darkpills.com Open in urlscan Pro
2001:41d0:1:1b00:213:186:33:19 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/
Submission: On May 21 via manual (May 21st 2022, 8:36:11 pm UTC) from US — Scanned from FR

Summary HTTP 15 Redirects Links 28 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 15 HTTP transactions. The main IP is 2001:41d0:1:1b00:213:186:33:19, located in France and belongs to OVH, FR. The main domain is darkpills.com.
TLS certificate: Issued by R3 on March 20th 2022. Valid for: 3 months.

This is the only time darkpills.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
9	2001:41d0:1:1... 2001:41d0:1:1b00:213:186:33:19	16276 (OVH) (OVH)
6	2603:1020:c01... 2603:1020:c01:4::40	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
15	2

9 2001:41d0:1:1b00:213:186:33:19 (France)

ASN16276 (OVH, FR)

darkpills.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2603:1020:c01:4::40 (Frankfurt am Main, Germany)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

darkpills.containers.piwik.pro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
darkpills.piwik.pro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	darkpills.com darkpills.com	452 KB
6	piwik.pro darkpills.containers.piwik.pro darkpills.piwik.pro	247 KB
15	2

	Domain	Requested by
9	darkpills.com	darkpills.com
4	darkpills.containers.piwik.pro	darkpills.com darkpills.containers.piwik.pro
2	darkpills.piwik.pro	darkpills.com
15	3

This site contains links to these domains. Also see Links.

Domain
github.com
wordpress.com
brandexponents.com
developer.wordpress.org
cwe.mitre.org
en.wikipedia.org
x-c3ll.github.io
book.hacktricks.xyz
cheatsheetseries.owasp.org
www.php.net
gist.github.com
wpscan.com
tatsubuilder.com
exponentwptheme.com
www.linkedin.com
twitter.com
piwik.pro

Subject Issuer	Validity	Valid
vincent-michel.fr R3	`2022-03-20` - `2022-06-18`	3 months	crt.sh
*.containers.piwik.pro GlobeSSL DV CA	`2021-08-17` - `2022-09-08`	a year	crt.sh
*.piwik.pro GlobeSSL DV CA	`2022-01-10` - `2023-01-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/
Frame ID: A815BC4CD73EA2BB01183CBA69311B51
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Wordpress Tatsu builder preauth RCE (CVE-2021-25094) | @darkpills cybersecurity blogPiwik PRO

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

15
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

699 kB
Transfer

2373 kB
Size

3
Cookies

28 Outgoing links

These are links going to different origins than the main page.

URL: https://github.com/wpscanteam/wpscan
Title: wpscan

Search URL Search Domain Scan URL

URL: https://wordpress.com/
Title: Wordpress

Search URL Search Domain Scan URL

URL: https://brandexponents.com/
Title: BrandExponents

Search URL Search Domain Scan URL

URL: https://developer.wordpress.org/reference/functions/add_action/
Title: here

Search URL Search Domain Scan URL

URL: https://cwe.mitre.org/data/definitions/362.html
Title: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’)

Search URL Search Domain Scan URL

URL: https://github.com/darkpills/CVE-2021-25094-tatsu-preauth-rce/blob/main/exploit-race.py
Title: https://github.com/darkpills/CVE-2021-25094-tatsu-preauth-rce/blob/main/exploit-race.py

Search URL Search Domain Scan URL

URL: https://github.com/darkpills/CVE-2021-25094-tatsu-preauth-rce/blob/main/exploit-rce.py
Title: https://github.com/darkpills/CVE-2021-25094-tatsu-preauth-rce/blob/main/exploit-rce.py

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Zip_bomb
Title: zip bomb attack

Search URL Search Domain Scan URL

URL: https://x-c3ll.github.io/posts/bypass-wordpress-plugins/
Title: here

Search URL Search Domain Scan URL

URL: https://book.hacktricks.xyz/pentesting/pentesting-web/php-tricks-esp
Title: here

Search URL Search Domain Scan URL

URL: https://github.com/wireghoul/htshells/blob/master/shell/mod_php.shell.htaccess
Title: here

Search URL Search Domain Scan URL

URL: https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html
Title: OWASP File upload cheat sheet

