myonlinesecurity.co.uk Open in urlscan Pro
178.62.74.125 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/'
Effective URL:
https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
Submission: On September 25 via api (September 25th 2022, 2:21:15 pm UTC) from DE — Scanned from GB

Summary HTTP 70 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 7 IPs in 4 countries across 6 domains to perform 70 HTTP transactions. The main IP is 178.62.74.125, located in London, United Kingdom and belongs to DIGITALOCEAN-ASN, US. The main domain is myonlinesecurity.co.uk.
TLS certificate: Issued by R3 on August 20th 2022. Valid for: 3 months.

This is the only time myonlinesecurity.co.uk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 63	178.62.74.125 178.62.74.125	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2a00:1450:400... 2a00:1450:400e:810::200a	15169 (GOOGLE) (GOOGLE)
2	2a02:26f0:dc:... 2a02:26f0:dc:282::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f00... 2a03:2880:f007:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
1	151.101.64.84 151.101.64.84	54113 (FASTLY) (FASTLY)
70	7

63 178.62.74.125 (London, United Kingdom) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

myonlinesecurity.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400e:810::200a (Ireland)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:dc:282::1931 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

assets.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f007:8:face:b00c:0:1 (Vienna, Austria)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.64.84 (United States)

ASN54113 (FASTLY, US)

log.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
63	myonlinesecurity.co.uk 1 redirects myonlinesecurity.co.uk	808 KB
3	pinterest.com assets.pinterest.com — Cisco Umbrella Rank: 2609 log.pinterest.com — Cisco Umbrella Rank: 3693	19 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 152	89 KB
1	gravatar.com secure.gravatar.com — Cisco Umbrella Rank: 1680	1 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 293	9 KB
0	nftsgary.com Failed nftsgary.com Failed
70	6

	Domain	Requested by
63	myonlinesecurity.co.uk	1 redirects myonlinesecurity.co.uk
2	connect.facebook.net	myonlinesecurity.co.uk connect.facebook.net
2	assets.pinterest.com	myonlinesecurity.co.uk assets.pinterest.com
1	log.pinterest.com
1	secure.gravatar.com	myonlinesecurity.co.uk
1	ajax.googleapis.com	myonlinesecurity.co.uk
0	nftsgary.com Failed	myonlinesecurity.co.uk
70	7

This site contains links to these domains. Also see Links.

Domain
wordpress.org
www.facebook.com
twitter.com
pinterest.com
www.virustotal.com
app.any.run
support.office.com
products.office.com
en.wikipedia.org
codesupply.co

Subject Issuer	Validity	Valid
myonlinesecurity.co.uk R3	`2022-08-20` - `2022-11-18`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
*.pinterest.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-01` - `2023-08-08`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-07-04` - `2022-10-02`	3 months	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
Frame ID: 6F2036C44AD4F38E8B1F15A1E835063D
Requests: 70 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Lokibot Campaigns Continue With Some Changes To C2 URLs - My Online Security

Page URL History Show full URLs

https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/' HTTP 301
https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Flickity (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/flickity(?:\.pkgd)?(?:\.min)?\.js

Lightbox (JavaScript Libraries) Expand

Pinterest (Widgets) Expand

Overall confidence: 100%
Detected patterns

//assets\.pinterest\.com/js/pinit\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui.*\.js

Page Statistics

70
Requests

99 %
HTTPS

67 %
IPv6

6
Domains

7
Subdomains

7
IPs

4
Countries

926 kB
Transfer

2935 kB
Size

1
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://wordpress.org/
Title: WordPress.org

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
Title: 4

Search URL Search Domain Scan URL

URL: https://twitter.com/share?&text=Lokibot%20Campaigns%20Continue%20With%20Some%20Changes%20To%20C2%20URLs&url=https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
Title: 0

Search URL Search Domain Scan URL

URL: https://pinterest.com/pin/create/bookmarklet/?url=https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/&media=https://myonlinesecurity.co.uk/wp-content/uploads/2022/03/Malware-Download.jpg
Title: 0

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/#/file/4c0be53f6ab8c64063eb70ed62d53f2d54384bbadf9dbe85a64d93aedcfca636/detection
Title: Current Virus total detections

Search URL Search Domain Scan URL

URL: https://app.any.run/tasks/e4f95a31-57f4-4963-8a60-4251eda40fef
Title: Anyrun

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/#/file/83aade137c5932cdfcdbe214120ece80b11dd998e0eeeef2aca4373da50331fc/detection
Title: Virustotal

Search URL Search Domain Scan URL

URL: https://support.office.com/en-gb/article/What-is-Protected-View-d6f09ac7-e6b9-4495-8e43-2bbcdbcb6653
Title: protected view

Search URL Search Domain Scan URL

URL: https://products.office.com/en-gb/office-online/documents-spreadsheets-presentations-office-online
Title: Office Online

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Social_engineering_(security)
Title: Social engineering

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https://myonlinesecurity.co.uk/nanocore-rat-via-fake-dhl-failed-delivery-in-chinese/
Title: 1

Search URL Search Domain Scan URL

URL: https://twitter.com/share?&text=Nanocore%20RAT%20Via%20Fake%20DHL%20Failed%20Delivery%20In%20Chinese&url=https://myonlinesecurity.co.uk/nanocore-rat-via-fake-dhl-failed-delivery-in-chinese/
Title: 0

Search URL Search Domain Scan URL

URL: https://pinterest.com/pin/create/bookmarklet/?url=https://myonlinesecurity.co.uk/nanocore-rat-via-fake-dhl-failed-delivery-in-chinese/&media=https://myonlinesecurity.co.uk/wp-content/uploads/2022/03/Fake.jpg
Title: 0

Search URL Search Domain Scan URL

URL: https://codesupply.co/
Title: Code Supply Co.

