396f47cee
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
140237201b8d9ee83abd909ec616d622cd03bdbdb68e2f509e8f522518b7eef3
192c65c1ab99993da5595f9e6ab27fe04aac5bd5e0515ce076e2b1f1e600fcef
20550f7bcb2a817ac9a5879e04260da8268e971c0b8031a6b7a2f48a55ee60d5
2497fed5d20961b72c0464044bdce3efa2cf1d11fbd458d8344f36ad0e2141b8
2acbb91b42306467ea03c580e2fa361fcd61fb79d599718c2a949c0dad15c90d
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
34988554893009eb1f64d49b96d6dd472699ad46e71557eab757bcfcecee4342
34eee5dcfb0c64df2cfdff05f322ce9a24f2e19fec6c4fed55a6a803ed28597b
35667f94f5d8ceaac265ab0ee16d50ef3fc5b04b9ce6f770a8b57b0b8313450a
382eec6a06d36e61ea966510e1fe3f52428e0bc44c329dbaa888f14d59955a74
40b87680850d61dff26f2280eaac2487e2261e8771cca1f4eba69dc366cd1fe2
4284fc67b001b14223b3605043e1340e0542ddf1aad34b5277dd6eceba15d3b3
465ca9e432168f0604aed9d539fe96f4338bdd69d0850760d64240066ab03c51
466532d720469eab15683075d0681b23248bd0638a3b77b8b672760a7f4ec521
47bb48dbb60985f6c3925bcf32c14d6c586edcad7b629b9c97fe3705d1660279
4991ede4040bc4d71a9d4ad513a09b717f5290ab6ca74807ec5cb61811847307
49dd51efa6cf7deacbe8ffc88e4d1149f6a69a5d6da403ea5f97dda990a0fe00
4d90a12415ab9eec636222e0c8bfd9a579c4fe7cf784b063b6b331107d633de6
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3
526d676a40f3d7b45aa46213e63602a7ea7e2906505a99df3bd593c94e94e1cc
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
532af117d969ca8bd0ff019ce150f9c109d44c362f9eabe7ef8ff9d82c227bd3
535f1e8f0acb7c4f04fa24122fe140844f1d22e2b69a99efd0aec415fa4ec237
55ddd1f80cec627f624b79cea24ccd18fb38180c3bff6757ffe56be7c1a6445d
5664ef27a425a799226cc5b4a9ce3f663f5dd9060ab7b19326515ae6a78933c2
576e529ab8a4f6521f8aff687e04e47ca0e165585dfe6b82d1758fd99ff03336
5b9f9afe7621ec465573f58064f5bef3a229e5e19362351168fd211f6a28bb5c
5cbff7c70efe6b8a6877e92b8b0c60564dfa64dace120d3a85b4ea24d5a5dba6
5e532f2001bd715ac2458b017f00e83297416f11297bb68a50d13e84f497b16b
5eeb76abbd17b81bc8a7f6722be1f0b980897bce2c1fe38bbe9f126573486d25
5f27ff5fc0da5cefdc57dd9e79a91efdd46903e83bd6c86643aafd686430ffb0
5f9bbcaf6ac8a93b61e3d94ac3639fdff2222c9a4d3f3b8bd4dc2c620331bddb
62c46fc4b22fb535a4de0337b9830b1c7506887e42156e43ca8bcb210578280b
658414418ebba65bb3d94f37b93ce4245b29d3b900897c923eeffd56ace0d381
685032dc6cc8d888d62fc0f0228a47aac0a06f1f468ad7269c7622f83a302d5c
68d587586668442fec1aba02e2f1106cba96923d9045b4f9e952d9266e0094b4
6a1fdce4e2f209d018014e05c230d279fc2ed26c2241737650fb23413fe16001
6fd951519999c4f446db71f347635025addb27c21d3b5915d498732ea1eec927
70469df2c7c60dd0fd471dd98076939866edce268ed114c33ad8c0309fd81d2e
708ac71ed8728392391eb1d7c3fdb816dedb96bfcd4a1ab9238647623b9528c6
70d17ea151f46d31f85bdddba1200b66e5fe6ea21c461544153c0f643e2fca5b
724ee0d315af0ab32498db3591516c82dce11772cd4153e30fd7b6a40917bec5
763c90a60f06998d0e5496b960fb880f1d28405fb9040e879d1e2328458c9001
7731d577c5dfa5f38e9bf82dedae51174c9ddd4d3d4668eea9d1e51d6ce13d66
774e962975f775218ab0d77b8881b02ccb9b80889bb7a126d85d9e44218c848a
780929714861ca223c2893799ec20e113d5cd9d3dcae15be3aca5db440ea1db2
7ac3da9cfd5c1a08a07b9b3a69d4baf42d25ff62dcc6b65789b94a770091fe30
830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375
85209302deaf80a2a3e0f612eee743053c5d1b14e656cde8079dd543fc6830f4
86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b
868503219c7ca2afd9cab62a466011d4e99684a725dd287e55b1b57fbe78febd
899d1ec3c095342571d3be2091ec6f984d4cc82390d1f61945c391fa035b00d9
8d9524269f77bfe9bb2dfa87e6d3dca4c0ab1545e94533c69fda779b3797874a
945c284f98ebab78bcdccb6711ebc2340756345a312a8fcad4da1871505029bf
9838b2f0b70eed858474cf429e7b3a9e74b7a968547b9b43151b3d3417942c17
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