Search URL Search Domain Scan URL

URL: https://www.php.net/manual/fr/ziparchive.getnameindex.php
Title: https://www.php.net/manual/fr/ziparchive.getnameindex.php

Search URL Search Domain Scan URL

URL: https://www.php.net/manual/fr/function.pathinfo.php
Title: https://www.php.net/manual/fr/function.pathinfo.php

Search URL Search Domain Scan URL

URL: https://gist.github.com/Caffe1neAdd1ct/f2ece3705053b3e2ea4c
Title: https://gist.github.com/Caffe1neAdd1ct/f2ece3705053b3e2ea4c

Search URL Search Domain Scan URL

URL: https://www.php.net/manual/fr/ziparchive.statindex.php
Title: https://www.php.net/manual/fr/ziparchive.statindex.php

Search URL Search Domain Scan URL

URL: https://www.php.net/manual/fr/function.mime-content-type.php
Title: https://www.php.net/manual/fr/function.mime-content-type.php

Search URL Search Domain Scan URL

URL: https://www.php.net/manual/fr/book.zip.php
Title: php zip

Search URL Search Domain Scan URL

URL: https://github.com/darkpills/CVE-2021-25094-tatsu-preauth-rce
Title: https://github.com/darkpills/CVE-2021-25094-tatsu-preauth-rce

Search URL Search Domain Scan URL

URL: https://wpscan.com/vulnerability/fb0097a0-5d7b-4e5b-97de-aacafa8fffcd
Title: https://wpscan.com/vulnerability/fb0097a0-5d7b-4e5b-97de-aacafa8fffcd

Search URL Search Domain Scan URL

URL: https://tatsubuilder.com/
Title: https://tatsubuilder.com/

Search URL Search Domain Scan URL

URL: https://exponentwptheme.com/documentation/list-of-articles-others/typehub/
Title: https://exponentwptheme.com/documentation/list-of-articles-others/typehub/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/in/vincent--michel/

Search URL Search Domain Scan URL

URL: https://twitter.com/darkpills

Search URL Search Domain Scan URL

URL: https://github.com/darkpills

Search URL Search Domain Scan URL

URL: https://twitter.com/mdo
Title: @mdo

Search URL Search Domain Scan URL

URL: https://twitter.com/mralanorth
Title: @mralanorth

Search URL Search Domain Scan URL

URL: https://piwik.pro/?utm_source=App&utm_medium=Consent_Pop_Up&utm_campaign=Consent_Manager_Pop_Up
Title: Piwik PRO

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/ 50 KB
12 KB 54ms
21ms Document
text/html 2001:41d0:1:1b00:213:186:33:19
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:41d0:1:1b00:213:186:33:19 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Apache /

Resource Hash

2a3a64084faf27235c576f276a3c12f7e3cdb6d79da9b61a2162f728947179b9

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 11619
content-security-policy: default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
content-type: text/html
date: Sat, 21 May 2022 20:36:07 GMT
server: Apache
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: deny

GET
H2 200 bundle.min.4581acde25c1d6ebaed9e992ed39da2f70006146ddf4467809d05bf72e933b57.css
darkpills.com/css/ 123 KB
23 KB 47ms
46ms Stylesheet
text/css 2001:41d0:1:1b00:213:186:33:19
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://darkpills.com/css/bundle.min.4581acde25c1d6ebaed9e992ed39da2f70006146ddf4467809d05bf72e933b57.css

Requested by

Host: darkpills.com
URL: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:41d0:1:1b00:213:186:33:19 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Apache /

Resource Hash

4581acde25c1d6ebaed9e992ed39da2f70006146ddf4467809d05bf72e933b57

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Request headers

Referer: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/
Origin: https://darkpills.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 21 May 2022 20:36:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 29 Mar 2022 08:51:37 GMT
server: Apache
x-frame-options: deny
content-type: text/css
cache-control: max-age=900
content-security-policy: default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
strict-transport-security: max-age=31536000; includeSubDomains
accept-ranges: bytes
vary: Accept-Encoding
content-length: 22692
expires: Sat, 21 May 2022 20:51:07 GMT