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/' HTTP 301
https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

70 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
Redirect Chain

https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/'
https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

155 KB
25 KB

48ms
48ms

Document
text/html

178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

b75d3a0c530614f0a32a3147690456ef434a4196f433a245f206c5e65482e3bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

content-encoding: gzip
content-length: 25114
content-type: text/html; charset=UTF-8
date: Sun, 25 Sep 2022 14:21:09 GMT
server: nginx-rc
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-runcache-type: native
x-runcloud-cache: HIT
x-xss-protection: 1; mode=block

Redirect headers

cache-control: max-age=3600
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 25 Sep 2022 14:21:09 GMT
expires: Sun, 25 Sep 2022 15:21:09 GMT
location: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
server: nginx-rc
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-redirect-by: WordPress
x-runcache-type: native
x-runcloud-cache: MISS
x-xss-protection: 1; mode=block

GET
H2 200 canvas-icons.woff
myonlinesecurity.co.uk/wp-content/plugins/canvas/assets/fonts/ 4 KB
3 KB 35ms
32ms Font
font/woff 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/canvas/assets/fonts/canvas-icons.woff

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

67d85629e2ed1f3ac9a8a7d86dc49c0e9a72ff72ce43e0baef6071c912955943

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
Origin: https://myonlinesecurity.co.uk
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:09 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32ae5-10dc"
x-frame-options: SAMEORIGIN
content-type: font/woff
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:09 GMT

GET
H2 200 7k1w.css
myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/1p6sqd5n/ 176 KB
21 KB 35ms
32ms Stylesheet
text/css 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/1p6sqd5n/7k1w.css

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

ac59c9538d0c3a368bb577c552c83b324811f9314d858affcd23561a19b3dca9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:09 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"630137be-2bf3d"
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
last-modified: Sat, 20 Aug 2022 19:36:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:09 GMT

GET
H2 200 7k1w.css
myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/7ncdzmj5/ 58 KB
8 KB 35ms
33ms Stylesheet
text/css 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/7ncdzmj5/7k1w.css

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

2a75e0bb75d4dd1ce5eb8554c9578274183dceb1b6ed1bd096bbde4bf3565324

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:09 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"630137be-e9a7"
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
last-modified: Sat, 20 Aug 2022 19:36:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:09 GMT

GET
H2 200 7k1w.css
myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/8mkt8tj9/ 19 KB
3 KB 42ms
39ms Stylesheet
text/css 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/8mkt8tj9/7k1w.css

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

312c731a7076932adf41afbb52f75f74249d27bc6a07dfdaf7d8316ac1bef444

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:09 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"630137be-4dc8"
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
last-modified: Sat, 20 Aug 2022 19:36:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:09 GMT

GET
H2 200 7k1w.css
myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/ml9lsze2/ 287 KB
26 KB 42ms
39ms Stylesheet
text/css 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/ml9lsze2/7k1w.css

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

ba4a901c212d12b1968198233b3ac84aef32ea75be2fad6f9a859aa46228af36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:09 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"630137be-47d79"
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
last-modified: Sat, 20 Aug 2022 19:36:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:09 GMT

GET
H2 200 7k1w.css
myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/lkbb81tp/ 5 KB
1011 B 43ms
41ms Stylesheet
text/css 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/lkbb81tp/7k1w.css

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

1aa051ddded1bc293ba7488c30787a5ec73261abe9f7a4884bbedad3bbcb146e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:09 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"630137be-1299"
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
last-modified: Sat, 20 Aug 2022 19:36:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:09 GMT

GET
H2 200 jquery-ui.css
ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/ 36 KB
9 KB 114ms
37ms Stylesheet
text/css 2a00:1450:400e:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/jquery-ui.css?ver=6.0.1

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:810::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9b751c1cd0d2b0f91862db987fed9dda48758b15e6f42ca67796b45f4b21702

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 13:08:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 177186
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8422
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Sep 2023 13:08:04 GMT

GET
H2 200 7k1w.css
myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/f6gliwrn/ 504 KB
79 KB 43ms
41ms Stylesheet
text/css 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/f6gliwrn/7k1w.css

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

971ed9bf94081489606f13c0be7f8fde290027529d340ecfe344cb0348b29321

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:09 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"630137be-7e07c"
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
last-modified: Sat, 20 Aug 2022 19:36:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:09 GMT

GET
H2 200 7k1w.css
myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/fft1fdfg/ 1 KB
776 B 43ms
41ms Stylesheet
text/css 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/fft1fdfg/7k1w.css

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

0d9f01921dd2ce058185faec0a3592af140250eb40b7b0373538733b019fd49e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:09 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"630137be-561"
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
last-modified: Sat, 20 Aug 2022 19:36:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:09 GMT

GET
H2 200 7k1w.js Show response
myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/dg5e18zy/ 109 KB
35 KB 43ms
42ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/dg5e18zy/7k1w.js

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

9897f73963bca7fd213900d513d9b1834031f61973b83cca84c937f0f25c92de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:09 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"630137be-1b49a"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Sat, 20 Aug 2022 19:36:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:09 GMT

GET
H2 200 7k1w.js Show response
myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/20g6bnaw/ 75 KB
19 KB 44ms
42ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/20g6bnaw/7k1w.js

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

d1bb8df804e7c7c6b89f17abc970f817aa52064c5366670a0a149e08d4f3a365

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:09 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"630137be-12d31"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Sat, 20 Aug 2022 19:36:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:09 GMT

GET
H2 200 absolute-reviews-icons.woff
myonlinesecurity.co.uk/wp-content/plugins/absolute-reviews/fonts/ 3 KB
2 KB 93ms
92ms Font
font/woff 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/absolute-reviews/fonts/absolute-reviews-icons.woff

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

373bd9801efeaea7297d3754cb07c69133441d1e7dec426316ebf73f056a633f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
Origin: https://myonlinesecurity.co.uk
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32ae2-b94"
x-frame-options: SAMEORIGIN
content-type: font/woff
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 advanced-popups-icons.woff
myonlinesecurity.co.uk/wp-content/plugins/advanced-popups/fonts/ 1 KB
993 B 94ms
93ms Font
font/woff 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/advanced-popups/fonts/advanced-popups-icons.woff

