URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Submission: On October 01 via api from US

Summary

This website contacted 25 IPs in 5 countries across 18 domains to perform 143 HTTP transactions. The main IP is 2001:8d8:100f:f000::289, located in Germany and belongs to ONEANDONE-AS Brauerstrasse 48, DE. The main domain is securityaffairs.co.
TLS certificate: Issued by GeoTrust RSA CA 2018 on February 21st 2019. Valid for: a year.
This is the only time securityaffairs.co was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 43 2001:8d8:100f... 8560 (ONEANDONE...)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
1 2600:9000:214... 16509 (AMAZON-02)
1 2600:9000:204... 16509 (AMAZON-02)
5 2606:2800:234... 15133 (EDGECAST)
9 192.0.77.2 2635 (AUTOMATTIC)
36 2.18.235.93 16625 (AKAMAI-AS)
1 2a04:fa87:fff... 2635 (AUTOMATTIC)
3 2a03:2880:f02... 32934 (FACEBOOK)
1 192.0.77.32 2635 (AUTOMATTIC)
2 192.0.76.3 2635 (AUTOMATTIC)
1 2600:9000:214... 16509 (AMAZON-02)
1 2600:9000:214... 16509 (AMAZON-02)
8 2a00:1450:400... 15169 (GOOGLE)
1 2 18.195.80.102 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
8 172.217.16.194 15169 (GOOGLE)
2 2606:2800:234... 15133 (EDGECAST)
1 2 104.244.42.200 13414 (TWITTER)
6 2606:2800:134... 15133 (EDGECAST)
2 2a00:1450:400... 15169 (GOOGLE)
3 52.8.121.29 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
143 25
Domain Requested by
43 securityaffairs.co 1 redirects securityaffairs.co
25 contextual.media.net securityaffairs.co
contextual.media.net
8 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
securityaffairs.co
7 lg3.media.net securityaffairs.co
contextual.media.net
7 platform.twitter.com securityaffairs.co
platform.twitter.com
6 www.googletagservices.com securityaffairs.co
securepubads.g.doubleclick.net
5 pbs.twimg.com securityaffairs.co
5 i1.wp.com securityaffairs.co
4 hblg.media.net securityaffairs.co
3 navvy.media.net contextual.media.net
2 tpc.googlesyndication.com securepubads.g.doubleclick.net
2 syndication.twitter.com 1 redirects securityaffairs.co
2 adservice.google.com www.googletagservices.com
2 adservice.google.de www.googletagservices.com
2 l.sharethis.com 1 redirects securityaffairs.co
2 connect.facebook.net securityaffairs.co
connect.facebook.net
2 i0.wp.com securityaffairs.co
2 i2.wp.com securityaffairs.co
1 www.google-analytics.com
1 google-analytics.com securityaffairs.co
1 cdn.syndication.twimg.com platform.twitter.com
1 pixel.wp.com securityaffairs.co
1 staticxx.facebook.com connect.facebook.net
1 c.sharethis.mgr.consensu.org ws.sharethis.com
1 buttons-config.sharethis.com platform-api.sharethis.com
1 stats.wp.com securityaffairs.co
1 s0.wp.com securityaffairs.co
1 secure.gravatar.com securityaffairs.co
1 platform-api.sharethis.com securityaffairs.co
1 ws.sharethis.com securityaffairs.co
1 maxcdn.bootstrapcdn.com securityaffairs.co
0 fonts.googleapis.com Failed securityaffairs.co
143 32
Subject Issuer Validity Valid
www.securityaffairs.co
GeoTrust RSA CA 2018
2019-02-21 -
2020-03-22
a year crt.sh
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA
2019-09-14 -
2020-10-13
a year crt.sh
*.sharethis.com
Go Daddy Secure Certificate Authority - G2
2017-09-26 -
2020-09-29
3 years crt.sh
*.twimg.com
DigiCert SHA2 High Assurance Server CA
2018-11-19 -
2019-11-27
a year crt.sh
*.wp.com
Go Daddy Secure Certificate Authority - G2
2018-04-10 -
2020-05-11
2 years crt.sh
*.media.net
DigiCert SHA2 Secure Server CA
2018-12-30 -
2020-03-30
a year crt.sh
*.gravatar.com
COMODO RSA Domain Validation Secure Server CA
2018-09-06 -
2020-09-05
2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2019-08-24 -
2019-10-19
2 months crt.sh
*.sharethis.mgr.consensu.org
Go Daddy Secure Certificate Authority - G2
2018-05-21 -
2020-05-21
2 years crt.sh
*.g.doubleclick.net
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
*.google.com
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
syndication.twitter.com
DigiCert SHA2 High Assurance Server CA
2019-04-09 -
2020-04-01
a year crt.sh
tpc.googlesyndication.com
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh
*.google-analytics.com
GTS CA 1O1
2019-09-05 -
2019-11-28
3 months crt.sh

This page contains 19 frames:

Primary Page: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Frame ID: 9F569A6CA646FD897EE338D39DCDB8B7
Requests: 98 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Frame ID: 25C5CEC75AC53E32B01C6B32C03BB053
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HB41O6BH&prvid=80%2C82%2C97%2C109%2C148%2C175%2C178&rtime=5&https=1&gdpr=1&gdprconsent=2
Frame ID: 72F53DF4D9B16BBD2341CFB36E66145C
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&size=300x250&cc=NL&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&nse=3&vi=1569937438796240605&lw=1&ugd=4&rtbs=1&hlt=1&dfp=1&nb=1
Frame ID: 7320316C406D62DA20E5686E74C48C03
Requests: 2 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: F36E94D45DCD4989FA417C6BDD5F7357
Requests: 8 HTTP requests in this frame

Frame: https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=NL&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&nse=3&vi=1569937438851172487&lw=1&ugd=4&rtbs=1&nb=1
Frame ID: 6F465A1C963F795A8C190E7B2450F8FF
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&size=300x600&cc=NL&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&nse=3&vi=1569937438891765566&lw=1&ugd=4&rtbs=1&hlt=1&dfp=1&nb=1
Frame ID: 3B70F2DC4BBB56E937FACCAD78075A76
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: 35DAA93477639A78CE99429963F1ABE2
Requests: 8 HTTP requests in this frame

Frame: https://staticxx.facebook.com/connect/xd_arbiter.php?version=44
Frame ID: FECA2DAEE469B407F181694849000932
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.d6364fae9340b0be5f13818370141fd0.html?origin=https%3A%2F%2Fsecurityaffairs.co
Frame ID: 92AED58D0355DDE208982B7BAE6AA0A5
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&pid=8PO5M70HK&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrEBbIZGw_v2fXpyZXRW3WVE%3D&cme=hmi3FHRUKMmzKimfb0JIDAbp_fyjVK7depiARrivsoxRj_hLfG7Sh7pIMMFBEH3GQmWMN5-SfqQXYweHSH8KKnPGVgvGQ_aPSf0OGKC6cBSpFVbTXU3f6_1duVJnBmigo-643UevFDALT110G-ESfQ%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7Cq-6hGTGi_Gb8qnAezGKJeWNa85AapA8Th5FcMSeR34__Dyh8hafgsrGTmOlO-kzWx3Z5GgLYC9lf3kI5GK-yU5y237AMkDVPU68KaQ3qCjY%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=NL&bf=0&staticIframe=1&vif=1&nse=3&vi=1569937438796240605&lw=1&ugd=4&ib=0&katid=801338199&katbid=-21&katen=1&nb=1
Frame ID: 2786F33F5A923234FC8816BD3221B10D
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&pid=8PO5M70HK&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrHvHwrQGlpByWaOO1vn303s%3D&cme=ddF3tVt6Jgwc0vmFKxq3sxZQnh0iZwpa5KhKGcDHJFxEgLz35A0naNpam52fKJe_u9tIkCm3_lVs8UO_TWiOPSCbQBfwxs5LQx8hOuBd8dcPClRiQGYMWhkgJLSjI5BzpX_yLx7ECLkDeliuUBQP2w%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7Cq-6hGTGi_Gb8qnAezGKJeWNa85AapA8Th5FcMSeR34__Dyh8hafgsrGTmOlO-kzWx3Z5GgLYC9lf3kI5GK-yU5y237AMkDVPU68KaQ3qCjY%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=NL&bf=0&staticIframe=1&vif=1&nse=3&vi=1569937438851172487&lw=1&ugd=4&ib=0&katid=801344920&katbid=-21&katen=1&nb=1
Frame ID: 840514B227582C26CBE30697667AAAE0
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&pid=8PO5M70HK&size=300x600&cpnet=yVb1sHm-0KIh29BOFTjjrOMbY3Wy7OSYfNFL7sC0vVY%3D&cme=hmi3FHRUKMkilTzseEeahYBK0Dc9Iehoc--eJ91ZbJOU32yPMPHcgTcILw-vm_YLN7Vl26zwtvAWFY8-y5nJkY74VltIAgM5qiRWJ1RL1t9F_RjSHP5de0JanKU1hKV6Xa5xAjKNU5clkdmKXRb2-Q%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7Cq-6hGTGi_Gb8qnAezGKJeWNa85AapA8Th5FcMSeR34__Dyh8hafgsrGTmOlO-kzWx3Z5GgLYC9lf3kI5GK-yU5y237AMkDVPU68KaQ3qCjY%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=NL&bf=0&staticIframe=1&vif=1&nse=3&vi=1569937438891765566&lw=1&ugd=4&ib=0&katid=801338173&katbid=-21&katen=1&nb=1
Frame ID: 387B315BA17969D309DA53268A2F2DE3
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstAaOlpzDGnl3K6qKiu3vN9g9SWtdG1rWP-WbQcgjry5PpvnKUT9-7_7_g4vxlTlXJXs8sEmeg3a8zMakIiyMqlgV_U-7i59kjADC6saB0BR7v0SCGd0UpQwRYMn8YyQHySfpyDFfpoLmheBIuucRsYOXiFjX3F2zUnvvHBZTknRfRBkGI2QcBIpqN4nVAYgaKSLKUbqTt2aGd-565-EbwAF_tAZnHLFiUUnb18gZAhuxANL1xCvQZe5NEq9ilvU9W1wx4PkPjjiK5DkBv4r1AiNI5WhptLhLgJjrTmXod6LhHI&sai=AMfl-YRGp9BMiaYF2cSBOlrctfc28rBXnv6K6GKBU7QqT3Gz-787XXqofJW-6rNaCNe-akO8zyZS35ncSw3i1ZsKqCcrHbLYSMeYMwvN8_EDZw&sig=Cg0ArKJSzH5zIx0jEDwmEAE&urlfix=1&adurl=
Frame ID: 82195964EBF0A6BA7138F8D5B4D0A0F7
Requests: 3 HTTP requests in this frame

Frame: https://contextual.media.net/__media__/js/util/nrrV2325.js
Frame ID: 67CCBE97767870482B840874DFA8E37A
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstLO8lKpD3bflRWgtIZA1N99uUz5eBxksJA84IPp-7V2pLuqMnzbm0LvdsUPW2lts09bI-eyUI4J--We0r-tlI__Sd9aSgYcIAIhnaN6BwM9xA1MUbxxTh8FiDBvKxFmWnGH-kNIYckNEnHJMki9NYIX-aDm_RDtf7sMVy0Sy5T5IqEc61097ibLWVTPz5JQ49xNwE2YTCivKNsryKs4O9zOGwTiuwkJWr9tGVqlq8pHT1cOaV2NK7NKpykvJwM9n6JKJ-rgWoaC7ldtdpewbxcXKLCk5aK-US7JDTc1MiyrYyEMsGuPbDF8g41WISA&sai=AMfl-YTOcEV5SEF9TuGvxyKsCzIidaoGQ5D6Ixnc-es3rIO-c8iatik2WK-oqrj2gUgYVS8WlAB_7x8owKlKde9v6uKG1oZ8BcFhk1T4OlkZ0A&sig=Cg0ArKJSzCaxD5xWEYfbEAE&urlfix=1&adurl=
Frame ID: 0C3C3C99CD2E157318BAD889FA5105B8
Requests: 3 HTTP requests in this frame

Frame: https://contextual.media.net/__media__/js/util/nrrV2325.js
Frame ID: D97FD5AAD379BCD978B809D350DF62D5
Requests: 7 HTTP requests in this frame

Frame: https://platform.twitter.com/jot.html
Frame ID: D5FA7110B5C688FC05C8730F29EC3DC8
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/__media__/js/util/nrrV2325.js
Frame ID: CC4B3D6463284102077B09FF102B13D1
Requests: 5 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers link /rel="https:\/\/api\.w\.org\/"/i
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Overall confidence: 100%
Detected patterns
  • headers link /rel="https:\/\/api\.w\.org\/"/i
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Overall confidence: 100%
Detected patterns
  • headers link /rel="https:\/\/api\.w\.org\/"/i
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

143
Requests

97 %
HTTPS

67 %
IPv6

18
Domains

32
Subdomains

25
IPs

5
Countries

2293 kB
Transfer

3905 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 77
  • https://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&fpc=6f69f6a-16d879036cc-3084b36d-1&sessionID=1569937438412.18876&hostname=securityaffairs.co&location=%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&product=simpleshare&fcmp=false&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&consentDomain=.consensu.org&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&sharURL=&buttonType=ERROR&destination=ERROR&source=ERROR&title=Botnet%20exploits%20recent%20vBulletin%20flaw%20to%20protect%20its%20botsSecurity%20Affairs&ts1569937438412.0=&sop=false HTTP 301
  • https://l.sharethis.com/sc?cm=ZHQAD12TWB4AAAASD6jUAw%3D%3D&uid=true&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&sop=false
Request Chain 85
  • https://securityaffairs.co/wordpress?ga_action=googleanalytics_get_script HTTP 301
  • https://securityaffairs.co/wordpress/?ga_action=googleanalytics_get_script
Request Chain 134
  • https://syndication.twitter.com/i/jot HTTP 302
  • https://platform.twitter.com/jot.html

143 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request vbulletin-exploit-botnet.html
securityaffairs.co/wordpress/91759/hacking/
74 KB
20 KB
Document
General
Full URL
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache / PHP/7.2.22
Resource Hash
cbafc8a187cbe3e3e70abe865ae8482984af1b3361f97a7759b25324bab3ec45

Request headers

:method
GET
:authority
securityaffairs.co
:scheme
https
:path
/wordpress/91759/hacking/vbulletin-exploit-botnet.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
200
content-type
text/html; charset=UTF-8
date
Tue, 01 Oct 2019 13:43:56 GMT
server
Apache
x-powered-by
PHP/7.2.22
vary
Accept-Encoding,Cookie
x-pingback
https://securityaffairs.co/wordpress/xmlrpc.php
link
<https://securityaffairs.co/wordpress/wp-json/>; rel="https://api.w.org/", <https://securityaffairs.co/wordpress/?p=91759>; rel=shortlink
set-cookie
cookielawinfo-checkbox-necessary=yes; expires=Tue, 01-Oct-2019 14:43:56 GMT; Max-Age=3600; path=/ icwp-wpsf=bbcaf0ed36b2927149cc12160278fa44; expires=Wed, 31-Jul-2069 03:27:52 GMT; Max-Age=1572529435; path=/wordpress/
content-encoding
gzip
style.css
securityaffairs.co/wordpress/wp-includes/css/dist/block-library/
35 KB
35 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/css/dist/block-library/style.css?ver=20c1c3d11da1b4e08243d653861d5e28
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
d71d5d3c7599fea2708a390106f99aff6c764e5e043b8095a2c7d2e85e392ddd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Tue, 07 May 2019 21:49:17 GMT
server
Apache
etag
"8d39-58853304cdb25"
content-type
text/css
status
200
accept-ranges
bytes
content-length
36153
cookie-law-info-public.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/
3 KB
3 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=1.8.0
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
81e82457fb12ef9a7b3981eceba4363763a703fd04bbe4da183903fd74e2cbcd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Tue, 27 Aug 2019 23:17:27 GMT
server
Apache
etag
"b26-5912179cd70cb"
content-type
text/css
status
200
accept-ranges
bytes
content-length
2854
cookie-law-info-gdpr.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/
23 KB
23 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=1.8.0
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
41ae41dbf79250f10738fe6d7b3af43d5b83520b9b0f659f763fde04d8658371