GET
H2 200 tohttps.0b729bf906009b43b4796d840a95e7cb0f8eb616092555db8bd76383cd011355.js Show response
darkpills.com/js/ 170 B
719 B 18ms
17ms Script
application/javascript 2001:41d0:1:1b00:213:186:33:19
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://darkpills.com/js/tohttps.0b729bf906009b43b4796d840a95e7cb0f8eb616092555db8bd76383cd011355.js

Requested by

Host: darkpills.com
URL: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:41d0:1:1b00:213:186:33:19 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Apache /

Resource Hash

0b729bf906009b43b4796d840a95e7cb0f8eb616092555db8bd76383cd011355

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Request headers

Referer: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/
Origin: https://darkpills.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 21 May 2022 20:36:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 29 Mar 2022 08:51:37 GMT
server: Apache
x-frame-options: deny
content-type: application/javascript
cache-control: max-age=900
content-security-policy: default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
strict-transport-security: max-age=31536000; includeSubDomains
accept-ranges: bytes
vary: Accept-Encoding
content-length: 128
expires: Sat, 21 May 2022 20:51:07 GMT

GET
H2 200 darkpills.png
darkpills.com/ 17 KB
18 KB 18ms
17ms Image
image/png 2001:41d0:1:1b00:213:186:33:19
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://darkpills.com/darkpills.png

Requested by

Host: darkpills.com
URL: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:41d0:1:1b00:213:186:33:19 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Apache /

Resource Hash

fefd5a0aaa2abc6c4a680d53a1c31b49df2e00988e3a3c02795a33f7135c6d77

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 21 May 2022 20:36:07 GMT
x-content-type-options: nosniff
last-modified: Thu, 30 Dec 2021 09:00:55 GMT
server: Apache
x-frame-options: deny
content-type: image/png
cache-control: max-age=900
content-security-policy: default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
strict-transport-security: max-age=31536000; includeSubDomains
accept-ranges: bytes
content-length: 17863
expires: Sat, 21 May 2022 20:51:07 GMT

GET
H2 200 tatsubuilder-pres.png
darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/ 233 KB
234 KB 18ms
18ms Image
image/png 2001:41d0:1:1b00:213:186:33:19
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/tatsubuilder-pres.png

Requested by

Host: darkpills.com
URL: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:41d0:1:1b00:213:186:33:19 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Apache /

Resource Hash

a0fa3d15843acf186b264297c431f79c0e04cdfacd1fb725a8e8d043b9218844

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 21 May 2022 20:36:07 GMT
x-content-type-options: nosniff
last-modified: Tue, 29 Mar 2022 08:51:37 GMT
server: Apache
x-frame-options: deny
content-type: image/png
cache-control: max-age=900
content-security-policy: default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
strict-transport-security: max-age=31536000; includeSubDomains
accept-ranges: bytes
content-length: 238474
expires: Sat, 21 May 2022 20:51:07 GMT

GET
H2 200 tatsubuilder-fontimport.png
darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/ 45 KB
46 KB 18ms
17ms Image
image/png 2001:41d0:1:1b00:213:186:33:19
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/tatsubuilder-fontimport.png

Requested by

Host: darkpills.com
URL: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:41d0:1:1b00:213:186:33:19 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Apache /

Resource Hash

c439d5434186f4cbdb04153357ec12134e2cf67b432a9d6b1abfbe9fe0272d2e

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 21 May 2022 20:36:07 GMT
x-content-type-options: nosniff
last-modified: Tue, 29 Mar 2022 08:51:37 GMT
server: Apache
x-frame-options: deny
content-type: image/png
cache-control: max-age=900
content-security-policy: default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
strict-transport-security: max-age=31536000; includeSubDomains
accept-ranges: bytes
content-length: 46578
expires: Sat, 21 May 2022 20:51:07 GMT

GET
H2 200 photo.jpg
darkpills.com/ 41 KB
42 KB 18ms
18ms Image
image/jpeg 2001:41d0:1:1b00:213:186:33:19
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://darkpills.com/photo.jpg

Requested by

Host: darkpills.com
URL: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:41d0:1:1b00:213:186:33:19 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Apache /