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

318c46c474af05599ec3a9d9ab778c68dc21955b4109bdd40150c75f04cff167

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
Origin: https://myonlinesecurity.co.uk
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32ae4-55c"
x-frame-options: SAMEORIGIN
content-type: font/woff
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 public-block-alert.js Show response
myonlinesecurity.co.uk/wp-content/plugins/canvas/components/basic-elements/block-alert/ 236 B
471 B 30ms
30ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/canvas/components/basic-elements/block-alert/public-block-alert.js?ver=2.3.7

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

832ab1b4aa67dc13f7bd3a4edadfd0f2e41a421400eb6249ae5d7548d0a0fb60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32ae5-ec"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 public-block-collapsibles.js Show response
myonlinesecurity.co.uk/wp-content/plugins/canvas/components/basic-elements/block-collapsibles/ 755 B
591 B 30ms
30ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/canvas/components/basic-elements/block-collapsibles/public-block-collapsibles.js?ver=2.3.7

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

1a2c518645f351b7c0a5d4750a977bea702f9b35b7b8bad0246caf2a15da8444

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32ae5-2f3"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 public-block-tabs.js Show response
myonlinesecurity.co.uk/wp-content/plugins/canvas/components/basic-elements/block-tabs/ 736 B
590 B 42ms
31ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/canvas/components/basic-elements/block-tabs/public-block-tabs.js?ver=2.3.7

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

aca64aad202a0caa0622d7a5ccc762dd41c00f30607c549f16e5bfce44a3e32d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32ae5-2e0"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 jquery.justifiedGallery.min.js Show response
myonlinesecurity.co.uk/wp-content/plugins/canvas/components/justified-gallery/block/ 18 KB
5 KB 42ms
31ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/canvas/components/justified-gallery/block/jquery.justifiedGallery.min.js?ver=2.3.7

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

47d0390fea1660753108946b180abe68897b889f6b448d0adc0f10f508661ed8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32ae5-484f"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 public-block-justified-gallery.js Show response
myonlinesecurity.co.uk/wp-content/plugins/canvas/components/justified-gallery/block/ 2 KB
937 B 42ms
32ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/canvas/components/justified-gallery/block/public-block-justified-gallery.js?ver=2.3.7

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

8a9ecdb41088e36f1f44732089683e2cd0baabd42f40de94ada612c371461f3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32ae5-6a2"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 imagesloaded.min.js Show response
myonlinesecurity.co.uk/wp-includes/js/ 5 KB
2 KB 42ms
32ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-includes/js/imagesloaded.min.js?ver=4.1.4

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"61f7e333-15fd"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Mon, 31 Jan 2022 13:25:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 flickity.pkgd.min.js Show response
myonlinesecurity.co.uk/wp-content/plugins/canvas/components/slider-gallery/block/ 53 KB
13 KB 42ms
32ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/canvas/components/slider-gallery/block/flickity.pkgd.min.js?ver=2.3.7

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

407c57f44df9370aa9daf3f6db4458de526dfaf6c825c9017b1206537c91aca9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32ae5-d33c"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 public-block-slider-gallery.js Show response
myonlinesecurity.co.uk/wp-content/plugins/canvas/components/slider-gallery/block/ 2 KB
1 KB 42ms
33ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/canvas/components/slider-gallery/block/public-block-slider-gallery.js?ver=2.3.7

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

62ab2ed25887f741906e8d20701a2dcef183af815995d32ed5abca3076ee3bde

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32ae5-911"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 regenerator-runtime.min.js Show response
myonlinesecurity.co.uk/wp-includes/js/dist/vendor/ 6 KB
3 KB 43ms
33ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

f30769ea0b80a5d900c5f0de30b1aad1ab461195e69223d5ef63c2c5de8b6c1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"628d6cfa-194b"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Tue, 24 May 2022 23:40:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 wp-polyfill.min.js Show response
myonlinesecurity.co.uk/wp-includes/js/dist/vendor/ 19 KB
7 KB 43ms
33ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

6fecb89a29ee2bd397bb1bf58ecaa530a76f0654db71fadefd3cc70b0bc302bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"628d6cfa-4ac6"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Tue, 24 May 2022 23:40:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 index.js Show response
myonlinesecurity.co.uk/wp-content/plugins/contact-form-7/includes/js/ 21 KB
6 KB 43ms
34ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.6

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

7abd36a2f651330420d86187c125331d679408d1be7b6cd93efa64e08eaf80c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62b9b00a-553d"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Mon, 27 Jun 2022 13:26:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 public-powerkit-basic-elements.js Show response
myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/basic-elements/public/js/ 1 KB
729 B 43ms
34ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/basic-elements/public/js/public-powerkit-basic-elements.js?ver=4.0.0

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

32879ecf9aea0b36eb97887c282c3edf857d3dab33fe098fd4047be1c0edeb4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32aea-4cf"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 public-powerkit-justified-gallery.js Show response
myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/justified-gallery/public/js/ 2 KB
934 B 43ms
35ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/justified-gallery/public/js/public-powerkit-justified-gallery.js?ver=2.7.6

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

e6888cd690ab2b9c9361b3e1bdccdfa37be04374c5ab731d7651bbcae5eab6c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32aea-698"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 glightbox.min.js Show response
myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/lightbox/public/js/ 55 KB
15 KB 43ms
35ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/lightbox/public/js/glightbox.min.js?ver=2.7.6

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

267ab4a5ea85c601950cdb29b6e278c024b3e1be38d2ba27d2c39523c2e34741

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32aea-db9e"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 public-powerkit-lightbox.js Show response
myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/lightbox/public/js/ 4 KB
2 KB 43ms
35ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/lightbox/public/js/public-powerkit-lightbox.js?ver=2.7.6

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

e8b9704ac1420eca9d1fc12052ec43b1dc680cc85ddfa8c82387291fcce90c10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32aea-1143"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 public-powerkit-opt-in-forms.js Show response
myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/opt-in-forms/public/js/ 1 KB
816 B 43ms
36ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/opt-in-forms/public/js/public-powerkit-opt-in-forms.js?ver=2.7.6