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Tue, 27 Aug 2019 23:17:27 GMT
server
Apache
etag
"5b86-5912179cd70cb"
content-type
text/css
status
200
accept-ranges
bytes
content-length
23430
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/
23 KB
6 KB
Stylesheet
General
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css?ver=20c1c3d11da1b4e08243d653861d5e28
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
/
Resource Hash
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:35:19 GMT
status
200
etag
"1544639719"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
5442
custom.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/
19 KB
20 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/custom.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Wed, 16 Dec 2015 13:54:59 GMT
server
Apache
etag
"4d92-52704407f72c0"
content-type
text/css
status
200
accept-ranges
bytes
content-length
19858
tipsy.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
539 B
683 B
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/tipsy.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Wed, 16 Dec 2015 06:58:04 GMT
server
Apache
etag
"21b-526fe6d7cd700"
content-type
text/css
status
200
accept-ranges
bytes
content-length
539
flexslider.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/
6 KB
6 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/flexslider.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Wed, 16 Dec 2015 13:55:09 GMT
server
Apache
etag
"1851-5270441180940"
content-type
text/css
status
200
accept-ranges
bytes
content-length
6225
mediaelementplayer-legacy.min.css
securityaffairs.co/wordpress/wp-includes/js/mediaelement/
11 KB
11 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.6-78496d1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
ffa31f5802b20d64a10c71ad93394c1e2b4b16f33e2f479d8274fd02ce0a594f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Thu, 16 Nov 2017 13:57:00 GMT
server
Apache
etag
"2be0-55e19fe77c80f"
content-type
text/css
status
200
accept-ranges
bytes
content-length
11232
animation.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
2 KB
2 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/animation.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Wed, 16 Dec 2015 06:58:02 GMT
server
Apache
etag
"6b4-526fe6d5e5280"
content-type
text/css
status
200
accept-ranges
bytes
content-length
1716
font-awesome.min.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
17 KB
18 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Wed, 16 Dec 2015 06:58:02 GMT
server
Apache
etag
"4574-526fe6d5e5280"
content-type
text/css
status
200
accept-ranges
bytes
content-length
17780
swipebox.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
4 KB
5 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/swipebox.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Wed, 16 Dec 2015 06:58:18 GMT
server
Apache
etag
"118d-526fe6e527680"
content-type
text/css
status
200
accept-ranges
bytes
content-length
4493
jquery.circliful.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
334 B
478 B
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jquery.circliful.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Wed, 16 Dec 2015 06:58:02 GMT
server
Apache
etag
"14e-526fe6d5e5280"
content-type
text/css
status
200
accept-ranges
bytes
content-length
334
screen.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
110 KB
110 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/screen.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Wed, 16 Dec 2015 06:58:04 GMT
server
Apache
etag
"1b844-526fe6d7cd700"
content-type
text/css
status
200
accept-ranges
bytes
content-length
112708
custom-css.php
securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/
12 KB
12 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/custom-css.php?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache / PHP/7.2.22
Resource Hash
18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Tue, 01 Oct 2019 13:43:57 GMT
server
Apache
x-powered-by
PHP/7.2.22
content-type
text/css; charset: UTF-8;charset=UTF-8
grid.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
49 KB
50 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/grid.css?ver=20c1c3d11da1b4e08243d653861d5e28
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Wed, 16 Dec 2015 06:58:03 GMT
server
Apache
etag
"c5f2-526fe6d6d94c0"
content-type
text/css
status
200
accept-ranges
bytes
content-length
50674
jquery.js
securityaffairs.co/wordpress/wp-includes/js/jquery/
95 KB
95 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Tue, 21 May 2019 21:49:10 GMT
server
Apache
etag
"17a69-5896cd1a361be"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
96873
jquery-migrate.js
securityaffairs.co/wordpress/wp-includes/js/jquery/
23 KB
23 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
dce50148adaff4dccd1d95c9b25563011436e398272d530e974193b8685340a2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Thu, 21 Feb 2019 22:56:38 GMT
server
Apache
etag
"5bdb-5826f63145921"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
23515
cookie-law-info-public.js
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/
21 KB
21 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=1.8.0
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
60b810eace07d67a34d692acc49a38b7b48d5d200aa56a13f307daf84cfa71f5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Tue, 27 Aug 2019 23:17:27 GMT
server
Apache
etag
"54c5-5912179cd806b"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
21701
st_insights.js
ws.sharethis.com/button/
23 KB
7 KB
Script
General
Full URL
https://ws.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:4e00:3:c04e:c780:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx/1.12.2 /
Resource Hash
53ae914563ca9a506ecde6b72efbc109be28b72be94aaf341d3d216556d38ef6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 00:33:14 GMT
content-encoding
gzip
server
nginx/1.12.2
age
47439
etag
"5d82ad30-5abc"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=259200
x-amz-cf-pop
FRA53-C1
x-robots-tag
noindex, nofollow
x-amz-cf-id
eE5eSp_tKIF1wdmU4W1XtzGlgqtf2lLl4ZeZYAVOMy2LboRveh-vbg==
via
1.1 73f3a23156999272233949c078c30859.cloudfront.net (CloudFront)
expires
Fri, 04 Oct 2019 00:33:14 GMT
sharethis.js
platform-api.sharethis.com/js/
87 KB
27 KB
Script
General
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2047:ae00:1c:8a07:5e80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash
7f69349ca60e8d9541cd2bb383c938c4ce0964fc6ec54e336559ae6702d8e699

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:37:34 GMT
content-encoding
gzip
age
384
etag
W/"15cfc-nEojiZbCMg67s7oCuzLFwKkmpxM"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript; charset=utf-8
status
200
edge-control
cache-maxage=60m,downstream-ttl=60m
cache-control
max-age=600, public
x-amz-cf-pop
FRA53
x-amz-cf-id
QGBO0gqz3D3dwmJ0hmCwspfA50ErvGowXe_e1QyR56Zxm8Xp40SINg==
via
1.1 4d1cbe225c5d30aa78ec9a6fa1ba4211.cloudfront.net (CloudFront)
logo_SecurityAffairs.png
securityaffairs.co/wordpress/wp-content/uploads/2015/12/
44 KB
44 KB
Image
General
Full URL
https://securityaffairs.co/wordpress/wp-content/uploads/2015/12/logo_SecurityAffairs.png
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Wed, 16 Dec 2015 17:30:42 GMT
server
Apache
etag
"b0e9-5270743f5f480"
content-type
image/png
status
200
accept-ranges
bytes
content-length
45289
widgets.js
platform.twitter.com/
95 KB
28 KB
Script
General
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/4198) /
Resource Hash
45491009ecacd44a68ce929f718ec44a30d50b204a1c0302871ea801a2410171

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 01 Oct 2019 13:43:57 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 17:14:55 GMT
Server
ECS (fcn/4198)
Etag
"2de633c541519a6e0e3cc9b2a90013da+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
X-Cache
HIT
Content-Type
application/javascript; charset=utf-8
Content-Length
28608
vbulletin.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2019/09/
54 KB
54 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2019/09/vbulletin.png?w=948&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
c1e18edc7bd1afaeeb0b78b6dc289bd98f8d30fe6544cd1022281541c160b533
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 8
date
Tue, 01 Oct 2019 13:43:58 GMT
x-content-type-options
nosniff
last-modified
Tue, 24 Sep 2019 21:42:44 GMT
server
nginx
etag
"834cfe00346ec284"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2019/09/vbulletin.png>; rel="canonical"
content-length
54826
expires
Fri, 24 Sep 2021 09:42:44 GMT
vBulletin-exploit.png
i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2019/09/
17 KB
18 KB
Image
General
Full URL
https://i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2019/09/vBulletin-exploit.png?w=740&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
9be975407bce49a3666d53ca6553fd2500a022169c51af16b44497c49046e811
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Tue, 01 Oct 2019 13:43:58 GMT
x-content-type-options
nosniff
x-bytes-saved
7934
last-modified
Thu, 26 Sep 2019 20:03:32 GMT
server
nginx
etag
"d8a861e235ee797a"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2019/09/vBulletin-exploit.png>; rel="canonical"
content-length
17764
expires
Sun, 26 Sep 2021 08:03:32 GMT
dmedianet.js
contextual.media.net/
345 KB
111 KB
Script
General
Full URL
https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9972a15eb710be8f40584df58ffd5b892e3c65a99ded73f091d77ad4cf3a6b81

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
x-mnet-h
8-4
content-type
text/javascript; charset=utf-8
status
200
cache-control
max-age=300
x-mn-w
8-12
expires
Tue, 01 Oct 2019 13:48:58 GMT
facebook.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
830 B
1 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
c067a7d5bc50ed4ba554421966d6c4b0140ff2ed4574640fd5abcfa1ab35be11
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 5
date
Tue, 01 Oct 2019 13:43:58 GMT
x-content-type-options
nosniff
x-bytes-saved
290
last-modified
Sat, 08 Jun 2019 18:27:09 GMT
server
nginx
etag
"72b1281bd0945fdf"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png>; rel="canonical"
content-length
830
expires
Tue, 08 Jun 2021 06:27:09 GMT
twitter.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
1 KB
1 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
7a8cf6b7fce01f318e416ae1904132265526ca2b6ef3003f7fe831186a7380a0
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Tue, 01 Oct 2019 13:43:58 GMT
x-content-type-options
nosniff
x-bytes-saved
815
last-modified
Mon, 04 Feb 2019 06:29:20 GMT
server
nginx
etag
"25135197f99e62b3"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png>; rel="canonical"
content-length
1082
expires
Wed, 03 Feb 2021 18:29:20 GMT
linkedin.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
1 KB
1 KB
Image
General
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
00a4c9aeb6f61ae7f260eea51d5d19a651544c01d202363463375992ef021960
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 2
date
Tue, 01 Oct 2019 13:43:58 GMT
x-content-type-options
nosniff
x-bytes-saved
442
last-modified
Mon, 04 Feb 2019 06:42:59 GMT
server
nginx
etag
"119bceeb41186dc5"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png>; rel="canonical"
content-length
1182
expires
Wed, 03 Feb 2021 18:42:59 GMT
reddit.png
i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
2 KB
2 KB
Image
General
Full URL
https://i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/reddit.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
9eade11ffd772c4492d46969c94db94238be90cb2fc9ed98b199a64113d33920
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 6
date
Tue, 01 Oct 2019 13:43:58 GMT
x-content-type-options
nosniff
x-bytes-saved
361
last-modified
Sat, 08 Jun 2019 18:27:09 GMT
server
nginx
etag
"5f12cd69e7f147e3"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/reddit.png>; rel="canonical"
content-length
1566
expires
Tue, 08 Jun 2021 06:27:09 GMT
pinterest.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
1 KB
2 KB
Image
General
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/pinterest.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
3afe47d0fe0b16bc5bddecdc9bcaca94ed420b8fd0ddee2ae77364403c794bb8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 2
date
Tue, 01 Oct 2019 13:43:58 GMT
x-content-type-options
nosniff
x-bytes-saved
1227
last-modified
Mon, 04 Feb 2019 06:29:18 GMT
server
nginx
etag
"9a8b1a5335d6cfb5"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/pinterest.png>; rel="canonical"
content-length
1502
expires
Wed, 03 Feb 2021 18:29:18 GMT
f00db26378ef7df7c440a8ee60ead62b
secure.gravatar.com/avatar/
1 KB
1 KB
Image
General
Full URL
https://secure.gravatar.com/avatar/f00db26378ef7df7c440a8ee60ead62b?s=60&d=mm&r=g
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
643a860832456b5a74825b79d625434b5c4c2a344b8f9bef3614b327bea52646

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT vie 4
date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Wed, 11 Jan 1984 08:00:00 GMT
server
nginx
source-age
8170999
status
200
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=300
content-disposition
inline; filename="f00db26378ef7df7c440a8ee60ead62b.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/f00db26378ef7df7c440a8ee60ead62b?s=60&d=mm&r=g>; rel="canonical"
content-length
1186
expires
Tue, 01 Oct 2019 13:48:58 GMT
Comodo-data-breach.png
securityaffairs.co/wordpress/wp-content/uploads/2019/10/
117 KB
117 KB
Image
General
Full URL
https://securityaffairs.co/wordpress/wp-content/uploads/2019/10/Comodo-data-breach.png
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
03f9ce0e3b5c1796a72138abcec8469fce16791a19ae2e50263ffabd771b3f5d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Tue, 01 Oct 2019 12:49:15 GMT
server
Apache
etag
"1d274-593d8c7ad7f64"
content-type
image/png
status
200
accept-ranges
bytes
content-length
119412
ransomware.jpg
securityaffairs.co/wordpress/wp-content/uploads/2019/06/
175 KB
176 KB
Image
General
Full URL
https://securityaffairs.co/wordpress/wp-content/uploads/2019/06/ransomware.jpg
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
6828f1bdae5c7b89d801df314049a2d65159a4284ee530e5c848a153eadf8c87

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Wed, 26 Jun 2019 13:32:34 GMT
server
Apache
etag
"2bcb0-58c3a13f98fef"
content-type
image/jpeg
status
200
accept-ranges
bytes
content-length
179376
Digging-The-Deep-Web.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/
6 KB
6 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png?resize=236%2C300&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
2cbb8dfc4483c9ce680df342866531ac656e8bed029dcd37a1872327023da5f8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 6
date
Tue, 01 Oct 2019 13:43:58 GMT
x-content-type-options
nosniff
x-bytes-saved
54471
last-modified
Sat, 08 Jun 2019 18:27:09 GMT
server
nginx
etag
"9b0a533bb91198de"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png>; rel="canonical"
content-length
6390
expires
Tue, 08 Jun 2021 06:27:09 GMT
yoroi.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2017/06/
6 KB
7 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2017/06/yoroi.png?resize=300%2C286&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
aecbb7494580f4902d9b6686614623951c0d599a7a21fe0f855491b0f52987a7
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 3
date
Tue, 01 Oct 2019 13:43:58 GMT
x-content-type-options
nosniff
x-bytes-saved
13492
last-modified
Mon, 04 Feb 2019 05:58:07 GMT
server
nginx
etag
"0f8e82c107049c26"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2017/06/yoroi.png>; rel="canonical"
content-length
6494
expires
Wed, 03 Feb 2021 17:58:07 GMT
default.png
securityaffairs.co/wordpress/wp-includes/images/media/
168 B
312 B
Image
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/images/media/default.png
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
6dfe1e05661b087111ce1b280d4f082cbfd2b786a0941224da5af2ce1b29fb75