Resource Hash

31f4d019af8f9f250b9a8a520a69f0e1f5f4b2ce9a948083fb5166efd60ad513

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 21 May 2022 20:36:07 GMT
x-content-type-options: nosniff
last-modified: Mon, 18 Mar 2019 22:43:46 GMT
server: Apache
x-frame-options: deny
content-type: image/jpeg
cache-control: max-age=900
content-security-policy: default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
strict-transport-security: max-age=31536000; includeSubDomains
accept-ranges: bytes
content-length: 42097
expires: Sat, 21 May 2022 20:51:07 GMT

GET
H2 200 piwik.4a4ef161522a0aa2522fde358657dfa56d338fd2f56b793d272bcdc73b017f8b.js Show response
darkpills.com/js/ 1 KB
1 KB 31ms
31ms Script
application/javascript 2001:41d0:1:1b00:213:186:33:19
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://darkpills.com/js/piwik.4a4ef161522a0aa2522fde358657dfa56d338fd2f56b793d272bcdc73b017f8b.js

Requested by

Host: darkpills.com
URL: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:41d0:1:1b00:213:186:33:19 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Apache /

Resource Hash

4a4ef161522a0aa2522fde358657dfa56d338fd2f56b793d272bcdc73b017f8b

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Request headers

Referer: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/
Origin: https://darkpills.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 21 May 2022 20:36:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 29 Mar 2022 08:51:37 GMT
server: Apache
x-frame-options: deny
content-type: application/javascript
cache-control: max-age=900
content-security-policy: default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
strict-transport-security: max-age=31536000; includeSubDomains
accept-ranges: bytes
vary: Accept-Encoding
content-length: 694
expires: Sat, 21 May 2022 20:51:07 GMT

GET
H2 200 c2d529c9-3cd0-4855-8780-eaa2d9254f7d.js Show response
darkpills.containers.piwik.pro/ 241 KB
64 KB 148ms
53ms Script
application/javascript 2603:1020:c01:4::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://darkpills.containers.piwik.pro/c2d529c9-3cd0-4855-8780-eaa2d9254f7d.js

Requested by

Host: darkpills.com
URL: https://darkpills.com/js/piwik.4a4ef161522a0aa2522fde358657dfa56d338fd2f56b793d272bcdc73b017f8b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2603:1020:c01:4::40 Frankfurt am Main, Germany, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

365cc0c31ff0cc0250ba55c183794f33650f6d0c1efcd2589c5de76fbfe9de3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://darkpills.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 21 May 2022 20:36:07 GMT
content-encoding: gzip
referrer-policy: origin
x-frame-options: sameorigin
content-type: application/javascript; charset=utf-8
cache-control: public, must-revalidate, max-age=360
x-robots-tag: none
vary: Accept-Encoding, Accept-Encoding, Cookie
x-content-type-options: nosniff

GET
H2 200 fontawesome-webfont.woff2
darkpills.com/fonts/ 75 KB
76 KB 17ms
17ms Font
text/plain 2001:41d0:1:1b00:213:186:33:19
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://darkpills.com/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: darkpills.com
URL: https://darkpills.com/css/bundle.min.4581acde25c1d6ebaed9e992ed39da2f70006146ddf4467809d05bf72e933b57.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:41d0:1:1b00:213:186:33:19 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Apache /

Resource Hash

42736c7de60dfab94b3cc902b8692f80cfeb0a5989d1d51db1d25fd7d18dc45b

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Request headers

Referer: https://darkpills.com/css/bundle.min.4581acde25c1d6ebaed9e992ed39da2f70006146ddf4467809d05bf72e933b57.css
Origin: https://darkpills.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
x-content-type-options: nosniff
last-modified: Thu, 30 Dec 2021 21:29:38 GMT
server: Apache
date: Sat, 21 May 2022 20:36:07 GMT
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains
accept-ranges: bytes
content-length: 77160

GET
H2 200 ppms.js Show response
darkpills.containers.piwik.pro/ 78 KB
26 KB 35ms
35ms Script
application/javascript 2603:1020:c01:4::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://darkpills.containers.piwik.pro/ppms.js