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

565637476a6f33a1187e3dc40aa6f65fda018dd1ed19f088490bdd2c2076b6d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32aea-551"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 pinit.js Show response
assets.pinterest.com/js/ 361 B
448 B 321ms
57ms Script
application/javascript 2a02:26f0:dc:282::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.pinterest.com/js/pinit.js?ver=6.0.1
Requested by: Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:dc:282::1931 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 3faadebc89cdb21d11634a032816f152462d1cb8903eb21d0642501fcad065de

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

akamai-x-true-ttl: 300
content-encoding: br
x-cdn: akamai
etag: "62d32c28f14783b94192cd8d35bc010d"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: max-age=218
accept-ranges: bytes
content-length: 203
access-control-expose-headers: X-CDN

GET
H2 200 public-powerkit-pin-it.js Show response
myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/pinterest/public/js/ 5 KB
2 KB 43ms
36ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/pinterest/public/js/public-powerkit-pin-it.js?ver=2.7.6

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

9ebf830ab30802bb8a6e9929e4ab59ef403ee5d98aebe086b9f3615a09fad3b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32aea-125a"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 public-powerkit-scroll-to-top.js Show response
myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/scroll-to-top/public/js/ 507 B
568 B 43ms
36ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/scroll-to-top/public/js/public-powerkit-scroll-to-top.js?ver=2.7.6

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

f5d1555ca1d1736e61e55fa9abd975a91b48490c4582944fe2d23c22b20b817f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32aea-1fb"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 public-powerkit-share-buttons.js Show response
myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/share-buttons/public/js/ 3 KB
1 KB 43ms
36ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/share-buttons/public/js/public-powerkit-share-buttons.js?ver=2.7.6

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

d4da2752a0c926a286a5ed2627348471eb7fc863524622afdfe5314759be02fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32aea-c0f"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 public-powerkit-slider-gallery.js Show response
myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/slider-gallery/public/js/ 2 KB
1 KB 43ms
37ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/slider-gallery/public/js/public-powerkit-slider-gallery.js?ver=2.7.6

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

50c65d09bcac0e138d268b7ddb4bbad014becccdba7c1eb07af05cf4dff244c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32aea-90d"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 public-powerkit-table-of-contents.js Show response
myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/table-of-contents/public/js/ 3 KB
1 KB 43ms
37ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/powerkit/modules/table-of-contents/public/js/public-powerkit-table-of-contents.js?ver=2.7.6

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

6abe50ef3e60504ea153ca28d383b84b8b184428f316d1038feebd6282463d52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32aea-b16"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 jquery.magnific-popup.min.js Show response
myonlinesecurity.co.uk/wp-content/plugins/sight/render/js/ 20 KB
7 KB 43ms
37ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/sight/render/js/jquery.magnific-popup.min.js?ver=1654860524

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

9cd173d2b12a4a3b2295ae2f67bca95a8916fcfbe8d528a85e8528d6baeca9b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32aec-4ef9"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 sight.js Show response
myonlinesecurity.co.uk/wp-content/plugins/sight/render/js/ 34 KB
7 KB 67ms
62ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/sight/render/js/sight.js?ver=1654860524

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

95e6c8cb5da7b91b5f4df97676e6a40d5a7566a277d3c98664e6fafe77008ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32aec-885a"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 ResizeSensor.js Show response
myonlinesecurity.co.uk/wp-content/plugins/theia-sticky-sidebar/js/ 6 KB
2 KB 68ms
62ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/theia-sticky-sidebar/js/ResizeSensor.js?ver=1.7.0

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

2f826a947a47c13c4af480b9b7853e9ca12d2873c67a9200f3c7a26f8cacae2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32cb0-1743"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:36:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 theia-sticky-sidebar.js Show response
myonlinesecurity.co.uk/wp-content/plugins/theia-sticky-sidebar/js/ 16 KB
4 KB 68ms
62ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/theia-sticky-sidebar/js/theia-sticky-sidebar.js?ver=1.7.0

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

27f4119ce2d66a40ef8beba62ec4d995e95af50550c6d4471eec9eb27fa73774

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32cb0-3e36"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:36:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 main.js Show response
myonlinesecurity.co.uk/wp-content/plugins/theia-sticky-sidebar/js/ 435 B
490 B 68ms
62ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/theia-sticky-sidebar/js/main.js?ver=1.7.0

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

3e304dfe39fde10af2ee219f794108f785d18dd88658877ddf07bce099f6a9fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32cb0-1b3"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:36:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 core.min.js Show response
myonlinesecurity.co.uk/wp-includes/js/jquery/ui/ 20 KB
7 KB 68ms
63ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-includes/js/jquery/ui/core.min.js?ver=1.13.1

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

240b702419d6c39ecc4896f0132ccfc9bc517e9aef0c782d99580e0c678b47d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"628d6cfa-50eb"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Tue, 24 May 2022 23:40:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 jquery.sticky-kit.min.js Show response
myonlinesecurity.co.uk/wp-content/plugins/zoxpress-plugin//scripts/ 3 KB
1 KB 68ms
63ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/zoxpress-plugin//scripts/jquery.sticky-kit.min.js?ver=6.0.1

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

8e8230f2d1e6e230d63f5bd3091ea092eb8d1f447b5f6c84c5b776cf4f50a65d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32caf-aee"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:36:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 jquery.waypoints.min.js Show response
myonlinesecurity.co.uk/wp-content/plugins/zoxpress-plugin//scripts/ 10 KB
3 KB 68ms
63ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/zoxpress-plugin//scripts/jquery.waypoints.min.js?ver=6.0.1

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

42656c5a534309426b3c5452b07c4013df29165e754e36e51d724ad962bebc1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32caf-28ee"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:36:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 jquery.nouislider.all.min.js Show response
myonlinesecurity.co.uk/wp-content/plugins/reviewer/public/assets/js/ 18 KB
7 KB 68ms
63ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/reviewer/public/assets/js/jquery.nouislider.all.min.js?ver=3.14.2