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Wed, 16 Dec 2015 06:28:46 GMT
server
Apache
etag
"a8-526fe04b3e380"
content-type
image/png
status
200
accept-ranges
bytes
content-length
168
sdk.js
connect.facebook.net/en_US/
3 KB
2 KB
Script
General
Full URL
https://connect.facebook.net/en_US/sdk.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
c250e061b0e245d6c3dad48f7093ac60cbab48ce4e65078cf436f4c3b06242eb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
2utm8EJ7akcJTS4W4j/zQg==
status
200
content-length
1779
etag
"caa1a25db2c0a52f1a36d1b45ae0cac3"
x-fb-debug
kuiEX6kKi8jiJYfh3xy2OoXlyJ/oqH6vREDDl9/p9k3Ekbgyx6duVuMY4So0ZwjDuHcW0DfhBUTmS9xN7qFAmg==
x-fb-trip-id
420120009
x-fb-content-md5
29b9b729c93f75a2acc9db191d67c675
x-frame-options
DENY
date
Tue, 01 Oct 2019 13:43:58 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin
*
expires
Tue, 01 Oct 2019 13:56:36 GMT
ssba.css
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/
105 KB
105 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/ssba.css?ver=20c1c3d11da1b4e08243d653861d5e28
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
8630a5e9b221470e4baf94299937bbe590b50a2f8340c7a16533cddf9288224b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Mon, 26 Aug 2019 23:13:15 GMT
server
Apache
etag
"1a4c9-5910d4cf95005"
content-type
text/css
status
200
accept-ranges
bytes
content-length
107721
photon.js
securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/
2 KB
2 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/photon.js?ver=20190201
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
c255d6cac869be47d929ac6aa30d708482b94258921f91d90e9740b7650354ba

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Tue, 24 Sep 2019 05:14:01 GMT
server
Apache
etag
"6da-593459aba858e"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
1754
jquery.adrotate.clicktracker.js
securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/
1 KB
1 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/jquery.adrotate.clicktracker.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
2f64b025cec8c93dcb01fe88f0e79c134bc0a6c751787360153865dfa9f3a962

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Tue, 24 Sep 2019 05:13:55 GMT
server
Apache
etag
"40b-593459a617883"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
1035
devicepx-jetpack.js
s0.wp.com/wp-content/js/
10 KB
3 KB
Script
General
Full URL
https://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201940
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT ams 1
date
Tue, 01 Oct 2019 13:43:57 GMT
content-encoding
gzip
server
nginx
etag
W/"58674312-52b6"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Mon, 28 Sep 2020 09:44:00 GMT
ssba.js
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/
2 KB
2 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/ssba.js?ver=20c1c3d11da1b4e08243d653861d5e28
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
76a18f5f0637e0d73ce1afece898ce8b0fa75bb6b1c1990ae4a7ac6b083045ce

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Mon, 26 Aug 2019 23:13:15 GMT
server
Apache
etag
"792-5910d4cf97ee5"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
1938
hint.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
987 B
1 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/hint.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:57 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"3db-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
987
jquery.tipsy.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
4 KB
4 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.tipsy.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"1113-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
4371
jquery.easing.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
8 KB
8 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.easing.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"1fa1-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
8097
browser.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
3 KB
3 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/browser.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Wed, 16 Dec 2015 06:58:16 GMT
server
Apache
etag
"a36-526fe6e33f200"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
2614
jquery.flexslider-min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/
21 KB
21 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/jquery.flexslider-min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Wed, 16 Dec 2015 13:55:10 GMT
server
Apache
etag
"53ae-5270441274b80"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
21422
waypoints.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
8 KB
8 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/waypoints.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Wed, 16 Dec 2015 06:58:18 GMT
server
Apache
etag
"1f6c-526fe6e527680"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
8044
mediaelement-and-player.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/
69 KB
70 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/mediaelement-and-player.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Wed, 16 Dec 2015 13:55:14 GMT
server
Apache
etag
"11571-5270441645480"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
71025
jquery.swipebox.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
11 KB
11 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.swipebox.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"2a67-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
10855
jquery.circliful.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
3 KB
3 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.circliful.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"c18-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
3096
jquery.smarticker.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
13 KB
13 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.smarticker.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"3225-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
12837
custom.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
12 KB
13 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/custom.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Wed, 16 Dec 2015 06:58:16 GMT
server
Apache
etag
"31d4-526fe6e33f200"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
12756
wp-embed.js
securityaffairs.co/wordpress/wp-includes/js/
3 KB
3 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/wp-embed.js?ver=20c1c3d11da1b4e08243d653861d5e28
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
d931ba2089021a1357761939c18bcc09aa856d39be2a707ea450333f5b3443c4

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Thu, 21 Feb 2019 22:56:38 GMT
server
Apache
etag
"c8e-5826f6315ef61"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
3214
e-201940.js
stats.wp.com/
9 KB
3 KB
Script
General
Full URL
https://stats.wp.com/e-201940.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
server
nginx
etag
W/"5c6340e3-350a"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
expires
Mon, 28 Sep 2020 09:44:00 GMT
twemoji.js
securityaffairs.co/wordpress/wp-includes/js/
27 KB
27 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/twemoji.js?ver=20c1c3d11da1b4e08243d653861d5e28
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
f08920f16a4fb284b9f0b2f9d7453ef80388854e7eed8a00260886db6dd16103

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Tue, 07 May 2019 21:49:17 GMT
server
Apache
etag
"6be1-5885330520b46"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
27617
wp-emoji.js
securityaffairs.co/wordpress/wp-includes/js/
9 KB
9 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/wp-emoji.js?ver=20c1c3d11da1b4e08243d653861d5e28
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
c026c385573035118cb24fe5315dceea3f26646af3e91df1ad530e49121753d0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Thu, 21 Feb 2019 22:56:38 GMT
server
Apache
etag
"22d2-5826f6315ef61"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
8914
css
fonts.googleapis.com/
0
0

css
fonts.googleapis.com/
0
0

css
fonts.googleapis.com/
0
0

css
fonts.googleapis.com/
0
0

5b71b64b04b9a500117b1015.js
buttons-config.sharethis.com/js/
30 B
380 B
Script
General
Full URL
https://buttons-config.sharethis.com/js/5b71b64b04b9a500117b1015.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:c200:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 30 Sep 2019 18:48:21 GMT
via
1.1 850ccace60916919bf31313cb9176e01.cloudfront.net (CloudFront)
last-modified
Mon, 13 Aug 2018 16:48:12 GMT
server
AmazonS3
age
26
etag
"e6e1643313740711175f51662a65b42f"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
max-age=60,public
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-length
30
x-amz-cf-id
f6_8BifDH50R0ov38ZS7K8kNVw-gh4OyJVFd4CG9RBYd1Y1acNmsmQ==
fontawesome-webfont.woff
securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/
43 KB
44 KB
Font
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/fontawesome-webfont.woff?v=4.0.3
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849

Request headers

Sec-Fetch-Mode
cors
Referer
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Origin
https://securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
last-modified
Wed, 16 Dec 2015 06:58:09 GMT
server
Apache
etag
"ad90-526fe6dc92240"
content-type
application/font-woff
status
200
accept-ranges
bytes
content-length
44432
portal.html
c.sharethis.mgr.consensu.org/v1.0/cmp/ Frame 25C5
0
0
Document
General
Full URL
https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Requested by
Host: ws.sharethis.com
URL: https://ws.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:8600:c:a9b7:ddc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
/
Resource Hash

Request headers

:method
GET
:authority
c.sharethis.mgr.consensu.org
:scheme
https
:path
/v1.0/cmp/portal.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html

Response headers

status
200
content-type
text/html; charset=utf-8
accept-ranges
bytes
cache-control
max-age=600, public
content-encoding
gzip
date
Tue, 01 Oct 2019 11:16:38 GMT
edge-control
cache-maxage=60m,downstream-ttl=60m
etag
W/"361b-16d839db5b0"
last-modified
Mon, 30 Sep 2019 19:20:14 GMT
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
x-amz-cf-id
Wh6ZWHM4kXx-wyvCp7gT5UKR_EnnFpbBMcxrVEqWs9RFv8XNCbv77w==
age
427
sdk.js
connect.facebook.net/en_US/
195 KB
58 KB
Script
General
Full URL
https://connect.facebook.net/en_US/sdk.js?hash=3d465926d6ee90a6bee1ab877a0042f3&ua=modern_es6
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
9880786f13259e603d90405c059eb5a4a9b01e0edcdc97f2a98880b13b00e24f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Sec-Fetch-Mode
cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Origin
https://securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
Xbva+Nm8JwhOMWg9gHK6Kg==
status
200
content-length
59104
etag
"30e6af297d7dc0a628084f822386b732"
x-fb-debug
r8/GOkjc23o7THK0fMKV6musZjpovj+GT6x6sLfhuWTTAqAEBW2dQAwyuQLA2VDsMtGb+lXx3ezRFJ88q2bgKA==
x-fb-trip-id
420120009
x-fb-content-md5
7f5b9edf9fe3b490db0ba1cee4f5647d
x-frame-options
DENY
date
Tue, 01 Oct 2019 13:43:58 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin
*
expires
Wed, 30 Sep 2020 12:30:20 GMT
checksync.php
contextual.media.net/ Frame 72F5
0
0
Document
General
Full URL
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HB41O6BH&prvid=80%2C82%2C97%2C109%2C148%2C175%2C178&rtime=5&https=1&gdpr=1&gdprconsent=2
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
contextual.media.net
:scheme
https
:path
/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HB41O6BH&prvid=80%2C82%2C97%2C109%2C148%2C175%2C178&rtime=5&https=1&gdpr=1&gdprconsent=2
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
accept-encoding
gzip, deflate, br
cookie
gdpr_status=1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html

Response headers

status
200
server
Apache
content-type
text/html; charset=UTF-8
set-cookie
gdpr_status=1; Expires=Fri, 03 Apr 2020 13:43:58 GMT; domain=.media.net; Path=/; visitor-id=2129390388735538000V10; Expires=Wed, 30 Sep 2020 13:43:58 GMT; domain=.media.net; Path=/;
x-mnet-hl2
E
p3p
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
vary
Accept-Encoding
content-encoding
gzip
cache-control
max-age=24051
expires
Tue, 01 Oct 2019 20:24:49 GMT
date
Tue, 01 Oct 2019 13:43:58 GMT
content-length
6381
rtbsmpubs.php
contextual.media.net/
5 KB
2 KB
Script
General
Full URL
https://contextual.media.net/rtbsmpubs.php?&gdpr=1&gdprconsent=1&cid=8HB41O6BH&region=nv&ptrid=8PREB0781&requestString=170605770*4%7C300x250%7C8CU5BD6EW%7C762221962%40170605770*97%7C300x250%7C8CU5BD6EW%7C762221962%40170605770*175%7C300x250%7C8CU5BD6EW%7C762221962%40170605770*178%7C300x250%7C8CU5BD6EW%7C762221962&crid=170605770&sd=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&bl=1&rt=5&dn=https://securityaffairs.co&https=1&act=headerBid&prvReqId=356302861364480361569937438568&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.26917485520680917&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1585%2C%22vh%22%3A1200%2C%22ph%22%3A4903%7D&itype=HB-CM&bt=1&isRefresh=0&callback=window.hbCMBidxc.rtbsheaderBid3S0
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9f43a0e47799e5385f63bc19f691407c31ccc5108087f2635c99e8d2d9bd7b97

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
max-age=0, no-cache, no-store
timing-allow-origin
*
content-length
1585
x-mnet-hl2
E
expires
Tue, 01 Oct 2019 13:43:58 GMT
fcmdynet.js
contextual.media.net/ Frame 7320
42 KB
15 KB
Script
General
Full URL
https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&size=300x250&cc=NL&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&nse=3&vi=1569937438796240605&lw=1&ugd=4&rtbs=1&hlt=1&dfp=1&nb=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f9e78732764c87ee679cb28f3a2c3ea3d0919690caa7509991c3bd25e05013b4

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
status
200
cache-control
max-age=300
x-mn-w
12-35
content-length
15383
x-mnet-hl2
8-8
expires
Tue, 01 Oct 2019 13:48:58 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame F36E
44 KB
14 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4fd1acd345a275a4bac18996c4de2352999db69b6a14a24bdda89af0e7c4ce3a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"295 / 136 of 1000 / last-modified: 1569872919"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14275
x-xss-protection
0
expires
Tue, 01 Oct 2019 13:43:58 GMT
rtbsmpubs.php
contextual.media.net/
5 KB
2 KB
Script
General
Full URL
https://contextual.media.net/rtbsmpubs.php?&gdpr=1&gdprconsent=1&cid=8HB41O6BH&region=nv&ptrid=8PREB0781&requestString=512365842*4%7C300x250%7C8CU5BD6EW%7C184323154%40512365842*97%7C300x250%7C8CU5BD6EW%7C184323154%40512365842*175%7C300x250%7C8CU5BD6EW%7C184323154%40512365842*178%7C300x250%7C8CU5BD6EW%7C184323154&crid=512365842&sd=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&bl=1&rt=5&dn=https://securityaffairs.co&https=1&act=headerBid&prvReqId=146720045560518221569937438580&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.5964617576420441&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1585%2C%22vh%22%3A1200%2C%22ph%22%3A4927%7D&itype=HB-CM&bt=1&isRefresh=0&callback=window.hbCMBidxc.rtbsheaderBid4S0
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
133f926dc875cb0014b8d2e2f65e6e9aaa2a6711e98c3d0b288b68e073c4fa7c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
max-age=0, no-cache, no-store
timing-allow-origin
*
content-length
1583
x-mnet-hl2
E
expires
Tue, 01 Oct 2019 13:43:58 GMT
fcmdynet.js
contextual.media.net/ Frame 6F46
42 KB
15 KB
Script
General
Full URL
https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=NL&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&nse=3&vi=1569937438851172487&lw=1&ugd=4&rtbs=1&nb=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b35e08c980ed59f98bb4797a4df415c31b0bb8fee73d66d16ad70f318cdcc01a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
status
200
cache-control
max-age=300
x-mn-w
12-28
content-length
15303
x-mnet-hl2
8-8
expires
Tue, 01 Oct 2019 13:48:58 GMT
rtbsmpubs.php
contextual.media.net/
5 KB
2 KB
Script
General
Full URL
https://contextual.media.net/rtbsmpubs.php?&gdpr=1&gdprconsent=1&cid=8HB41O6BH&region=nv&ptrid=8PREB0781&requestString=555212031*4%7C300x600%7C8CU5BD6EW%7C639665355%40555212031*97%7C300x600%7C8CU5BD6EW%7C639665355%40555212031*175%7C300x600%7C8CU5BD6EW%7C639665355%40555212031*178%7C300x600%7C8CU5BD6EW%7C639665355&crid=555212031&sd=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&bl=1&rt=5&dn=https://securityaffairs.co&https=1&act=headerBid&prvReqId=682611849092848341569937438586&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.8603654790239337&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1585%2C%22vh%22%3A1200%2C%22ph%22%3A4927%7D&itype=HB-CM&bt=1&isRefresh=0&callback=window.hbCMBidxc.rtbsheaderBid5S0
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
31dd9b4f7ea697c2d0640510fbce7a4136209a712ae6f90a70574e948c169a08