Requested by

Host: darkpills.com
URL: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2603:1020:c01:4::40 Frankfurt am Main, Germany, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

ac2f6e5e0c1e545886c36f8ba0313360e970f144bdb7c18f640d3a84d143bd57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://darkpills.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 21 May 2022 20:36:07 GMT
content-encoding: gzip
referrer-policy: origin
last-modified: Wed, 20 Apr 2022 11:44:49 GMT
etag: W/"625ff231-138c5"
x-frame-options: sameorigin
content-type: application/javascript
cache-control: max-age=21600
vary: Accept-Encoding
x-content-type-options: nosniff
expires: Sun, 22 May 2022 02:36:07 GMT

GET
H2 200 privacy-templates.json Show response
darkpills.containers.piwik.pro/c2d529c9-3cd0-4855-8780-eaa2d9254f7d/ 1 MB
156 KB 85ms
85ms XHR
application/json 2603:1020:c01:4::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://darkpills.containers.piwik.pro/c2d529c9-3cd0-4855-8780-eaa2d9254f7d/privacy-templates.json

Requested by

Host: darkpills.containers.piwik.pro
URL: https://darkpills.containers.piwik.pro/c2d529c9-3cd0-4855-8780-eaa2d9254f7d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2603:1020:c01:4::40 Frankfurt am Main, Germany, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

a33388f965f7b4c9f7b36a54904e31673bfd37556720906f4d94bf49c37331e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

Referer: https://darkpills.com/
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 21 May 2022 20:36:07 GMT
content-encoding: gzip
referrer-policy: origin
x-frame-options: sameorigin
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=360
x-robots-tag: none
vary: Accept-Encoding
x-content-type-options: nosniff

OPTIONS
H2 200 privacy-templates.json
darkpills.containers.piwik.pro/c2d529c9-3cd0-4855-8780-eaa2d9254f7d/ 0
0 90ms
38ms Preflight 2603:1020:c01:4::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://darkpills.containers.piwik.pro/c2d529c9-3cd0-4855-8780-eaa2d9254f7d/privacy-templates.json

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2603:1020:c01:4::40 Frankfurt am Main, Germany, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://darkpills.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

access-control-allow-headers: Origin,X-Requested-With,Accept,Content-Type
access-control-allow-methods: GET
access-control-allow-origin: *
content-length: 0
date: Sat, 21 May 2022 20:36:07 GMT
referrer-policy: origin
x-content-type-options: nosniff
x-frame-options: sameorigin
x-robots-tag: none

GET
H2 202 ppms.php
darkpills.piwik.pro/ 43 B
326 B 128ms
40ms Image
image/gif 2603:1020:c01:4::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://darkpills.piwik.pro/ppms.php?action_name=Wordpress%20Tatsu%20builder%20preauth%20RCE%20(CVE-2021-25094)%20%7C%20%40darkpills%20cybersecurity%20blog&idsite=c2d529c9-3cd0-4855-8780-eaa2d9254f7d&rec=1&r=850138&h=20&m=36&s=7&url=https%3A%2F%2Fdarkpills.com%2Fwordpress-tatsu-builder-preauth-rce-cve-2021-25094%2F&uia=1&_id=b80b733075df099b&_idts=1653165368&_idvc=1&_idn=0&_viewts=1653165368&send_image=1&ts_n=jstc_tm&ts_v=2.6.10&cookie=1&res=1600x1200&gt_ms=28&pv_id=aU2mXu

Requested by

Host: darkpills.com
URL: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2603:1020:c01:4::40 Frankfurt am Main, Germany, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://darkpills.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
referrer-policy: origin
date: Sat, 21 May 2022 20:36:07 GMT
x-frame-options: sameorigin
content-type: image/gif
cache-control: no-store
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-length: 43
x-content-type-options: nosniff