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

bbf94e5438333ae008e9b742cf1dd74dd310f7385ebe6f9ef4fdc82976de34a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32caf-466e"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:36:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 photoswipe.js Show response
myonlinesecurity.co.uk/wp-content/plugins/reviewer/public/assets/js/ 40 KB
15 KB 68ms
64ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/reviewer/public/assets/js/photoswipe.js?ver=3.14.2

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

9ca0e984615396c430f5f5b0071acf29a6ee2086c33dd2992a0722222e10a0ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32caf-a1ab"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:36:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 jquery.knob.js Show response
myonlinesecurity.co.uk/wp-content/plugins/reviewer/public/assets/js/ 24 KB
6 KB 68ms
64ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/reviewer/public/assets/js/jquery.knob.js?ver=3.14.2

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

0bfc0795245dfb367e2600f248ee85a485c8acb3d23409f8dd5dffdb2845576d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32caf-6158"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:36:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 reviewer.public.min.js Show response
myonlinesecurity.co.uk/wp-content/plugins/reviewer/public/assets/js/ 4 KB
2 KB 69ms
64ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/reviewer/public/assets/js/reviewer.public.min.js?ver=3.14.2

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

4cd14927179cd88891fae3057a4ce4a7cf499af73f65c3b2e83f32e1598c0288

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32caf-e80"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:36:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 reviewer-reviews-boxes.js Show response
myonlinesecurity.co.uk/wp-content/plugins/reviewer/public/assets/js/ 131 KB
42 KB 69ms
65ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/reviewer/public/assets/js/reviewer-reviews-boxes.js?ver=3.14.2

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

6b56887afb6436cbf903b3339832656cd04ed202eef5629be210fc10cb1355c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32caf-20d63"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:36:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 reviewer-widget-users-reviews.js Show response
myonlinesecurity.co.uk/wp-content/plugins/reviewer/public/assets/js/ 90 KB
31 KB 69ms
65ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/reviewer/public/assets/js/reviewer-widget-users-reviews.js?ver=3.14.2

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

e71bfe0dbb5b7a9cf82ab6f1165c8831077302ef10dd60e02cfb5a338c5c1ac1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32caf-168de"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:36:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 scripts.js Show response
myonlinesecurity.co.uk/wp-content/themes/newsblock/assets/js/ 54 KB
12 KB 69ms
65ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/themes/newsblock/assets/js/scripts.js?ver=1.2.1

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

010096922672db0118391c4483a9756b559cc1358a9c127da9d625b8d5e162d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32d06-d865"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:37:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 comment-reply.min.js Show response
myonlinesecurity.co.uk/wp-includes/js/ 3 KB
2 KB 69ms
65ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-includes/js/comment-reply.min.js?ver=6.0.1

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"628d6cfa-ba5"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Tue, 24 May 2022 23:40:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 script.min.js Show response
myonlinesecurity.co.uk/wp-content/plugins/searchwp-live-ajax-search/assets/javascript/dist/ 11 KB
4 KB 69ms
66ms Script
application/javascript 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/searchwp-live-ajax-search/assets/javascript/dist/script.min.js?ver=1.6.3

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

aae323aae1b82ab324f2f2093cb59bef2b7c70399101ed51ee66adcf1b7e2aec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32d56-2b46"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:39:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 HTxwL3I-JCGChYJ8VI-L6OO_au7B4873z3bWv4MBYro.woff
myonlinesecurity.co.uk/wp-content/fonts/barlow-condensed/ 17 KB
18 KB 62ms
62ms Font
font/woff 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/fonts/barlow-condensed/HTxwL3I-JCGChYJ8VI-L6OO_au7B4873z3bWv4MBYro.woff

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

e7f3f73dee581e32eb4866f8cc84b49ec27a162bf4e35dd35837c93591d1d25b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
Origin: https://myonlinesecurity.co.uk
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32d86-4570"
x-frame-options: SAMEORIGIN
content-type: font/woff
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:39:50 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 icons.ttf
myonlinesecurity.co.uk/wp-content/themes/newsblock/assets/static/icon-fonts/ 14 KB
7 KB 63ms
62ms Font
application/octet-stream 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/themes/newsblock/assets/static/icon-fonts/icons.ttf

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/f6gliwrn/7k1w.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

6c1e20ddb86a549229ab1410b3de82a590ae9ed9687cc59023721f45dd6b0004

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/f6gliwrn/7k1w.css
Origin: https://myonlinesecurity.co.uk
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32d06-3930"
x-frame-options: SAMEORIGIN
content-type: application/octet-stream
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:37:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRfp66_B2sjqZ6GfQ.woff
myonlinesecurity.co.uk/wp-content/fonts/barlow-semi-condensed/ 18 KB
19 KB 63ms
62ms Font
font/woff 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/fonts/barlow-semi-condensed/wlpigxjLBV1hqnzfr-F8sEYMB0Yybp0mudRfp66_B2sjqZ6GfQ.woff

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

79fda2930999aa8ae47791d2da40184ad1fe60f948c9bfad81b1404436c01aca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
Origin: https://myonlinesecurity.co.uk
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32d86-49c8"
x-frame-options: SAMEORIGIN
content-type: font/woff
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:39:50 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 xn7_YHE41ni1AdIRqAuZuw1Bx9mbZk79FN_C-b_Tfc7AKrU.woff
myonlinesecurity.co.uk/wp-content/fonts/manrope/ 17 KB
18 KB 51ms
51ms Font
font/woff 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/fonts/manrope/xn7_YHE41ni1AdIRqAuZuw1Bx9mbZk79FN_C-b_Tfc7AKrU.woff

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

241189206cd76ac68cf6325beea8b1f936669a63589896b38c432ca42cd15a7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
Origin: https://myonlinesecurity.co.uk
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62d31f7f-44dc"
x-frame-options: SAMEORIGIN
content-type: font/woff
cache-control: max-age=2592000
last-modified: Sat, 16 Jul 2022 20:28:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 160ms
53ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