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
max-age=0, no-cache, no-store
timing-allow-origin
*
content-length
1588
x-mnet-hl2
E
expires
Tue, 01 Oct 2019 13:43:58 GMT
fcmdynet.js
contextual.media.net/ Frame 3B70
42 KB
15 KB
Script
General
Full URL
https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&size=300x600&cc=NL&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&nse=3&vi=1569937438891765566&lw=1&ugd=4&rtbs=1&hlt=1&dfp=1&nb=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
a2789929aecd0e896ebade7618b39d20f6c27d4ab1edcb4bb19182be651df31a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
status
200
cache-control
max-age=300
x-mn-w
12-2
content-length
15374
x-mnet-hl2
8-8
expires
Tue, 01 Oct 2019 13:48:58 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 35DA
44 KB
14 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4fd1acd345a275a4bac18996c4de2352999db69b6a14a24bdda89af0e7c4ce3a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"295 / 896 of 1000 / last-modified: 1569872919"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14275
x-xss-protection
0
expires
Tue, 01 Oct 2019 13:43:58 GMT
bping.php
lg3.media.net/
35 B
177 B
Image
General
Full URL
https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=762221962&vi=1569937438796240605&ugd=4&lf=6&cc=NL&wsip=2886781043&r=1569937438553&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=49981&vgd_nvLogging=0&hvsid=00001569937438551014956871685537
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:58 GMT
server
Apache
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Tue, 01 Oct 2019 13:43:58 GMT
bping.php
lg3.media.net/
35 B
177 B
Image
General
Full URL
https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&vi=1569937438851172487&ugd=4&lf=6&cc=NL&wsip=2886781043&r=1569937438579&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=49981&vgd_nvLogging=0&hvsid=00001569937438579014956871685242
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:58 GMT
server
Apache
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Tue, 01 Oct 2019 13:43:58 GMT
bping.php
lg3.media.net/
35 B
177 B
Image
General
Full URL
https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=639665355&vi=1569937438891765566&ugd=4&lf=6&cc=NL&wsip=2886781043&r=1569937438586&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=49981&vgd_nvLogging=0&hvsid=00001569937438585014956871685152
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:58 GMT
server
Apache
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Tue, 01 Oct 2019 13:43:58 GMT
sc
l.sharethis.com/
Redirect Chain
  • https://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&fpc=6f69f6a-16d879036cc-3084b36d-1&sessionID=1569937438412.18876&hostname=securityaffairs.co&location=%2Fwordpress%2F91759%2...
  • https://l.sharethis.com/sc?cm=ZHQAD12TWB4AAAASD6jUAw%3D%3D&uid=true&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&sop=false
51 B
509 B
XHR
General
Full URL
https://l.sharethis.com/sc?cm=ZHQAD12TWB4AAAASD6jUAw%3D%3D&uid=true&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&sop=false
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.80.102 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-195-80-102.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
47374c98881c854f070492cb2170394e9983559b7dc2cb63c93961f693b674d9

Request headers

Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 01 Oct 2019 13:43:58 GMT
Access-Control-Max-Age
1728000
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://securityaffairs.co
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Access-Control-Allow-Headers
*
Content-Length
51
Stid
ZHQAD12TWB4AAAASD6jUAw==

Redirect headers

Date
Tue, 01 Oct 2019 13:43:58 GMT
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
https://securityaffairs.co
Access-Control-Max-Age
1728000
P3p
policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Location
/sc?cm=ZHQAD12TWB4AAAASD6jUAw%3D%3D&uid=true&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&sop=false
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Access-Control-Allow-Headers
*
Content-Length
200
Stid
ZHQAD12TWB4AAAASD6jUAw==
xd_arbiter.php
staticxx.facebook.com/connect/ Frame FECA
0
0
Document
General
Full URL
https://staticxx.facebook.com/connect/xd_arbiter.php?version=44
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=3d465926d6ee90a6bee1ab877a0042f3&ua=modern_es6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
staticxx.facebook.com
:scheme
https
:path
/connect/xd_arbiter.php?version=44
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html

Response headers

status
200
content-encoding
br
content-type
text/html; charset=utf-8
strict-transport-security
max-age=15552000; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
expires
Tue, 29 Sep 2020 21:36:40 GMT
cache-control
public,max-age=31536000,immutable
x-fb-debug
FVkSWhR2mJK6Wt2WkCMKbg9JQdhKyi8wJRthbvLeeztL7JjKN8/5MxCw66dpd96/am90CL8k8CKQklCpVZXmZA==
content-length
11821
x-fb-trip-id
420120009
date
Tue, 01 Oct 2019 13:43:58 GMT
integrator.js
adservice.google.de/adsid/ Frame F36E
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame F36E
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_modern_2019092602.js
securepubads.g.doubleclick.net/gpt/ Frame F36E
145 KB
56 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_2019092602.js?21064579
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
sffe /
Resource Hash
831d19d3c80ca082ccf9394743c71280aa5a2b7c40b8176382eb1ce20ad06ae7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 26 Sep 2019 18:43:36 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
56843
x-xss-protection
0
expires
Tue, 01 Oct 2019 13:43:58 GMT
integrator.js
adservice.google.de/adsid/ Frame 35DA
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 35DA
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2019092602.js
securepubads.g.doubleclick.net/gpt/ Frame 35DA
158 KB
58 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019092602.js?21064578
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
sffe /
Resource Hash
35aefd2d1de0b25d9a5640cf3129dfc507a3c417a7da34f4bb6f9b4a79e19484
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 26 Sep 2019 18:43:36 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
59149
x-xss-protection
0
expires
Tue, 01 Oct 2019 13:43:58 GMT
/
securityaffairs.co/wordpress/
Redirect Chain
  • https://securityaffairs.co/wordpress?ga_action=googleanalytics_get_script
  • https://securityaffairs.co/wordpress/?ga_action=googleanalytics_get_script
493 B
470 B
XHR
General
Full URL
https://securityaffairs.co/wordpress/?ga_action=googleanalytics_get_script
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache / PHP/7.2.22
Resource Hash
529a8625b1d79f8a672375f5acdefd683f86f29327461266fa428aa734cb697b

Request headers

Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
server
Apache
x-powered-by
PHP/7.2.22
vary
Accept-Encoding,Cookie
content-type
text/html; charset=UTF-8

Redirect headers

status
301
date
Tue, 01 Oct 2019 13:43:58 GMT
server
Apache
content-length
282
location
https://securityaffairs.co/wordpress/?ga_action=googleanalytics_get_script
content-type
text/html; charset=iso-8859-1
widget_iframe.d6364fae9340b0be5f13818370141fd0.html
platform.twitter.com/widgets/ Frame 92AE
0
0
Document
General
Full URL
https://platform.twitter.com/widgets/widget_iframe.d6364fae9340b0be5f13818370141fd0.html?origin=https%3A%2F%2Fsecurityaffairs.co
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40AD) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Tue, 01 Oct 2019 13:43:58 GMT
Etag
"7d3f6ed140174a20e7c8be261a70a863+gzip"
Last-Modified
Tue, 17 Sep 2019 17:14:06 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (fcn/40AD)
Vary
Accept-Encoding
X-Cache
HIT
Content-Length
5816
g.gif
pixel.wp.com/
50 B
92 B
Image
General
Full URL
https://pixel.wp.com/g.gif?v=ext&j=1%3A7.7.2&blog=29506073&post=91759&tz=0&srv=securityaffairs.co&host=securityaffairs.co&ref=&fcp=2328&rand=0.7801051724875565
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Tue, 01 Oct 2019 13:43:58 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
moment~timeline~tweet.ec04a6cb5ba879d0e0db41f211639fdf.js
platform.twitter.com/js/
24 KB
8 KB
Script
General
Full URL
https://platform.twitter.com/js/moment~timeline~tweet.ec04a6cb5ba879d0e0db41f211639fdf.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41AF) /
Resource Hash
57811344d04a892ddcd3623c551ce97f268cdf0b300e2396cac5168dbc49d425

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 01 Oct 2019 13:43:58 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 17:14:00 GMT
Server
ECS (fcn/41AF)
Etag
"193d41dde5636e7f143422dcf5051b6d+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Content-Type
application/javascript; charset=utf-8
Content-Length
7914
tweet.b2d749028be81f16d9cb4994d9692feb.js
platform.twitter.com/js/
19 KB
7 KB
Script
General
Full URL
https://platform.twitter.com/js/tweet.b2d749028be81f16d9cb4994d9692feb.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40D8) /
Resource Hash
2137b85fb02da63ebddb0df947618705e590cac29d7dd5e268337e92ebf6751e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 01 Oct 2019 13:43:58 GMT
Content-Encoding
gzip
Last-Modified
Tue, 17 Sep 2019 17:14:00 GMT
Server
ECS (fcn/40D8)
Etag
"add928b0d9be8cf878d1c1f13a904301+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Content-Type
application/javascript; charset=utf-8
Content-Length
6281
syndication
syndication.twitter.com/i/jot/
43 B
337 B
Image
General
Full URL
https://syndication.twitter.com/i/jot/syndication?dnt=1&l=%7B%22_category_%22%3A%22syndicated_impression%22%2C%22triggered_on%22%3A1569937438771%2C%22dnt%22%3Atrue%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22impression%22%7D%7D
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.200 , United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
117
pragma
no-cache
last-modified
Tue, 01 Oct 2019 13:43:58 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
fe7d7b22790b42bc6a7e8f512afe4b6d
x-transaction
007097ad00881ce0
expires
Tue, 31 Mar 1981 05:00:00 GMT
tweets.json
cdn.syndication.twimg.com/
17 KB
3 KB
Script
General
Full URL
https://cdn.syndication.twimg.com/tweets.json?callback=__twttr.callbacks.cb0&ids=1176803541047861249%2C1177256656322695168&lang=en&suppress_response_codes=true&theme=light&tz=GMT%2B0200
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
tsa_f /
Resource Hash
3253c0f033164f38e0cc32f41cc71eb02c263c92bc54738ffc32a077c8c5801c
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-disposition
attachment; filename=jsonp.jsonp
content-length
2954
x-xss-protection
0
x-response-time
197
last-modified
Tue, 01 Oct 2019 13:43:58 GMT
server
tsa_f
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
application/javascript;charset=utf-8
cache-control
must-revalidate, max-age=60
x-connection-hash
feae0817edd9b529cf7f757f7dfd5b1a
timing-allow-origin
*
x-transaction
006fb3240007eb2e
expires
Tue, 01 Oct 2019 13:44:58 GMT
nrrV2325.js
contextual.media.net/__media__/js/util/ Frame 7320
64 KB
22 KB
Script
General
Full URL
https://contextual.media.net/__media__/js/util/nrrV2325.js
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&size=300x250&cc=NL&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&nse=3&vi=1569937438796240605&lw=1&ugd=4&rtbs=1&hlt=1&dfp=1&nb=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
5043660f05ed1feb3879441fbb19c13705ddb2f44d732da7e08e3c75fed51932

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
max-age=2592000
date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
x-mnet-h
8-12
content-type
text/javascript; charset=utf-8
status
200
cache-control
max-age=1209600
content-length
21812
expires
Tue, 15 Oct 2019 13:43:58 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame F36E
4 KB
2 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4013859877131558&correlator=584654795477798&output=ldjh&callback=googletag.impl.pubads.callbackProxy1&impl=fif&adsid=NT&eid=21064579%2C21062415%2C21064521%2C21064581&vrg=2019092602&npa=1&guci=1.2.0.0.2.1.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191001&iu=%2F45361917%2F8CU5BD6EW-762221962-300x250_inside_post&sz=300x250&scp=crid%3D762221962%26mnet_segment%3D0.78%26mnet_variant%3D454%26pub_domain%3Dsecurityaffairs.co%26mnet_cc%3DNL%26mnet_bucketid%3Db3%26mnet_ref_ybn%3D1%26PubMaticSS%3D1610%26RubiconSS%3D2209&eri=4&cookie_enabled=1&bc=31&abxe=1&lmt=1569937438&dt=1569937438893&dlt=1569937438576&idt=172&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=250&oid=3&adx=320&ady=3288&adk=3177995050&uci=ndjksvcwwvp2&ifi=1&ifk=2121209063&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&top=securityaffairs.co&dssz=5&icsg=170&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&ga_vid=1029843746.1569937439&ga_sid=1569937439&ga_hid=322820002&fws=256&ohw=0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_2019092602.js?21064579
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
94deff5cec03e6e7fcecce2bfb0a845de50b36eb46eab7980ce33599c39edf97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2000
x-xss-protection
0
google-lineitem-id
731775557
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
33134182877
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_modern_rendering_2019092602.js
securepubads.g.doubleclick.net/gpt/ Frame F36E
59 KB
23 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_rendering_2019092602.js?21064579
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_2019092602.js?21064579
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
sffe /
Resource Hash
ede50408d9975eb59f99b6525984e2c1cf091977e1bbc37d49a1aee6e75bcc90
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 26 Sep 2019 18:43:36 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
23878
x-xss-protection
0
expires
Tue, 01 Oct 2019 13:43:58 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame F36E
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_2019092602.js?21064579
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

mediamain.html
contextual.media.net/ Frame 2786
60 KB
15 KB
Script
General
Full URL
https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&pid=8PO5M70HK&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrEBbIZGw_v2fXpyZXRW3WVE%3D&cme=hmi3FHRUKMmzKimfb0JIDAbp_fyjVK7depiARrivsoxRj_hLfG7Sh7pIMMFBEH3GQmWMN5-SfqQXYweHSH8KKnPGVgvGQ_aPSf0OGKC6cBSpFVbTXU3f6_1duVJnBmigo-643UevFDALT110G-ESfQ%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7Cq-6hGTGi_Gb8qnAezGKJeWNa85AapA8Th5FcMSeR34__Dyh8hafgsrGTmOlO-kzWx3Z5GgLYC9lf3kI5GK-yU5y237AMkDVPU68KaQ3qCjY%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=NL&bf=0&staticIframe=1&vif=1&nse=3&vi=1569937438796240605&lw=1&ugd=4&ib=0&katid=801338199&katbid=-21&katen=1&nb=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
fcb7e630770077694f06c279fb4a785de12b5c08004e415ca9b6a32354de4b61

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
max-age=300
x-mnet-hl3
8-12
x-mn-w
12-5
content-length
15406
expires
Tue, 01 Oct 2019 13:48:59 GMT
mediamain.html
contextual.media.net/ Frame 8405
60 KB
15 KB
Script
General
Full URL
https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&pid=8PO5M70HK&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrHvHwrQGlpByWaOO1vn303s%3D&cme=ddF3tVt6Jgwc0vmFKxq3sxZQnh0iZwpa5KhKGcDHJFxEgLz35A0naNpam52fKJe_u9tIkCm3_lVs8UO_TWiOPSCbQBfwxs5LQx8hOuBd8dcPClRiQGYMWhkgJLSjI5BzpX_yLx7ECLkDeliuUBQP2w%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7Cq-6hGTGi_Gb8qnAezGKJeWNa85AapA8Th5FcMSeR34__Dyh8hafgsrGTmOlO-kzWx3Z5GgLYC9lf3kI5GK-yU5y237AMkDVPU68KaQ3qCjY%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=NL&bf=0&staticIframe=1&vif=1&nse=3&vi=1569937438851172487&lw=1&ugd=4&ib=0&katid=801344920&katbid=-21&katen=1&nb=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
33bab23e69957f20e39d83d1ccf32d6846b86b5d993744acf278aaac2b411852