GET
H2 202 ppms.php
darkpills.piwik.pro/ 43 B
325 B 34ms
34ms Image
image/gif 2603:1020:c01:4::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://darkpills.piwik.pro/ppms.php?e_c=consent_form_impression&e_a=popup&idsite=c2d529c9-3cd0-4855-8780-eaa2d9254f7d&rec=1&r=726329&h=20&m=36&s=7&url=https%3A%2F%2Fdarkpills.com%2Fwordpress-tatsu-builder-preauth-rce-cve-2021-25094%2F&uia=1&_id=b80b733075df099b&_idts=1653165368&_idvc=1&_idn=0&_viewts=1653165368&send_image=1&ts_n=jstc_tm&ts_v=2.6.10&cookie=1&res=1600x1200&gt_ms=28&pv_id=aU2mXu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2603:1020:c01:4::40 Frankfurt am Main, Germany, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://darkpills.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'none'
referrer-policy: origin
date: Sat, 21 May 2022 20:36:07 GMT
x-frame-options: sameorigin
content-type: image/gif
cache-control: no-store
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-length: 43
x-content-type-options: nosniff

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
darkpills.com/	1970-01-20 03:12:47	Name: _pk_id.c2d529c9-3cd0-4855-8780-eaa2d9254f7d.8d07 Value: b80b733075df099b.1653165368.1.1653165368.1653165368.
darkpills.com/	1970-01-20 03:12:47	Name: _pk_ses.c2d529c9-3cd0-4855-8780-eaa2d9254f7d.8d07 Value: *
darkpills.com/	1970-01-20 11:58:21	Name: ppms_privacy_c2d529c9-3cd0-4855-8780-eaa2d9254f7d Value: {%22consents%22:{%22analytics%22:{%22status%22:-1%2C%22historyId%22:%22ace84835-650c-4ef7-849a-060a57201773%22%2C%22updatedAt%22:%222022-05-21T20:36:07.770Z%22}}%2C%22visitorId%22:%223d3861a1-10bb-62db-3fe9-ca24afe18901%22%2C%22domain%22:{%22normalized%22:%22darkpills.com%22%2C%22isWildcard%22:false%2C%22pattern%22:%22darkpills.com%22}%2C%22staleCheckpoint%22:%222022-05-21T20:36:07.749Z%22}

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'none'; script-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; connect-src darkpills.piwik.pro darkpills.containers.piwik.pro; img-src 'self' darkpills.piwik.pro; style-src 'self' 'unsafe-inline' darkpills.containers.piwik.pro; font-src 'self' darkpills.piwik.pro;base-uri 'self';form-action 'none'; frame-ancestors 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

darkpills.com
darkpills.containers.piwik.pro
darkpills.piwik.pro
2001:41d0:1:1b00:213:186:33:19
2603:1020:c01:4::40
0b729bf906009b43b4796d840a95e7cb0f8eb616092555db8bd76383cd011355
2a3a64084faf27235c576f276a3c12f7e3cdb6d79da9b61a2162f728947179b9
31f4d019af8f9f250b9a8a520a69f0e1f5f4b2ce9a948083fb5166efd60ad513
365cc0c31ff0cc0250ba55c183794f33650f6d0c1efcd2589c5de76fbfe9de3a
42736c7de60dfab94b3cc902b8692f80cfeb0a5989d1d51db1d25fd7d18dc45b
4581acde25c1d6ebaed9e992ed39da2f70006146ddf4467809d05bf72e933b57
4a4ef161522a0aa2522fde358657dfa56d338fd2f56b793d272bcdc73b017f8b
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
a0fa3d15843acf186b264297c431f79c0e04cdfacd1fb725a8e8d043b9218844
a33388f965f7b4c9f7b36a54904e31673bfd37556720906f4d94bf49c37331e6
ac2f6e5e0c1e545886c36f8ba0313360e970f144bdb7c18f640d3a84d143bd57
c439d5434186f4cbdb04153357ec12134e2cf67b432a9d6b1abfbe9fe0272d2e
fefd5a0aaa2abc6c4a680d53a1c31b49df2e00988e3a3c02795a33f7135c6d77

darkpills.com Open in urlscan Pro 2001:41d0:1:1b00:213:186:33:19 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

100 %IPv6

2 Domains

3 Subdomains

2 IPs

2 Countries

699 kBTransfer

2373 kBSize

3 Cookies

28 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

3 Cookies

Security Headers

Indicators

darkpills.com Open in urlscan Pro
2001:41d0:1:1b00:213:186:33:19 Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

699 kB
Transfer

2373 kB
Size

3
Cookies

15 HTTP transactions
0 data transactions