24313b5b756fada2ab2143dd6cf96579b81741d02f41b5b67940534a815b424e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: ZDIyi66LglugSGymCBQ/VA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 1686
x-fb-rlafr: 0
x-fb-debug: jLVveRB/MnMcl1PSBLXwDuVc+yPHTIrIq7n6sneT9h+uTWnaLUiASLbhvI3GIPYl94wFGvJysDR1rtlDQm2wQA==
x-fb-trip-id: 2071890597
x-fb-content-md5: 3ea9b5d2ed33958863a5bd22db117557
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sun, 25 Sep 2022 14:21:10 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "216cb8a48f72f44fea9b87d56d11d2e5"
timing-allow-origin: *
priority: u=3,i
expires: Sun, 25 Sep 2022 14:30:56 GMT

GET
H2 200 powerkit-icons.woff
myonlinesecurity.co.uk/wp-content/plugins/powerkit/assets/fonts/ 25 KB
16 KB 54ms
52ms Font
font/woff 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/plugins/powerkit/assets/fonts/powerkit-icons.woff

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/1p6sqd5n/7k1w.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

05a1dbfe780fd6bdd0718ae8819a959125caa7507c0f65ebc2175b4d8c752bab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/1p6sqd5n/7k1w.css
Origin: https://myonlinesecurity.co.uk
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62a32aea-64a8"
x-frame-options: SAMEORIGIN
content-type: font/woff
cache-control: max-age=2592000
last-modified: Fri, 10 Jun 2022 11:28:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 xn7_YHE41ni1AdIRqAuZuw1Bx9mbZk4jE9_C-b_Tfc7AKrU.woff
myonlinesecurity.co.uk/wp-content/fonts/manrope/ 17 KB
18 KB 54ms
53ms Font
font/woff 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/fonts/manrope/xn7_YHE41ni1AdIRqAuZuw1Bx9mbZk4jE9_C-b_Tfc7AKrU.woff

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

1d9bbceeaa8d722226927cd6dca663043f8d47c5a645e46fd737f1f5785e27cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
Origin: https://myonlinesecurity.co.uk
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62d31f80-451c"
x-frame-options: SAMEORIGIN
content-type: font/woff
cache-control: max-age=2592000
last-modified: Sat, 16 Jul 2022 20:28:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 xn7_YHE41ni1AdIRqAuZuw1Bx9mbZk4aE9_C-b_Tfc7AKrU.woff
myonlinesecurity.co.uk/wp-content/fonts/manrope/ 17 KB
18 KB 54ms
53ms Font
font/woff 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-content/fonts/manrope/xn7_YHE41ni1AdIRqAuZuw1Bx9mbZk4aE9_C-b_Tfc7AKrU.woff

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

97b53048de12587b86e5e838efc7cd49b740dc3318764521845c957496f1398f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
Origin: https://myonlinesecurity.co.uk
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"62d31f80-4534"
x-frame-options: SAMEORIGIN
content-type: font/woff
cache-control: max-age=2592000
last-modified: Sat, 16 Jul 2022 20:28:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 62e2f8bdb3ba2810ada7f77a52e22c50
secure.gravatar.com/avatar/ 901 B
1 KB 106ms
29ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/62e2f8bdb3ba2810ada7f77a52e22c50?s=26&d=mm&r=g
Requested by: Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 96d69c07de6945a7f3b199641074634c0b3a6271ddf0f360acc93b113666f797

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-nc: HIT lhr 4
date: Sun, 25 Sep 2022 14:21:10 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="62e2f8bdb3ba2810ada7f77a52e22c50.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/62e2f8bdb3ba2810ada7f77a52e22c50?s=26&d=mm&r=g>; rel="canonical"
content-length: 901
expires: Sun, 25 Sep 2022 14:26:10 GMT

GET
H2 200 Malware-Download.jpg
myonlinesecurity.co.uk/wp-content/uploads/2022/03/ 180 KB
166 KB 31ms
30ms Image
image/jpeg 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://myonlinesecurity.co.uk/wp-content/uploads/2022/03/Malware-Download.jpg

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

05a86a6c3f1790637ac32b6ab4989e025f0237c3aeb4f177e355a4a93ed0e060

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"623aaf02-2ce32"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=2592000
last-modified: Wed, 23 Mar 2022 05:24:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H2 200 Fake-Request-for-Invoice-email.jpg
myonlinesecurity.co.uk/wp-content/uploads/2022/02/ 116 KB
94 KB 31ms
30ms Image
image/jpeg 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://myonlinesecurity.co.uk/wp-content/uploads/2022/02/Fake-Request-for-Invoice-email.jpg

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

3a6ea1a53be34fc630f59bb5ad426e0dac8655da3a979410d99fd3aa32ead76b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
x-runcache-type: native
server: nginx-rc
etag: W/"621d69b3-1ceba"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=2592000
last-modified: Tue, 01 Mar 2022 00:32:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-xss-protection: 1; mode=block
expires: Tue, 25 Oct 2022 14:21:10 GMT

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 318 KB
87 KB 104ms
51ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=b872528f7fa84a81db142453ae8f47ef

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c1cc16bbbfd5eb5ce2b49b8f8dffaa85d4da5296f6cea0c9bd2e0b65620b7de9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://myonlinesecurity.co.uk/
Origin: https://myonlinesecurity.co.uk
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: kHdIMYZ1cP+7y+ZMdLsOMQ==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 88799
x-fb-rlafr: 0
x-fb-debug: ZnqOmNLqDG65Evi01XPrw/BX3CsBxtOBCCuwHh4jJo2miCMKKNpz3ph8pz4U/MOG6iOBZ8WSD8tjkLFvyhiP4g==
x-fb-content-md5: 18488dcbb96e006712082cd3bd31a9fc
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sun, 25 Sep 2022 14:21:10 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "29100f25d9714febce57a744fe03db27"
timing-allow-origin: *
priority: u=3,i
expires: Mon, 25 Sep 2023 13:20:22 GMT

GET Macros.png
nftsgary.com/wp-content/uploads/2022/02/ 0
0

GET
H2 200 pinit_main.js Show response
assets.pinterest.com/js/ 66 KB
19 KB 56ms
56ms Script
application/javascript 2a02:26f0:dc:282::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.pinterest.com/js/pinit_main.js?0.9943897158863102
Requested by: Host: assets.pinterest.com
URL: https://assets.pinterest.com/js/pinit.js?ver=6.0.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:dc:282::1931 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 20f0315c97ff7007f2e7a94d659e094a7efc01b8306da53987538c1101489e0e