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
max-age=300
x-mnet-hl3
8-12
x-mn-w
12-1
content-length
15450
expires
Tue, 01 Oct 2019 13:48:59 GMT
log
hblg.media.net/
35 B
185 B
Image
General
Full URL
https://hblg.media.net/log?logid=awlog&pid=8PREB0781&itype=HB-CM&dn=securityaffairs.co&cid=8HB41O6BH&svr=2019100108_689&servname=c8-web-3&gdpr=1&csex=2&csstr=&ugd=4&adt=desktop&vid=00001569937438915014956871684771&vsid=&sd=1&gtd=400&inid=0&gfd=&cc=NL&sc=&ct=AMSTERDAM&abte=CONTROL&adbd=0&amp=0&version=1&sB=true&cors=true&disB=false&ice=0&vw=1585&vh=1200&pht=5138&cl=&__rk=0&app=0&rtype=&pvid=4&prvAccId=184323154&prvApiId=8CU5BD6EW&exid=31&pcId=0000EEA&mowxReqId=146720045560518221569937438580&crid=512365842&g=0&size=300x250&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=1&rtime=114&dtc=nydc&rtbsv2=&apid=1&wsip=c10-mowx-web-15&ltime=257&abs=0&ssregion=&ssreqid=&sssvnm=&bdp=0.21&cbdp=0.21&dcbdp=0&ckfl=0&cs=&mnet_ckfl=0&cat=&attr=&advId=&advNm=&advUrl=unknown&dfpBd=0.21&nms=1&di=&dt=O&epc=184323154&ogbdp=0.21&s=1&snm=success&dbf=1&bdata=iurl_l%3D40%7C%7Cogerpm%3D0.11%7C%7Cvis_sd%3D2019093019%7C%7Cxgboost_l%3D0%7C%7Cscd%3Dzh%7C%7Cvl2r_sd%3D2019100103%7C%7Ciurl_b%3D5815.98%7C%7Cxgb_sd%3D2019092800%7C%7Clast%3D0%7C%7Cdevice_b%3D0.76%7C%7Cvl2r_if_sd%3D2019092923%7C%7Cfbb%3D0%7C%7Cxgb_nt%3D101%7C%7Crc%3D1%7C%7Crps_sd%3D2019100100%7C%7Cvis_b%3D314.01%7C%7Curl_b%3D0.23%7C%7Curl_l%3D20%7C%7Cxgb_b%3D0%7C%7Cvis_l%3D20%7C%7Cgcat%3D500436%7C%7Cbb%3D196%7C%7Cvv%3D0%7C%7Cl2r_b%3D1000%7C%7Cvl2r_l%3D-1%7C%7Cerpm%3D0.11%7C%7Csd%3D1%7C%7Cl2r_l%3D-1%7C%7Cbtd%3D1116692160512%7C%7Cuim%3D1%7C%7Crps_l%3D-1%7C%7Cdevice_l%3D0%7C%7Css%3D1600x1200%7C%7Cuiw%3D0%7C%7Crps_b%3D162.04%7C%7CCI%3D1604%7C%7Ctb%3D-1%7C%7Cct%3Dnaaldwijk%7C%7Cbasis2%3D196%7C%7Cbasis1%3D196%7C%7CisRef%3D0%7C%7Cisif%3D0%7C%7Clc%3D0%7C%7Cxgboost_b%3D0%7C%7Cbid%3D0.21%7C%7Cdc%3D7%7C%7Cvl2r_b%3D204.29%7C%7Cogbid%3D0.21%7C%7Ccbdp%3D0.21%7C%7Cbflag%3D0%7C%7Cdmm%3D&cmpid=&bId=&pcrid=8CU5BD6EW-184323154-40-18&ruct=0&brs=&brr=&iurl=https%3A%2F%2Fiurl-a.akamaihd.net%2Fybntag%3F%26cid%3D8CU5BD6EW%26crid%3D184323154%26size%3D300x250%26requrl%3Dhttps%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F91759%252Fhacking%252Fvbulletin-exploit-botnet.html&htps=0&ptype=27&pbidflr=0.00&exp=sfl%3Dfalse%7Cbfl%3D-100%7Crc%3D1%7Chr_ck%3Dfalse%7Cfl_rl%3D1%7Cdbr%3D1%7Ctkd%3Dnull&bfs=0&seat=&nbr=0&ba=76&ybnca_gbid=&ybnca_erpm=0.11&ybnca_vbid=0.11&yogbdp=0.21&yErpmFlag=0&smsrc=1&strg=&ybnca_bbid=-1.0&prvReqId=21125739912785164_514429637_51236584241&dStat=0&ogbid=0.21&acid=136861136045447781569937438580&act=headerBid&dtfdl=&dspltime=&ttfd=&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=0&adj0=0&adj1=0&adj2=0&adj3=0&patkey=&patint%3C%3E=&spSource=0&spIvt=3&spId=&spFst=0&spIsReq=3&spTo=3&top=0&btm=0&lft=0&rght=0&mx_PC=0&mx_SPRIG=&mx_UCC=&mx_GCID=&mx_IAB2=&mx_SC=0&mx_dgf=0&mx_bsBucket=0&mx_bsProfile=0&mx_sbp=-10&mx_aurt=0&actltime=259&brf=0&dcs=&dfpDiv=&dfpPos=&dfpAdPath=&lper=1&td=r%3Dstr%7Cab%3D0%7C&oyaf=0&sbdrid=426&ra_sz=300x250&sc_pvid=&sc_ogbdp=0&sc_adj0=0&sc_adj1=0&sc_adj2=0&sc_prspt=&sc_act=&sc_bdata=&sc_bdp=0&sc_cbdp=0&sc_bId=&sc_cat=&sc_cmpid=&sc_advId=&sc_advNm=&sc_advUrl=&udc=&rti=-1&rme=ADPTR&bbdrid=&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&kwrf=&epurl=
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache Tomcat /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:58 GMT
server
Apache Tomcat
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Tue, 01 Oct 2019 13:43:58 GMT
mediamain.html
contextual.media.net/ Frame 387B
62 KB
15 KB
Script
General
Full URL
https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&pid=8PO5M70HK&size=300x600&cpnet=yVb1sHm-0KIh29BOFTjjrOMbY3Wy7OSYfNFL7sC0vVY%3D&cme=hmi3FHRUKMkilTzseEeahYBK0Dc9Iehoc--eJ91ZbJOU32yPMPHcgTcILw-vm_YLN7Vl26zwtvAWFY8-y5nJkY74VltIAgM5qiRWJ1RL1t9F_RjSHP5de0JanKU1hKV6Xa5xAjKNU5clkdmKXRb2-Q%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7Cq-6hGTGi_Gb8qnAezGKJeWNa85AapA8Th5FcMSeR34__Dyh8hafgsrGTmOlO-kzWx3Z5GgLYC9lf3kI5GK-yU5y237AMkDVPU68KaQ3qCjY%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=NL&bf=0&staticIframe=1&vif=1&nse=3&vi=1569937438891765566&lw=1&ugd=4&ib=0&katid=801338173&katbid=-21&katen=1&nb=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f184f9b4ee160da5ab5ef268074da09846272433305a86394de7046fd3b91296

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
max-age=300
x-mnet-hl3
8-12
x-mn-w
12-28
content-length
15300
expires
Tue, 01 Oct 2019 13:48:59 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 35DA
4 KB
2 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4501322389118759&correlator=93509999856478&output=ldjh&callback=googletag.impl.pubads.callbackProxy1&impl=fif&adsid=NT&eid=21064578%2C21062751%2C21064568%2C21064580&vrg=2019092602&npa=1&guci=1.2.0.0.2.1.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191001&iu=%2F45361917%2F8CU5BD6EW-639665355-Skyscraper_post_yahoo_300_x_600&sz=300x600&scp=crid%3D639665355%26mnet_segment%3D0.09%26mnet_variant%3D426%26pub_domain%3Dsecurityaffairs.co%26mnet_cc%3DNL%26mnet_bucketid%3Db3%26mnet_ref_ybn%3D1%26PubMaticSS%3D1610%26RubiconSS%3D2209&eri=4&cookie_enabled=1&bc=31&abxe=1&lmt=1569937438&dt=1569937438964&dlt=1569937438592&idt=167&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=600&oid=3&adx=973&ady=1639&adk=2891760302&uci=huxzkz8uio3&ifi=1&ifk=2121212999&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&top=securityaffairs.co&dssz=5&icsg=170&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&ga_vid=974807601.1569937439&ga_sid=1569937439&ga_hid=436680708&fws=256&ohw=0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019092602.js?21064578
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
cb049a37fbac86a3d282e1946c57703c3d3078667362e694b324f5560629f308
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2015
x-xss-protection
0
google-lineitem-id
731758397
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
35793382397
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019092602.js
securepubads.g.doubleclick.net/gpt/ Frame 35DA
63 KB
24 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019092602.js?21064578
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019092602.js?21064578
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
sffe /
Resource Hash
35c073a53df4dd054afab9758b90a88846802754ff15fc3b31cc9af133c8a401
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 26 Sep 2019 18:43:36 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24721
x-xss-protection
0
expires
Tue, 01 Oct 2019 13:43:58 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ Frame 35DA
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019092602.js?21064578
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

tweet.9bf5093a19cec463852b31b784bf047a.light.ltr.css
platform.twitter.com/css/
51 KB
12 KB
Stylesheet
General
Full URL
https://platform.twitter.com/css/tweet.9bf5093a19cec463852b31b784bf047a.light.ltr.css
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40E3) /
Resource Hash
82362621d84dafedb468e0a04d88dcc0730114e52b6907a2e89141e7ae379aed

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 01 Oct 2019 13:43:59 GMT
Content-Encoding
gzip
Last-Modified
Mon, 09 Sep 2019 22:11:05 GMT
Server
ECS (fcn/40E3)
Etag
"98ef2a3a88ab7443920fb6114193c099+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Content-Type
text/css; charset=utf-8
Content-Length
11553
tweet.9bf5093a19cec463852b31b784bf047a.light.ltr.css
platform.twitter.com/css/
51 KB
51 KB
Image
General
Full URL
https://platform.twitter.com/css/tweet.9bf5093a19cec463852b31b784bf047a.light.ltr.css
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40E3) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 01 Oct 2019 13:43:59 GMT
Content-Encoding
gzip
Last-Modified
Mon, 09 Sep 2019 22:11:05 GMT
Server
ECS (fcn/40E3)
Etag
"98ef2a3a88ab7443920fb6114193c099+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Content-Type
text/css; charset=utf-8
Content-Length
11553
view
securepubads.g.doubleclick.net/pcs/ Frame 8219
0
57 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstAaOlpzDGnl3K6qKiu3vN9g9SWtdG1rWP-WbQcgjry5PpvnKUT9-7_7_g4vxlTlXJXs8sEmeg3a8zMakIiyMqlgV_U-7i59kjADC6saB0BR7v0SCGd0UpQwRYMn8YyQHySfpyDFfpoLmheBIuucRsYOXiFjX3F2zUnvvHBZTknRfRBkGI2QcBIpqN4nVAYgaKSLKUbqTt2aGd-565-EbwAF_tAZnHLFiUUnb18gZAhuxANL1xCvQZe5NEq9ilvU9W1wx4PkPjjiK5DkBv4r1AiNI5WhptLhLgJjrTmXod6LhHI&sai=AMfl-YRGp9BMiaYF2cSBOlrctfc28rBXnv6K6GKBU7QqT3Gz-787XXqofJW-6rNaCNe-akO8zyZS35ncSw3i1ZsKqCcrHbLYSMeYMwvN8_EDZw&sig=Cg0ArKJSzH5zIx0jEDwmEAE&urlfix=1&adurl=
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 01 Oct 2019 13:43:59 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 8219
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_rendering_2019092602.js?21064579
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
5f224a13a15499778526423761125cbae8b8063bf0f90a46862671e17ccc9e7b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1569842443931303"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29671
x-xss-protection
0
expires
Tue, 01 Oct 2019 13:43:59 GMT
osd.js
www.googletagservices.com/activeview/js/current/ Frame F36E
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_modern_2019092602.js?21064579
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a7708a738c64bd02df7ae231ab503159ab3336fa03de1853675631309ec07ada
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1569842443931303"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29108
x-xss-protection
0
expires
Tue, 01 Oct 2019 13:43:59 GMT
FGltMfZ1_normal.png
pbs.twimg.com/profile_images/1113668754141900801/
2 KB
2 KB
Image
General
Full URL
https://pbs.twimg.com/profile_images/1113668754141900801/FGltMfZ1_normal.png
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40D4) /
Resource Hash
185c9e2bc69d60f16dd75642555ec30aca7ed11607d624abff383b8c3ccbdbb1
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:51 GMT
x-content-type-options
nosniff
x-cache
HIT
status
200
content-length
2339
x-response-time
105
surrogate-key
profile_images profile_images/bucket/0 profile_images/1113668754141900801
last-modified
Thu, 04 Apr 2019 05:02:56 GMT
server
ECS (fcn/40D4)
strict-transport-security
max-age=631138519
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
49cf348f09ce6bfa82f78a62f2f0efc6
accept-ranges
bytes
EFZ0sHJU8AYadEw
pbs.twimg.com/media/
3 KB
4 KB
Image
General
Full URL
https://pbs.twimg.com/media/EFZ0sHJU8AYadEw?format=jpg&name=360x360
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40D9) /
Resource Hash
90c24135dc23d0aad6b1a7639f178e4020b5301323cf343d0ea09e2c19e463c0
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
x-content-type-options
nosniff
x-cache
HIT
status
200
content-length
3450
x-response-time
157
surrogate-key
media media/bucket/1 media/1177256653785198598
last-modified
Thu, 26 Sep 2019 16:18:33 GMT
server
ECS (fcn/40D9)
strict-transport-security
max-age=631138519
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
677c8f218d3a98b290f270b622f16aa4
accept-ranges
bytes
EFZ0sHJUYAE048y
pbs.twimg.com/media/
35 KB
35 KB
Image
General
Full URL
https://pbs.twimg.com/media/EFZ0sHJUYAE048y?format=png&name=360x360
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/419A) /
Resource Hash
0318d45b1e27a4c9d626763e1fc386b84d3347ba439d1efc624b7e84507caae6
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
x-content-type-options
nosniff
x-cache
HIT
status
200
content-length
36095
x-response-time
151
surrogate-key
media media/bucket/7 media/1177256653785161729
last-modified
Thu, 26 Sep 2019 16:18:33 GMT
server
ECS (fcn/419A)
strict-transport-security
max-age=631138519
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
cc8c62107a2cbd501d9c512a1a401958
accept-ranges
bytes
EFZ0sHLUYAAU0ru
pbs.twimg.com/media/
25 KB
25 KB
Image
General
Full URL
https://pbs.twimg.com/media/EFZ0sHLUYAAU0ru?format=png&name=360x360
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40FD) /
Resource Hash
f64a19c5e65d43242870597af0a9ee5424ec221c86938d761cbaa81edc23e5d8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
x-content-type-options
nosniff
x-cache
HIT
status
200
content-length
25659
x-response-time
145
surrogate-key
media media/bucket/6 media/1177256653793550336
last-modified
Thu, 26 Sep 2019 16:18:33 GMT
server
ECS (fcn/40FD)
strict-transport-security
max-age=631138519
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
b8238a0f45729d431818e70bb1bd17dd
accept-ranges
bytes
SU05k-Aq_normal.jpg
pbs.twimg.com/profile_images/624449394025172992/
2 KB
2 KB
Image
General
Full URL
https://pbs.twimg.com/profile_images/624449394025172992/SU05k-Aq_normal.jpg
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41A3) /
Resource Hash
6e0488bae82bd65d223e31d6284d61d6f6bb84306e711f1cdf700c337b07f7ad
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
x-content-type-options
nosniff
x-cache
HIT
status
200
content-length
1655
x-response-time
123
surrogate-key
profile_images profile_images/bucket/6 profile_images/624449394025172992
last-modified
Fri, 24 Jul 2015 05:19:51 GMT
server
ECS (fcn/41A3)
strict-transport-security
max-age=631138519
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
6d60680b5ea5162124391afce8aedfd4
accept-ranges
bytes
truncated
/
825 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4468e35646c229b518e5f398c5a3d6b15ba1351a71ef22692129bb32f5030ac0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
572 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0341a4478ce861ef85c819b913fa0a2501836a6a2ffda8643e95e39f4a2a7de0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
707 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
338e5578a7b3021caec1db415b93b214c378029d3cd8d19adc833d8b85ea7d29