98cecf88a23542fa047ce46eedb650b5c5128761ed4386c0977b847094ddfa20
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
9b99ce50d05750058143cb93936075ad5107f9a3e5b03f2d4872c0ebe753a9f7
a0acc524b541f57df4024b039206425fbcc49c7b3cba369bc0b4a57cfc0e9629
a1c4a7fc8d5baa9d1b5e4d8c55c3229442dbf98430024e9b008cd3cd99c72fbb
a2b997da567762896061490c3c08e506b2e5b936978560fc12251dd245140b32
a875e1d5f8cfe252cc8f5e04d750dd8c771fb8aceabd435d548425a445ab61d3
a8ab087f9b9387b26e1f331867effa23c3fadd5dd9c7b77d5e8210b76793d028
ade38136058fcd75880d3673855aff859ee377d5915e59cccf24a973d418bebb
aeca7cb7462506fd077810dbd1ccd58af233fd5ef2f02cfecbc22138cdd2e4e2
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b4a9abdcbfeca0fdfbde625c8fc01582fde3f1ff5c5189c38d58a6ce2cec061f
b663370b2ecf34db611eaba1d1064a9c0f08f8047c18c59f5ffd16caf58ef6b7
b7b9f2c0ab617f6860d1e08fb1b98c31859c4a12fd7836a62ad2b594097a5150
c05e26befde7722134ba6666c70090b4442f804ab3cc0b72260a862fafa70055
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c36ca8cd5566c156e23f38dde55efa9767270c732ddcb7ed915ea44b2295601e
c7f46df91d74501f7ee85f7ce9b32e1e4f8d413b525366a24a7a036ca75952f7
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cce25d26533d03769ddb04d54482b596a16d98cf9bf7dea2df2b071ebf415e10
cddede585f1ce388062b874c8ed32e1bbe2a0ffa258e85ff334ec7d1b673200f
cf8646fc48648f5a6d806df8f757007e6398a55ddccc3d8c2046a4c014cf1b56
d0ff37ec6455fc98cf29d6e3d6a6117c260e2623f9f8238519a6570b7081daaf
d198aa686d1152dea61220e984befd325376330286ffbeb9bba9d43347c2f065
d454566fbbab8fcbc70a1c3139be25be5205712442564fe24a5e0258e3337a98
d80f9badc08b8777ce9133f8bfa898576eaac335a195355a410f34e83c26311d
d83f73562c5fedb0c3086617e16fd47c91832f0de8d01fcc638dc2ed0c8bd978
dc93c5b3243e66c7b2e27c51b76fa6a11bd7a6d7546c5fa26bbffa001f885305
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd63265ed07d13fa2b0422ae4b2324ba4a8ff29bf5460b90c09d7cdaa8bd568b
e254222dccac85dc391b811a0177bbe48a6ce70dd48ccc1e7112881eaf4ae870
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5f87052ae30bfd71b5b59b70267de5895ae2133a05e40104eaebb15b149b1ac
e9f98a22a9c2b3d07f045d2ded3da0622f8d06f666609e3e0a65986d3f8081e1
ec804c0b664c15e3ffe885c3b8101526fe2c386f0bb66eec9066dcea261acf29
ecc24f40f565ce3d863f4ab0fe3258c6d92ca796776a4cae7d68fb52fdddeb7d
ece565a1f66a32347dfed83562c428ff7736648de72b0027dd8f0e0f27e0c327
ed5b5df9ceacfe76857ac51964972b0b417a215b2f50e837fd6b64bad7339c40
ee0479b1679cab0a529e7ad7ee5eaa2cbeba64b35d07cfaa669565314d5abd2e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef774bedbe77e522d4744a3309c90dbbc745df5253eb4972485898ba8ccf9bdd
f6e17a06cf57ba1c1e00d705cc0ea44d42dc095c01327f5c8b800ac5c10b534c
f920491d697fadb52d78fdb399b4bab60ef9bb6f42b73daa90279a4a93ae63a2
f9f7ff183d86cda77ec548473949359e842a6963e6457ebccaaa700c22702012
fa73690522b04e6df899152023bbd9f87577f8507e96c5bda8e309eca2b0ff9d
fab34cb0ba670abf20ae82b55e7c44b38f240c0b257d4193833e7ac2c11117eb
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
fd57ae7228574a83527cb8917ec5a0ff944aa787934ee5b85a7976f259b7ae31
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

blogs.infoblox.com Open in urlscan Pro 2a04:4e42:8e::765 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

134 Requests

94 %HTTPS

57 %IPv6

23 Domains

35 Subdomains

29 IPs

5 Countries

2738 kBTransfer

4570 kBSize

28 Cookies

100 Outgoing links

Page URL History

Redirected requests

134 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

blogs.infoblox.com Open in urlscan Pro
2a04:4e42:8e::765 Public Scan

Screenshot
Live screenshot

Full Image

134
Requests

94 %
HTTPS

57 %
IPv6

23
Domains

35
Subdomains

29
IPs

5
Countries

2738 kB
Transfer

4570 kB
Size

28
Cookies

134 HTTP transactions
0 data transactions