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

akamai-x-true-ttl: 300
content-encoding: br
x-cdn: akamai
etag: "3725764cf05d1a0938de73d398772331"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: max-age=176
accept-ranges: bytes
content-length: 18679
access-control-expose-headers: X-CDN

GET
H2 200 get-shares Show response
myonlinesecurity.co.uk/wp-json/social-share/v1/ 196 B
603 B 269ms
267ms XHR
application/json 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://myonlinesecurity.co.uk/wp-json/social-share/v1/get-shares?ids=facebook%2Ctwitter%2Cpinterest&post_id=236&url=https%3A%2F%2Fmyonlinesecurity.co.uk%2Flokibot-campaigns-continue-with-some-changes-to-c2-urls%2F

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/dg5e18zy/7k1w.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

a02834bd70a2e51054679ca3792b670d89618b18695ec66d1d5a79de82693b6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
X-Requested-With: XMLHttpRequest
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:10 GMT
content-encoding: br
x-content-type-options: nosniff, nosniff
x-runcloud-cache: BYPASS
vary: Accept-Encoding, Origin
x-xss-protection: 1; mode=block
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
allow: GET
x-runcache-type: native
server: nginx-rc
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
x-robots-tag: noindex
link: <https://myonlinesecurity.co.uk/wp-json/>; rel="https://api.w.org/"

GET
H2 200 get-shares Show response
myonlinesecurity.co.uk/wp-json/social-share/v1/ 196 B
603 B 487ms
485ms XHR
application/json 178.62.74.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: myonlinesecurity.co.uk
URL: https://myonlinesecurity.co.uk/wp-content/cache/wpfc-minified/dg5e18zy/7k1w.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.62.74.125 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

a02834bd70a2e51054679ca3792b670d89618b18695ec66d1d5a79de82693b6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://myonlinesecurity.co.uk/lokibot-campaigns-continue-with-some-changes-to-c2-urls/
X-Requested-With: XMLHttpRequest
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:11 GMT
content-encoding: br
x-content-type-options: nosniff, nosniff
x-runcloud-cache: BYPASS
vary: Accept-Encoding, Origin
x-xss-protection: 1; mode=block
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
allow: GET
x-runcache-type: native
server: nginx-rc
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
x-robots-tag: noindex
link: <https://myonlinesecurity.co.uk/wp-json/>; rel="https://api.w.org/"

GET
H2 200 /
log.pinterest.com/ 0
334 B 301ms
114ms Image
text/plain 151.101.64.84
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://log.pinterest.com/?type=pidget&guid=bc7an2103e12&tv=2021110201&event=init&sub=www&button_count=0&follow_count=0&pin_count=0&profile_count=0&board_count=0&section_count=0&lang=en&nvl=en-US&via=https%3A%2F%2Fmyonlinesecurity.co.uk%2Flokibot-campaigns-continue-with-some-changes-to-c2-urls%2F&viaSrc=canonical
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.64.84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://myonlinesecurity.co.uk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 14:21:11 GMT
via: 1.1 varnish
x-cache: MISS
x-envoy-upstream-service-time: 3
x-cache-hits: 0
content-length: 0
x-served-by: cache-lcy19273-LCY
pragma: no-cache
server: envoy
x-timer: S1664115672.785809,VS0,VE84
access-control-max-age: 86400
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-pinterest-rid: 1348448416946340
accept-ranges: bytes
expires: Sat, 01 Jan 2000 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: nftsgary.com
URL: https://nftsgary.com/wp-content/uploads/2022/02/Macros.png

Verdicts & Comments Add Verdict or Comment

69 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			myonlinesecurity.co.uk/	1969-12-31 23:59:59	Name: _color_system_schema Value: default