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
600 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c50a17e8272b9359e4b62e0f305e201f359cb5bd2245671c115d031f2b7f68d0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
323 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c3531ed2c934e5daee80955db42a0245d666131e6322c6ec6985992922520ab4

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ded16b9cb72df85ea242aaef8878c716abb57c746f0bfda6eabd2b9ddb2a23b5

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
log
hblg.media.net/
35 B
185 B
Image
General
Full URL
https://hblg.media.net/log?logid=aplog&pid=8PREB0781&itype=HB-CM&dn=securityaffairs.co&cid=8HB41O6BH&svr=2019100108_689&servname=c8-web-3&gdpr=1&csex=2&csstr=&ugd=4&adt=desktop&vid=00001569937438915014956871684771&vsid=&sd=1&gtd=400&inid=0&gfd=&cc=NL&sc=&ct=AMSTERDAM&abte=CONTROL&adbd=0&amp=0&version=1&sB=true&cors=true&disB=false&ice=0&vw=1585&vh=1200&pht=5138&cl=&__rk=0&app=0&rtype=&pvid=0&prvAccId=&prvApiId=&exid=&pcId=0000EEA&adj0=0&adj1=0&adj2=0&adj3=0&mowxReqId=&crid=170605770&g=0&size=300x250&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=0&bdp=0&cbdp=0&dcbdp=0&ckfl=&cs=&mnet_ckfl=&cat=&attr=&advId=&advNm=&advUrl=&dfpBd=0&nms=1&di=&dt=&epc=&ogbdp=0&s=1&snm=success&dbf=1&bdata=&cmpid=&bId=&pcrid=&ruct=0&brs=&brr=&iurl=&htps=0&ptype=27&pbidflr=0&exp=&bfs=0&seat=&nbr=&ba=0&ybnca_gbid=&ybnca_erpm=&ybnca_vbid=&yogbdp=&yErpmFlag=&smsrc=1&strg=&ybnca_bbid=&prvReqId=&dStat=&ogbid=0&acid=366235628083163391569937438564&act=headerBid&dtfdl=&dspltime=&ttfd=&rtime=&dtc=&rtbsv2=&apid=&wsip=&ltime=&abs=&ssregion=&ssreqid=&sssvnm=&top=0&btm=0&lft=0&rght=0&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=0&patkey=&patint=&spSource=0&spIvt=0&spId=&spFst=0&spIsReq=0&spTo=0&refVisId=&osnbr=&brf=0&iwb=1&toconsider=0&dcs=&actltime=220&acsn=1&dfpDiv=&dfpAdPath=&dfpPos=&sbdrid=454&bbdrid=&td=%7C&lper=1&pvid=0&prvAccId=&prvApiId=&exid=&pcId=0000EEA&adj0=0&adj1=0&adj2=0&adj3=0&mowxReqId=&crid=512365842&g=0&size=300x250&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=0&bdp=0&cbdp=0&dcbdp=0&ckfl=&cs=&mnet_ckfl=&cat=&attr=&advId=&advNm=&advUrl=&dfpBd=0&nms=1&di=&dt=&epc=&ogbdp=0&s=1&snm=success&dbf=1&bdata=&cmpid=&bId=&pcrid=&ruct=0&brs=&brr=&iurl=&htps=0&ptype=27&pbidflr=0&exp=&bfs=0&seat=&nbr=&ba=0&ybnca_gbid=&ybnca_erpm=&ybnca_vbid=&yogbdp=&yErpmFlag=&smsrc=1&strg=&ybnca_bbid=&prvReqId=&dStat=&ogbid=0&acid=136861136045447781569937438580&act=headerBid&dtfdl=&dspltime=&ttfd=&rtime=&dtc=&rtbsv2=&apid=&wsip=&ltime=&abs=&ssregion=&ssreqid=&sssvnm=&top=0&btm=0&lft=0&rght=0&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=0&patkey=&patint=&spSource=0&spIvt=0&spId=&spFst=0&spIsReq=0&spTo=0&refVisId=&osnbr=&brf=0&iwb=1&toconsider=0&dcs=&actltime=259&acsn=1&dfpDiv=&dfpAdPath=&dfpPos=&sbdrid=426&bbdrid=&td=%7C&lper=1&pvid=0&prvAccId=&prvApiId=&exid=&pcId=0000EEA&adj0=0&adj1=0&adj2=0&adj3=0&mowxReqId=&crid=555212031&g=0&size=300x600&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=0&bdp=0&cbdp=0&dcbdp=0&ckfl=&cs=&mnet_ckfl=&cat=&attr=&advId=&advNm=&advUrl=&dfpBd=0&nms=1&di=&dt=&epc=&ogbdp=0&s=1&snm=success&dbf=1&bdata=&cmpid=&bId=&pcrid=&ruct=0&brs=&brr=&iurl=&htps=0&ptype=27&pbidflr=0&exp=&bfs=0&seat=&nbr=&ba=0&ybnca_gbid=&ybnca_erpm=&ybnca_vbid=&yogbdp=&yErpmFlag=&smsrc=1&strg=&ybnca_bbid=&prvReqId=&dStat=&ogbid=0&acid=257419550668695101569937438586&act=headerBid&dtfdl=&dspltime=&ttfd=&rtime=&dtc=&rtbsv2=&apid=&wsip=&ltime=&abs=&ssregion=&ssreqid=&sssvnm=&top=0&btm=0&lft=0&rght=0&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=0&patkey=&patint=&spSource=0&spIvt=0&spId=&spFst=0&spIsReq=0&spTo=0&refVisId=&osnbr=&brf=0&iwb=1&toconsider=0&dcs=&actltime=366&acsn=1&dfpDiv=&dfpAdPath=&dfpPos=&sbdrid=426&bbdrid=&td=%7C&lper=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&kwrf=&epurl=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache Tomcat /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:59 GMT
server
Apache Tomcat
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Tue, 01 Oct 2019 13:43:59 GMT
truncated
/ Frame 8219
219 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
74e69d4e22a1174df1af2fb7e5be654a9ee551aed0ca2b437de0f1f8cd97611b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
nrrV2325.js
contextual.media.net/__media__/js/util/ Frame 67CC
64 KB
22 KB
Script
General
Full URL
https://contextual.media.net/__media__/js/util/nrrV2325.js
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
5043660f05ed1feb3879441fbb19c13705ddb2f44d732da7e08e3c75fed51932

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
max-age=2592000
date
Tue, 01 Oct 2019 13:43:59 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
x-mnet-h
8-12
content-type
text/javascript; charset=utf-8
status
200
cache-control
max-age=1209600
content-length
21812
expires
Tue, 15 Oct 2019 13:43:59 GMT
1x1.gif
contextual.media.net/__media__/pics/800028474/ Frame 67CC
42 B
192 B
Image
General
Full URL
https://contextual.media.net/__media__/pics/800028474/1x1.gif
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
last-modified
Mon, 04 Jun 2018 10:04:19 GMT
server
Apache
content-type
image/gif
status
200
cache-control
max-age=975179
accept-ranges
bytes
content-length
42
expires
Sat, 12 Oct 2019 20:36:58 GMT
10124_505bb4db55aaa1165fa3b242bf39701b.png
contextual.media.net/__media__/images/800000006/ Frame 67CC
4 KB
4 KB
Image
General
Full URL
https://contextual.media.net/__media__/images/800000006/10124_505bb4db55aaa1165fa3b242bf39701b.png
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
last-modified
Tue, 03 Oct 2017 12:52:51 GMT
server
Apache
content-type
image/png
status
200
cache-control
max-age=933979
accept-ranges
bytes
content-length
4097
expires
Sat, 12 Oct 2019 09:10:18 GMT
bullet12.woff
contextual.media.net/__media__/fonts/bullet12/ Frame 67CC
2 KB
2 KB
Font
General
Full URL
https://contextual.media.net/__media__/fonts/bullet12/bullet12.woff
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c5216d8d82c0c227f6efb8d924f603fe922e2608740205873d74c8d3e0f3e0c9

Request headers

Sec-Fetch-Mode
cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Origin
https://securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
last-modified
Mon, 16 May 2016 10:39:41 GMT
server
Apache
status
200
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
content-length
1716
expires
Wed, 02 Oct 2019 13:43:59 GMT
log
hblg.media.net/
35 B
185 B
Image
General
Full URL
https://hblg.media.net/log?logid=awlog&pid=8PREB0781&itype=HB-CM&dn=securityaffairs.co&cid=8HB41O6BH&svr=2019100108_689&servname=c8-web-3&gdpr=1&csex=2&csstr=&ugd=4&adt=desktop&vid=00001569937438915014956871684771&vsid=&sd=1&gtd=400&inid=0&gfd=&cc=NL&sc=&ct=AMSTERDAM&abte=CONTROL&adbd=0&amp=0&version=1&sB=true&cors=true&disB=false&ice=0&vw=1585&vh=1200&pht=5185&cl=&__rk=0&app=0&rtype=&pvid=4&prvAccId=762221962&prvApiId=8CU5BD6EW&exid=31&pcId=0000EEA&mowxReqId=356302861364480361569937438568&crid=170605770&g=0&size=300x250&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=1&rtime=71&dtc=nydc&rtbsv2=&apid=1&wsip=c10-mowx-web-43&ltime=210&abs=0&ssregion=&ssreqid=&sssvnm=&bdp=0.78&cbdp=0.78&dcbdp=0&ckfl=0&cs=&mnet_ckfl=0&cat=&attr=&advId=&advNm=&advUrl=unknown&dfpBd=0.78&nms=1&di=&dt=O&epc=762221962&ogbdp=0.78&s=1&snm=success&dbf=1&bdata=iurl_l%3D40%7C%7Cogerpm%3D0.01%7C%7Cvis_sd%3D2019093019%7C%7Cxgboost_l%3D0%7C%7Cscd%3Dzh%7C%7Cvl2r_sd%3D2019100103%7C%7Ciurl_b%3D299.41%7C%7Cxgb_sd%3D2019092800%7C%7Clast%3D0%7C%7Cdevice_b%3D0.76%7C%7Cvl2r_if_sd%3D2019092923%7C%7Cfbb%3D0%7C%7Cxgb_nt%3D101%7C%7Crc%3D1%7C%7Crps_sd%3D2019100100%7C%7Cvis_b%3D314.01%7C%7Curl_b%3D0.06%7C%7Curl_l%3D50%7C%7Cxgb_b%3D0%7C%7Cvis_l%3D20%7C%7Cgcat%3D500436%7C%7Cbb%3D100%7C%7Cvv%3D0%7C%7Cl2r_b%3D1000%7C%7Cvl2r_l%3D-1%7C%7Cerpm%3D0.01%7C%7Csd%3D1%7C%7Cl2r_l%3D-1%7C%7Cbtd%3D1116700549120%7C%7Cuim%3D2975%7C%7Crps_l%3D-1%7C%7Cdevice_l%3D0%7C%7Css%3D1600x1200%7C%7Cuiw%3D24%7C%7Crps_b%3D162.04%7C%7CCI%3D1604%7C%7Ctb%3D-1%7C%7Cct%3Dnaaldwijk%7C%7Cbasis2%3D196%7C%7Cbasis1%3D196%7C%7CisRef%3D0%7C%7Cisif%3D0%7C%7Clc%3D0%7C%7Cxgboost_b%3D0%7C%7Cbid%3D0.78%7C%7Cdc%3D7%7C%7Cvl2r_b%3D204.29%7C%7Cogbid%3D0.78%7C%7Ccbdp%3D0.78%7C%7Cbflag%3D0%7C%7Cdmm%3D&cmpid=&bId=&pcrid=8CU5BD6EW-762221962-40-7&ruct=0&brs=&brr=&iurl=https%3A%2F%2Fiurl-a.akamaihd.net%2Fybntag%3F%26cid%3D8CU5BD6EW%26crid%3D762221962%26size%3D300x250%26requrl%3Dhttps%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F91759%252Fhacking%252Fvbulletin-exploit-botnet.html&htps=0&ptype=27&pbidflr=0.00&exp=sfl%3Dfalse%7Cbfl%3D-100%7Crc%3D1%7Chr_ck%3Dfalse%7Cfl_rl%3D1%7Cdbr%3D1%7Ctkd%3Dnull&bfs=0&seat=&nbr=0&ba=479&ybnca_gbid=&ybnca_erpm=0.01&ybnca_vbid=0.01&yogbdp=0.78&yErpmFlag=0&smsrc=1&strg=&ybnca_bbid=-1.0&prvReqId=6576023676110691_1234098562_17060577041&dStat=0&ogbid=0.78&acid=366235628083163391569937438564&act=headerBid&dtfdl=&dspltime=&ttfd=&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=0&adj0=0&adj1=0&adj2=0&adj3=0&patkey=&patint%3C%3E=&spSource=0&spIvt=3&spId=&spFst=0&spIsReq=3&spTo=3&top=0&btm=0&lft=0&rght=0&mx_PC=0&mx_SPRIG=&mx_UCC=&mx_GCID=&mx_IAB2=&mx_SC=0&mx_dgf=0&mx_bsBucket=0&mx_bsProfile=0&mx_sbp=-10&mx_aurt=0&actltime=220&brf=0&dcs=&dfpDiv=&dfpPos=&dfpAdPath=&lper=1&td=r%3Dstr%7Cab%3D0%7C&oyaf=0&sbdrid=454&ra_sz=300x250&sc_pvid=&sc_ogbdp=0&sc_adj0=0&sc_adj1=0&sc_adj2=0&sc_prspt=&sc_act=&sc_bdata=&sc_bdp=0&sc_cbdp=0&sc_bId=&sc_cat=&sc_cmpid=&sc_advId=&sc_advNm=&sc_advUrl=&udc=&rti=-1&rme=ADPTR&bbdrid=&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&kwrf=&epurl=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache Tomcat /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:59 GMT
server
Apache Tomcat
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Tue, 01 Oct 2019 13:43:59 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 0C3C
0
279 B
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstLO8lKpD3bflRWgtIZA1N99uUz5eBxksJA84IPp-7V2pLuqMnzbm0LvdsUPW2lts09bI-eyUI4J--We0r-tlI__Sd9aSgYcIAIhnaN6BwM9xA1MUbxxTh8FiDBvKxFmWnGH-kNIYckNEnHJMki9NYIX-aDm_RDtf7sMVy0Sy5T5IqEc61097ibLWVTPz5JQ49xNwE2YTCivKNsryKs4O9zOGwTiuwkJWr9tGVqlq8pHT1cOaV2NK7NKpykvJwM9n6JKJ-rgWoaC7ldtdpewbxcXKLCk5aK-US7JDTc1MiyrYyEMsGuPbDF8g41WISA&sai=AMfl-YTOcEV5SEF9TuGvxyKsCzIidaoGQ5D6Ixnc-es3rIO-c8iatik2WK-oqrj2gUgYVS8WlAB_7x8owKlKde9v6uKG1oZ8BcFhk1T4OlkZ0A&sig=Cg0ArKJSzCaxD5xWEYfbEAE&urlfix=1&adurl=
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s08-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 01 Oct 2019 13:43:59 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 01 Oct 2019 13:43:59 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 0C3C
78 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019092602.js?21064578
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
5f224a13a15499778526423761125cbae8b8063bf0f90a46862671e17ccc9e7b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1569842443931303"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29671
x-xss-protection
0
expires
Tue, 01 Oct 2019 13:43:59 GMT
osd.js
www.googletagservices.com/activeview/js/current/ Frame 35DA
77 KB
29 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019092602.js?21064578
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a7708a738c64bd02df7ae231ab503159ab3336fa03de1853675631309ec07ada
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1569842443931303"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29108
x-xss-protection
0
expires
Tue, 01 Oct 2019 13:43:59 GMT
nrrV2325.js
contextual.media.net/__media__/js/util/ Frame D97F
64 KB
22 KB
Script
General
Full URL
https://contextual.media.net/__media__/js/util/nrrV2325.js
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/fcmdynet.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=NL&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&nse=3&vi=1569937438851172487&lw=1&ugd=4&rtbs=1&nb=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
5043660f05ed1feb3879441fbb19c13705ddb2f44d732da7e08e3c75fed51932

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
max-age=2592000
date
Tue, 01 Oct 2019 13:43:59 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
x-mnet-h
8-12
content-type
text/javascript; charset=utf-8
status
200
cache-control
max-age=1209600
content-length
21812
expires
Tue, 15 Oct 2019 13:43:59 GMT
10461_505bb4db55aaa1165fa3b242bf39701b.png
contextual.media.net/__media__/images/800000006/ Frame D97F
4 KB
4 KB
Image
General
Full URL
https://contextual.media.net/__media__/images/800000006/10461_505bb4db55aaa1165fa3b242bf39701b.png
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
last-modified
Wed, 25 Oct 2017 12:46:19 GMT
server
Apache
content-type
image/png
status
200
cache-control
max-age=976444
accept-ranges
bytes
content-length
4097
expires
Sat, 12 Oct 2019 20:58:03 GMT
Oswald-Regular.woff
contextual.media.net/__media__/fonts/Oswald-Regular/ Frame D97F
27 KB
27 KB
Font
General
Full URL
https://contextual.media.net/__media__/fonts/Oswald-Regular/Oswald-Regular.woff
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
a8451c3757b0729edcecf6edb54abacce58e3773b0e228073658377931523c29

Request headers

Sec-Fetch-Mode
cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Origin
https://securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
last-modified
Mon, 16 May 2016 10:39:41 GMT
server
Apache
status
200
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
content-length
27164
expires
Wed, 02 Oct 2019 13:43:59 GMT
Lato-Regular.woff
contextual.media.net/__media__/fonts/Lato-Regular/ Frame D97F
37 KB
38 KB
Font
General
Full URL
https://contextual.media.net/__media__/fonts/Lato-Regular/Lato-Regular.woff
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b7c2309c6e08de495b618ca1d7325a767ce1f1921447efad9eb29fb42824d611

Request headers

Sec-Fetch-Mode
cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Origin
https://securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
last-modified
Mon, 16 May 2016 10:39:41 GMT
server
Apache
status
200
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
content-length
38240
expires
Wed, 02 Oct 2019 13:43:59 GMT
bullet16.woff
contextual.media.net/__media__/fonts/bullet16/ Frame D97F
2 KB
2 KB
Font
General
Full URL
https://contextual.media.net/__media__/fonts/bullet16/bullet16.woff
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
6c567f5f0ea4a8f2b5ef941a4b6b4d4d616e8198a96b6fab88df74a5bc3b5dce

Request headers

Sec-Fetch-Mode
cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Origin
https://securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
last-modified
Mon, 16 May 2016 10:39:41 GMT
server
Apache
status
200
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
content-length
2000
expires
Wed, 02 Oct 2019 13:43:59 GMT
jot.html
platform.twitter.com/ Frame D5FA
Redirect Chain
  • https://syndication.twitter.com/i/jot
  • https://platform.twitter.com/jot.html
0
0
Document
General
Full URL
https://platform.twitter.com/jot.html
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40DD) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
Origin
https://securityaffairs.co
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Tue, 01 Oct 2019 13:43:59 GMT
Etag
"d9592a6c704736fa4da218d4357976dd"
Last-Modified
Mon, 09 Sep 2019 22:21:05 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (fcn/40DD)
X-Cache
HIT
Content-Length
80

Redirect headers

status
302 302 Found
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-length
0
content-type
text/html;charset=utf-8
date
Tue, 01 Oct 2019 13:43:59 GMT
expires
Tue, 31 Mar 1981 05:00:00 GMT
last-modified
Tue, 01 Oct 2019 13:43:59 GMT
location
https://platform.twitter.com/jot.html
pragma
no-cache
server
tsa_o
strict-transport-security
max-age=631138519
x-connection-hash
fe7d7b22790b42bc6a7e8f512afe4b6d
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-response-time
117
x-transaction
003388570014bb6d
x-tsa-request-body-time
1
x-twitter-response-tags
BouncerCompliant
x-xss-protection
0
OpenSans-Regular.woff
contextual.media.net/__media__/fonts/OpenSans-Regular/ Frame 67CC
66 KB
66 KB
Font
General
Full URL
https://contextual.media.net/__media__/fonts/OpenSans-Regular/OpenSans-Regular.woff
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/__media__/js/util/nrrV2325.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
5256d55a499ecb71f04dd716cfdf75bf9fe5f863620ec6634e3b43b4e6b11fd8

Request headers

Sec-Fetch-Mode
cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Origin
https://securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
last-modified
Mon, 16 May 2016 10:39:41 GMT
server
Apache
status
200
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
content-length
67528
expires
Wed, 02 Oct 2019 13:43:59 GMT
truncated
/ Frame 0C3C
211 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5ca3c1682657fb5ee83738de7e62e1c8d6d851c793b96828cfe8f02eb9697d45

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
nrrV2325.js
contextual.media.net/__media__/js/util/ Frame CC4B
64 KB
22 KB
Script
General
Full URL
https://contextual.media.net/__media__/js/util/nrrV2325.js
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
5043660f05ed1feb3879441fbb19c13705ddb2f44d732da7e08e3c75fed51932

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
max-age=2592000
date
Tue, 01 Oct 2019 13:43:59 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
x-mnet-h
8-12
content-type
text/javascript; charset=utf-8
status
200
cache-control
max-age=1209600
content-length
21812
expires
Tue, 15 Oct 2019 13:43:59 GMT
10124_505bb4db55aaa1165fa3b242bf39701b.png
contextual.media.net/__media__/images/800000006/ Frame CC4B
4 KB
4 KB
Image
General
Full URL
https://contextual.media.net/__media__/images/800000006/10124_505bb4db55aaa1165fa3b242bf39701b.png
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
last-modified
Tue, 03 Oct 2017 12:52:51 GMT
server
Apache
content-type
image/png
status
200
cache-control
max-age=933979
accept-ranges
bytes
content-length
4097
expires
Sat, 12 Oct 2019 09:10:18 GMT
bullet8.woff
contextual.media.net/__media__/fonts/bullet8/ Frame CC4B
2 KB
2 KB
Font
General
Full URL
https://contextual.media.net/__media__/fonts/bullet8/bullet8.woff
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
53270b71935310d01091c385fb610d324d59e3cb15354e98762445f658cb64bb