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://nftsgary.com/wp-content/uploads/2022/02/Macros.png Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
assets.pinterest.com
connect.facebook.net
log.pinterest.com
myonlinesecurity.co.uk
nftsgary.com
secure.gravatar.com
nftsgary.com
151.101.64.84
178.62.74.125
2a00:1450:400e:810::200a
2a02:26f0:dc:282::1931
2a03:2880:f007:8:face:b00c:0:1
2a04:fa87:fffe::c000:4902
010096922672db0118391c4483a9756b559cc1358a9c127da9d625b8d5e162d7
05a1dbfe780fd6bdd0718ae8819a959125caa7507c0f65ebc2175b4d8c752bab
05a86a6c3f1790637ac32b6ab4989e025f0237c3aeb4f177e355a4a93ed0e060
0bfc0795245dfb367e2600f248ee85a485c8acb3d23409f8dd5dffdb2845576d
0d9f01921dd2ce058185faec0a3592af140250eb40b7b0373538733b019fd49e
1a2c518645f351b7c0a5d4750a977bea702f9b35b7b8bad0246caf2a15da8444
1aa051ddded1bc293ba7488c30787a5ec73261abe9f7a4884bbedad3bbcb146e
1d9bbceeaa8d722226927cd6dca663043f8d47c5a645e46fd737f1f5785e27cf
20f0315c97ff7007f2e7a94d659e094a7efc01b8306da53987538c1101489e0e
240b702419d6c39ecc4896f0132ccfc9bc517e9aef0c782d99580e0c678b47d5
241189206cd76ac68cf6325beea8b1f936669a63589896b38c432ca42cd15a7b
24313b5b756fada2ab2143dd6cf96579b81741d02f41b5b67940534a815b424e
267ab4a5ea85c601950cdb29b6e278c024b3e1be38d2ba27d2c39523c2e34741
27f4119ce2d66a40ef8beba62ec4d995e95af50550c6d4471eec9eb27fa73774
2a75e0bb75d4dd1ce5eb8554c9578274183dceb1b6ed1bd096bbde4bf3565324
2f826a947a47c13c4af480b9b7853e9ca12d2873c67a9200f3c7a26f8cacae2d
312c731a7076932adf41afbb52f75f74249d27bc6a07dfdaf7d8316ac1bef444
318c46c474af05599ec3a9d9ab778c68dc21955b4109bdd40150c75f04cff167
32879ecf9aea0b36eb97887c282c3edf857d3dab33fe098fd4047be1c0edeb4a
373bd9801efeaea7297d3754cb07c69133441d1e7dec426316ebf73f056a633f
3a6ea1a53be34fc630f59bb5ad426e0dac8655da3a979410d99fd3aa32ead76b
3e304dfe39fde10af2ee219f794108f785d18dd88658877ddf07bce099f6a9fa
3faadebc89cdb21d11634a032816f152462d1cb8903eb21d0642501fcad065de
407c57f44df9370aa9daf3f6db4458de526dfaf6c825c9017b1206537c91aca9
42656c5a534309426b3c5452b07c4013df29165e754e36e51d724ad962bebc1f
47d0390fea1660753108946b180abe68897b889f6b448d0adc0f10f508661ed8
4cd14927179cd88891fae3057a4ce4a7cf499af73f65c3b2e83f32e1598c0288
50c65d09bcac0e138d268b7ddb4bbad014becccdba7c1eb07af05cf4dff244c0
565637476a6f33a1187e3dc40aa6f65fda018dd1ed19f088490bdd2c2076b6d8
62ab2ed25887f741906e8d20701a2dcef183af815995d32ed5abca3076ee3bde
67d85629e2ed1f3ac9a8a7d86dc49c0e9a72ff72ce43e0baef6071c912955943
6abe50ef3e60504ea153ca28d383b84b8b184428f316d1038feebd6282463d52
6b56887afb6436cbf903b3339832656cd04ed202eef5629be210fc10cb1355c5
6c1e20ddb86a549229ab1410b3de82a590ae9ed9687cc59023721f45dd6b0004
6fecb89a29ee2bd397bb1bf58ecaa530a76f0654db71fadefd3cc70b0bc302bf
79fda2930999aa8ae47791d2da40184ad1fe60f948c9bfad81b1404436c01aca
7abd36a2f651330420d86187c125331d679408d1be7b6cd93efa64e08eaf80c7
832ab1b4aa67dc13f7bd3a4edadfd0f2e41a421400eb6249ae5d7548d0a0fb60
8a9ecdb41088e36f1f44732089683e2cd0baabd42f40de94ada612c371461f3c
8e8230f2d1e6e230d63f5bd3091ea092eb8d1f447b5f6c84c5b776cf4f50a65d
95e6c8cb5da7b91b5f4df97676e6a40d5a7566a277d3c98664e6fafe77008ae0
96d69c07de6945a7f3b199641074634c0b3a6271ddf0f360acc93b113666f797
971ed9bf94081489606f13c0be7f8fde290027529d340ecfe344cb0348b29321
97b53048de12587b86e5e838efc7cd49b740dc3318764521845c957496f1398f
9897f73963bca7fd213900d513d9b1834031f61973b83cca84c937f0f25c92de
9ca0e984615396c430f5f5b0071acf29a6ee2086c33dd2992a0722222e10a0ed
9cd173d2b12a4a3b2295ae2f67bca95a8916fcfbe8d528a85e8528d6baeca9b2
9ebf830ab30802bb8a6e9929e4ab59ef403ee5d98aebe086b9f3615a09fad3b4
a02834bd70a2e51054679ca3792b670d89618b18695ec66d1d5a79de82693b6b
aae323aae1b82ab324f2f2093cb59bef2b7c70399101ed51ee66adcf1b7e2aec
ac59c9538d0c3a368bb577c552c83b324811f9314d858affcd23561a19b3dca9
aca64aad202a0caa0622d7a5ccc762dd41c00f30607c549f16e5bfce44a3e32d
b75d3a0c530614f0a32a3147690456ef434a4196f433a245f206c5e65482e3bb
ba4a901c212d12b1968198233b3ac84aef32ea75be2fad6f9a859aa46228af36
bbf94e5438333ae008e9b742cf1dd74dd310f7385ebe6f9ef4fdc82976de34a6
c1cc16bbbfd5eb5ce2b49b8f8dffaa85d4da5296f6cea0c9bd2e0b65620b7de9
d1bb8df804e7c7c6b89f17abc970f817aa52064c5366670a0a149e08d4f3a365
d4da2752a0c926a286a5ed2627348471eb7fc863524622afdfe5314759be02fa
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6888cd690ab2b9c9361b3e1bdccdfa37be04374c5ab731d7651bbcae5eab6c9
e71bfe0dbb5b7a9cf82ab6f1165c8831077302ef10dd60e02cfb5a338c5c1ac1
e7f3f73dee581e32eb4866f8cc84b49ec27a162bf4e35dd35837c93591d1d25b
e8b9704ac1420eca9d1fc12052ec43b1dc680cc85ddfa8c82387291fcce90c10
f30769ea0b80a5d900c5f0de30b1aad1ab461195e69223d5ef63c2c5de8b6c1a
f5d1555ca1d1736e61e55fa9abd975a91b48490c4582944fe2d23c22b20b817f
f9b751c1cd0d2b0f91862db987fed9dda48758b15e6f42ca67796b45f4b21702
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

myonlinesecurity.co.uk Open in urlscan Pro 178.62.74.125 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

70 Requests

99 %HTTPS

67 %IPv6

6 Domains

7 Subdomains

7 IPs

4 Countries

926 kBTransfer

2935 kBSize

1 Cookies

14 Outgoing links

Page URL History

Redirected requests

70 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

myonlinesecurity.co.uk Open in urlscan Pro
178.62.74.125 Public Scan

Screenshot
Live screenshot

Full Image

70
Requests

99 %
HTTPS

67 %
IPv6

6
Domains

7
Subdomains

7
IPs

4
Countries

926 kB
Transfer

2935 kB
Size

1
Cookies

70 HTTP transactions
0 data transactions