Request headers

Sec-Fetch-Mode
cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Origin
https://securityaffairs.co
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 01 Oct 2019 13:43:59 GMT
last-modified
Mon, 16 May 2016 10:39:41 GMT
server
Apache
status
200
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
content-length
1708
expires
Wed, 02 Oct 2019 13:43:59 GMT
log
hblg.media.net/
35 B
185 B
Image
General
Full URL
https://hblg.media.net/log?logid=awlog&pid=8PREB0781&itype=HB-CM&dn=securityaffairs.co&cid=8HB41O6BH&svr=2019100108_689&servname=c8-web-3&gdpr=1&csex=2&csstr=&ugd=4&adt=desktop&vid=00001569937438915014956871684771&vsid=&sd=1&gtd=400&inid=0&gfd=&cc=NL&sc=&ct=AMSTERDAM&abte=CONTROL&adbd=0&amp=0&version=1&sB=true&cors=true&disB=false&ice=0&vw=1585&vh=1200&pht=5185&cl=&__rk=0&app=0&rtype=&pvid=4&prvAccId=639665355&prvApiId=8CU5BD6EW&exid=31&pcId=0000EEA&mowxReqId=682611849092848341569937438586&crid=555212031&g=0&size=300x600&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=1&rtime=77&dtc=nydc&rtbsv2=&apid=1&wsip=c10-mowx-web-34&ltime=364&abs=0&ssregion=&ssreqid=&sssvnm=&bdp=0.09&cbdp=0.09&dcbdp=0&ckfl=0&cs=&mnet_ckfl=0&cat=&attr=&advId=&advNm=&advUrl=unknown&dfpBd=0.09&nms=1&di=&dt=O&epc=639665355&ogbdp=0.09&s=1&snm=success&dbf=1&bdata=iurl_l%3D40%7C%7Cogerpm%3D0.05%7C%7Cvis_sd%3D2019093019%7C%7Cxgboost_l%3D0%7C%7Cscd%3Dzh%7C%7Cvl2r_sd%3D2019100103%7C%7Ciurl_b%3D1560.65%7C%7Cxgb_sd%3D2019092800%7C%7Clast%3D0%7C%7Cdevice_b%3D0.76%7C%7Cvl2r_if_sd%3D2019092923%7C%7Cfbb%3D0%7C%7Cxgb_nt%3D101%7C%7Crc%3D1%7C%7Crps_sd%3D2019100100%7C%7Cvis_b%3D314.01%7C%7Curl_b%3D0.06%7C%7Curl_l%3D50%7C%7Cxgb_b%3D0%7C%7Cvis_l%3D20%7C%7Cgcat%3D500436%7C%7Cbb%3D196%7C%7Cvv%3D0%7C%7Cl2r_b%3D1000%7C%7Cvl2r_l%3D-1%7C%7Cerpm%3D0.05%7C%7Csd%3D1%7C%7Cl2r_l%3D-1%7C%7Cbtd%3D1116692160512%7C%7Cuim%3D529%7C%7Crps_l%3D-1%7C%7Cdevice_l%3D0%7C%7Css%3D1600x1200%7C%7Cuiw%3D12%7C%7Crps_b%3D162.04%7C%7CCI%3D1604%7C%7Ctb%3D-1%7C%7Cct%3Dnaaldwijk%7C%7Cbasis2%3D196%7C%7Cbasis1%3D196%7C%7CisRef%3D0%7C%7Cisif%3D0%7C%7Clc%3D0%7C%7Cxgboost_b%3D0%7C%7Cbid%3D0.09%7C%7Cdc%3D7%7C%7Cvl2r_b%3D204.29%7C%7Cogbid%3D0.09%7C%7Ccbdp%3D0.09%7C%7Cbflag%3D0%7C%7Cdmm%3D&cmpid=&bId=&pcrid=8CU5BD6EW-639665355-40-2&ruct=0&brs=&brr=&iurl=https%3A%2F%2Fiurl-a.akamaihd.net%2Fybntag%3F%26cid%3D8CU5BD6EW%26crid%3D639665355%26size%3D300x600%26requrl%3Dhttps%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F91759%252Fhacking%252Fvbulletin-exploit-botnet.html&htps=0&ptype=27&pbidflr=0.00&exp=sfl%3Dfalse%7Cbfl%3D-100%7Crc%3D1%7Chr_ck%3Dtrue%7Cfl_rl%3D1%7Cdbr%3D1%7Ctkd%3Dnull&bfs=0&seat=&nbr=0&ba=434&ybnca_gbid=&ybnca_erpm=0.05&ybnca_vbid=0.05&yogbdp=0.09&yErpmFlag=0&smsrc=1&strg=&ybnca_bbid=-1.0&prvReqId=7260448072808570_1686537957_55521203141&dStat=0&ogbid=0.09&acid=257419550668695101569937438586&act=headerBid&dtfdl=&dspltime=&ttfd=&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=0&adj0=0&adj1=0&adj2=0&adj3=0&patkey=&patint%3C%3E=&spSource=0&spIvt=3&spId=&spFst=0&spIsReq=3&spTo=3&top=0&btm=0&lft=0&rght=0&mx_PC=0&mx_SPRIG=&mx_UCC=&mx_GCID=&mx_IAB2=&mx_SC=0&mx_dgf=0&mx_bsBucket=0&mx_bsProfile=0&mx_sbp=-10&mx_aurt=0&actltime=366&brf=0&dcs=&dfpDiv=&dfpPos=&dfpAdPath=&lper=1&td=r%3Dstr%7Cab%3D0%7C&oyaf=0&sbdrid=426&ra_sz=300x600&sc_pvid=&sc_ogbdp=0&sc_adj0=0&sc_adj1=0&sc_adj2=0&sc_prspt=&sc_act=&sc_bdata=&sc_bdp=0&sc_cbdp=0&sc_bId=&sc_cat=&sc_cmpid=&sc_advId=&sc_advNm=&sc_advUrl=&udc=&rti=-1&rme=ADPTR&bbdrid=&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&kwrf=&epurl=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache Tomcat /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:59 GMT
server
Apache Tomcat
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Tue, 01 Oct 2019 13:43:59 GMT
bql.php
lg3.media.net/ Frame D97F
15 B
204 B
Script
General
Full URL
https://lg3.media.net/bql.php?v=1&gdpr=1&hvsid=00001569937438579014956871685242&geo=52.35|4.92&lper=100&bdrid=4&subBdr=426&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYNEO3V26ZGEJEhQcuHceBo0lykHlHqZQoisUb8TlqhRmWxOXJiAy-ouNPGqI9crRuH10A42DgzMJ&lpid=&tsid=1&ksu=207&q=&prv=&type=&ps=&cme=fl3c56yKPIJiipo0RmKtPfkzMpHlVY1HVT6YgP1sq98XZ8wfpCJohT8ReklRZeZvbY3mIUHY7qmXN9DWBp8km8Cz2AS9nIY2FHgo5zF7UkNlAIpzvGDGIvhyONhjKAd0mEa1ouy-Crt-aGgegh0hkI52n7RsBvWSV79qzdFpPMd4mN1dyKXCaiDm7AbQN0l49sLZkK4VVfBHJh4LmL2k4_QZCIC8Jv6VRsmifgcr74g%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7Cq-6hGTGi_Gb8qnAezGKJeWNa85AapA8Th5FcMSeR34__Dyh8hafgsrGTmOlO-kzWx3Z5GgLYC9lf3kI5GK-yU5y237AMkDVPU68KaQ3qCjY%3D%7CsRBSg3CPSiQ%3D%7CeyOPkfgOPIgWm4rZHgtk76s0sCqPRbqckC1VUTmBVB6XBzcDKV9RMnYEauhbxXpthqrc_rvujVH6Lzqdim0lwX8dEXl7LMCqbPMnO97HxO8PgY00JA6lGx6XM0m1qSSkIyfckBQjc-LqnLgs1Cu-KkyfEivaKIOvNZMjDVR0AZBmIzuc5z9VF6lPxTarURC2Ev7G2nwWBxY0nDD8CvMxSg%3D%3D%7C&hint=&td=&cc=NL&wsip=2886957330&bca=0&ugd=4&&rc=0&vgd_aid=136861136045447781569937438580&fdkt=244&kwd[]=Mobile%20Phone%20Tracking&kwt[]=244&kbc[]=1203023066&kwp[]=1&kid[]=19457822&kbc2[]=ir%3D1%7C%7Ciid%3D1959073%7C%7Cps%3D0.791%7C%7Crpc%3D0.06%7C%7Clvl%3D1.00&ktd[]=278938124544&kwd[]=How%20to%20File%20for%20Disability&kwt[]=438&kbc[]=500985&kwp[]=2&kid[]=14346692&kbc2[]=ir%3D1%7C%7Ciid%3D939215%7C%7Cps%3D0.842%7C%7Crpc%3D0.47%7C%7Clvl%3D1.00&ktd[]=278401253632&kwd[]=Track%20Cell%20Phone%20Location&kwt[]=244&kbc[]=1203023066&kwp[]=3&kid[]=172728028&kbc2[]=ir%3D1%7C%7Ciid%3D440387%7C%7Cps%3D0.791%7C%7Crpc%3D0.06%7C%7Clvl%3D1.29&ktd[]=275716899072&kwd[]=Free%20Cell%20Phone%20Tracking&kwt[]=244&kbc[]=1203023066&kwp[]=4&kid[]=11531083&kbc2[]=ir%3D1%7C%7Ciid%3D2135473%7C%7Cps%3D0.791%7C%7Crpc%3D0.08%7C%7Clvl%3D1.00&ktd[]=277059076352&kwd[]=Best%20Investment%20Plans&kwt[]=244&kbc[]=1203023066&kwp[]=5&kid[]=3473948&kbc2[]=ir%3D1%7C%7Ciid%3D499317%7C%7Cps%3D0.791%7C%7Crpc%3D0.83%7C%7Clvl%3D1.00&ktd[]=275716964608&rand=1569937439360&cid=8CU5BD6EW&vwid=1569937438851172487&vi=1569937438851172487&l3ch=0&slnkp=no&bdrct=0.21&vgd_rt=260&bto=0&tdAdd[]=rtbsd%3D10&tdAdd[]=ib=0&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&sttm=1569937438579&upk=1569937439.28312&hvsid=00001569937438579014956871685242&verid=3121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D49981&vgd_hbReqId=T1569925803C8S21U93&vgd_isiolc=1&npgv=1&rtbsd=10&matchstring=&dytm=1569937438911&matm=1569937439373&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D49981&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l2ch=0&vgd_l1ch=1&vgd_katid=801344920&vgd_katbid=-21&vgd_kals=ttype%3D10002%7C%7Cpc%3D58&vgd_kalog=MPTD%3D192%7C%7CCI%3D1604%7C%7CHID%3D1%7C%7CSI%3D1604%7C%7CUUID%3DpMcdQygNyOXwIJn2r%7C%7CMI%3D1604%7C%7CTPTD%3D549806314372%7C%7CSID%3D12&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_sbSup=1&vgd_l2wsip=2886935974&vgd_nrrv=2325&vgd_nrrs=2325&vgd_optout=0&vgd_x_pos=973&vgd_y_pos=413&vgd_ren_page_h=5185&vgde_bdata=8xLjMjvH9%7C%7CmyJLEYv9.uu%7C%7Ce8QMQOvf9ui9iA9ui%7C%7C-yGmmQ7Mjv9%7C%7CQNOvlw%7C%7CejfLMQOvf9uiu99u9A%7C%7C8xLjMGvXWuX.iW%7C%7C-yGMQOvf9ui9ifW99%7C%7Cj1Q7v9%7C%7COJe8NJMGv9.hF%7C%7CejfLM8kMQOvf9ui9ififA%7C%7CkGGv9%7C%7C-yGMz7vu9u%7C%7CLNvu%7C%7CLEQMQOvf9uiu99u99%7C%7Ce8QMGvAuH.9u%7C%7CxLjMGv9.fA%7C%7CxLjMjvf9%7C%7C-yGMGv9%7C%7Ce8QMjvf9%7C%7CyN17vX99HAF%7C%7CGGvuiF%7C%7Ceev9%7C%7CjfLMGvu999%7C%7CejfLMjvou%7C%7CJLEYv9.uu%7C%7CQOvu%7C%7CjfLMjvou%7C%7CG7OvuuuFFifuF9Xuf%7C%7Cx8Yvu%7C%7CLEQMjvou%7C%7COJe8NJMjv9%7C%7CQQvuF99-uf99%7C%7Cx8Bv9%7C%7CLEQMGvuFf.9H%7C%7C%3DVvuF9H%7C%7C7Gvou%7C%7CN7vz11jOB8dU%7C%7CG1Q8QfvuiF%7C%7CG1Q8QuvuiF%7C%7C8QDJkv9%7C%7C8Q8kv9%7C%7CjNv9%7C%7C-yGmmQ7MGv9%7C%7CG8Ov9.fu%7C%7CONvh%7C%7CejfLMGvf9H.fi%7C%7CmyG8Ov9.fu%7C%7CNGOEv9.fu%7C%7CGkj1yv9%7C%7COYYv&vgd_is_amp=0&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&oRurl=http%3A%2F%2Fcdn3nc%2Fmediamain.html%3F%26esi%3D1%26%26cid%3D8CU5BD6EW%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253D%253D%26crid%3D184323154%26pid%3D8PO5M70HK%26size%3D300x250%26cpnet%3DyVb1sHm-0KIh29BOFTjjrHvHwrQGlpByWaOO1vn303s%253D%26cme%3DddF3tVt6Jgwc0vmFKxq3sxZQnh0iZwpa5KhKGcDHJFxEgLz35A0naNpam52fKJe_u9tIkCm3_lVs8UO_TWiOPSCbQBfwxs5LQx8hOuBd8dcPClRiQGYMWhkgJLSjI5BzpX_yLx7ECLkDeliuUBQP2w%253D%253D%257C%257CNDHRnZ9Gz3KXlI-i9OnZqQ%253D%253D%257C5gDUJdTGiJzedmq9hanWYg%253D%253D%257CN7fu2vKt8_s%253D%257Cq-6hGTGi_Gb8qnAezGKJeWNa85AapA8Th5FcMSeR34__Dyh8hafgsrGTmOlO-kzWx3Z5GgLYC9lf3kI5GK-yU5y237AMkDVPU68KaQ3qCjY%253D%257CsRBSg3CPSiQ%253D%257C%26https%3D1%26cc%3DNL%26bf%3D0%26staticIframe%3D1%26vif%3D1%26nse%3D3%26vi%3D1569937438851172487%26lw%3D1%26ugd%3D4%26ib%3D0%26katid%3D801344920%26katbid%3D-21%26katen%3D1%26nb%3D1%26chost%3Dcontextual.media.net%26fvips%3D0%26vpf%3D000%26ap%3D0%26pf%3D0%26isOffice%3D0&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A5&vgd_end=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/__media__/js/util/nrrV2325.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:59 GMT
server
Apache
status
200
ntcoent-length
15
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
15
expires
Tue, 01 Oct 2019 13:43:59 GMT
log
navvy.media.net/ Frame D97F
807 B
997 B
Other
General
Full URL
https://navvy.media.net/log
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/__media__/js/util/nrrV2325.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.121.29 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-121-29.us-west-1.compute.amazonaws.com
Software
Jetty(9.4.7.v20170914) /
Resource Hash
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:59 GMT
server
Jetty(9.4.7.v20170914)
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache,no-store
content-length
807
expires
Tue, 01 Oct 2019 13:43:59 GMT
bql.php
lg3.media.net/ Frame 67CC
15 B
204 B
Script
General
Full URL
https://lg3.media.net/bql.php?v=1&gdpr=1&hvsid=00001569937438551014956871685537&geo=52.35|4.92&lper=100&bdrid=4&subBdr=454&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYNEO3V26ZGEJEhQcuHceBo0lykHlHqZQoisUb8TlqhRmWxOXJiAy-osvtqnFQMztOTk4eMReUfT8&lpid=&tsid=1&ksu=207&q=&prv=&type=&ps=&cme=fl3c56yKPILbXc6mKiM984ZNCLAWM3rC3bZjcUnOtCzndJo-vsPEwyIqZRvnJKSjscGidjQ9PefWEhNFIh5T8W76I2As4Ql3jK4wmyKg3anDksgPd6kmyQm61j1LXYa0YLE80VIO7djLQfrswVHDPl7a1L_kHzeodc5xMcaDGYSf9Uo-KMajYqkRaWQuFX_AbmCMPGfdP2X-h2HG51MxJVMWJG-m5L_sI2BiE-MQpno%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7Cq-6hGTGi_Gb8qnAezGKJeWNa85AapA8Th5FcMSeR34__Dyh8hafgsrGTmOlO-kzWx3Z5GgLYC9lf3kI5GK-yU5y237AMkDVPU68KaQ3qCjY%3D%7CsRBSg3CPSiQ%3D%7CjwS4uQrBFEBTblGPDrVZXRLBbu99pYJcwnajZVrFzwm6s_EzFlNkLYQTajej4-CGjFKzOLkw0hDestg7gDEgP7nB88yYEl1G1momikRHqZdNawamiuuNODqf1FrrmCkzh7lp5TISBo6mP4X0FR3Oydul7yf7ny0M-F-t_nBvn6PbYAqIB61Hrqvscyz91C57RVeiWKyXq_sXSbpHsQ10Og%3D%3D%7C&hint=&td=&cc=NL&wsip=2886936505&bca=0&ugd=4&&rc=0&vgd_aid=366235628083163391569937438564&fdkt=244&kwd[]=Mobile%20Phone%20Tracking&kwt[]=244&kbc[]=1203023066&kwp[]=1&kid[]=19457822&kbc2[]=ir%3D1%7C%7Ciid%3D313974%7C%7Cps%3D0.791%7C%7Crpc%3D0.06%7C%7Clvl%3D1.00&ktd[]=277327511808&kwd[]=How%20to%20File%20for%20Disability&kwt[]=438&kbc[]=500985&kwp[]=2&kid[]=14346692&kbc2[]=ir%3D1%7C%7Ciid%3D939215%7C%7Cps%3D0.842%7C%7Crpc%3D0.47%7C%7Clvl%3D1.00&ktd[]=278401253632&kwd[]=Track%20Cell%20Phone%20Location&kwt[]=244&kbc[]=1203023066&kwp[]=3&kid[]=172728028&kbc2[]=ir%3D1%7C%7Ciid%3D436823%7C%7Cps%3D0.791%7C%7Crpc%3D0.06%7C%7Clvl%3D1.29&ktd[]=278938124544&kwd[]=Free%20Cell%20Phone%20Tracking&kwt[]=244&kbc[]=1203023066&kwp[]=4&kid[]=11531083&kbc2[]=ir%3D1%7C%7Ciid%3D3220630%7C%7Cps%3D0.791%7C%7Crpc%3D0.08%7C%7Clvl%3D1.00&ktd[]=275716899072&kwd[]=Best%20Investment%20Plans&kwt[]=244&kbc[]=1203023066&kwp[]=5&kid[]=3473948&kbc2[]=ir%3D1%7C%7Ciid%3D499317%7C%7Cps%3D0.791%7C%7Crpc%3D0.83%7C%7Clvl%3D1.00&ktd[]=275716964608&rand=1569937439325&cid=8CU5BD6EW&vwid=1569937438796240605&vi=1569937438796240605&l3ch=0&slnkp=no&bdrct=0.78&vgd_rt=225&bto=0&tdAdd[]=rtbsd%3D10&tdAdd[]=ib=0&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&axbx=bl5&vgd_refimp=0&sttm=1569937438551&upk=1569937439.28312&hvsid=00001569937438551014956871685537&verid=3121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D49981&vgd_hbReqId=T1569925803C8S21U93&vgd_isiolc=1&rtbsd=10&matchstring=&dytm=1569937438874&matm=1569937439334&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D49981&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l2ch=0&vgd_l1ch=1&vgd_katid=801338199&vgd_katbid=-21&vgd_kals=ttype%3D10002%7C%7Cpc%3D69&vgd_kalog=SI%3D1604%7C%7CSID%3D12%7C%7CHID%3D8%7C%7CTPTD%3D549797892740%7C%7CMPTD%3D192%7C%7CMI%3D1604%7C%7CCI%3D1604%7C%7CUUID%3D49LYcJUtCcGZKgr0BW&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_refcnf=%7B%22a2y%22%3A%7B%22afterLoadSecs%22%3A30%2C%22afterViewSecs%22%3A10%2C%22percentTraffic%22%3A95%2C%22ignoreSessionDisable%22%3Atrue%2C%22both%22%3Afalse%7D%7D&vgd_dfp_tgt=%7B%22crid%22%3A%22762221962%22%2C%22mnet_segment%22%3A%220.78%22%2C%22mnet_variant%22%3A%22454%22%2C%22pub_domain%22%3A%22securityaffairs.co%22%2C%22mnet_cc%22%3A%22NL%22%2C%22mnet_bucketid%22%3A%22b3%22%2C%22mnet_ref_ybn%22%3A1%2C%22PubMaticSS%22%3A%221610%22%2C%22RubiconSS%22%3A%222209%22%7D&vgd_sbSup=1&vgd_l2wsip=2886946207&vgd_nrrv=2325&vgd_nrrs=2325&vgd_optout=0&vgd_x_pos=320&vgd_y_pos=3334&vgd_ren_page_h=5185&vgde_bdata=8xLjMjvH9%7C%7CmyJLEYv9.9u%7C%7Ce8QMQOvf9ui9iA9ui%7C%7C-yGmmQ7Mjv9%7C%7CQNOvlw%7C%7CejfLMQOvf9uiu99u9A%7C%7C8xLjMGvfii.Hu%7C%7C-yGMQOvf9ui9ifW99%7C%7Cj1Q7v9%7C%7COJe8NJMGv9.hF%7C%7CejfLM8kMQOvf9ui9ififA%7C%7CkGGv9%7C%7C-yGMz7vu9u%7C%7CLNvu%7C%7CLEQMQOvf9uiu99u99%7C%7Ce8QMGvAuH.9u%7C%7CxLjMGv9.9F%7C%7CxLjMjvX9%7C%7C-yGMGv9%7C%7Ce8QMjvf9%7C%7CyN17vX99HAF%7C%7CGGvu99%7C%7Ceev9%7C%7CjfLMGvu999%7C%7CejfLMjvou%7C%7CJLEYv9.9u%7C%7CQOvu%7C%7CjfLMjvou%7C%7CG7OvuuuFh99XHiuf9%7C%7Cx8YvfihX%7C%7CLEQMjvou%7C%7COJe8NJMjv9%7C%7CQQvuF99-uf99%7C%7Cx8BvfH%7C%7CLEQMGvuFf.9H%7C%7C%3DVvuF9H%7C%7C7Gvou%7C%7CN7vz11jOB8dU%7C%7CG1Q8QfvuiF%7C%7CG1Q8QuvuiF%7C%7C8QDJkv9%7C%7C8Q8kv9%7C%7CjNv9%7C%7C-yGmmQ7MGv9%7C%7CG8Ov9.hW%7C%7CONvh%7C%7CejfLMGvf9H.fi%7C%7CmyG8Ov9.hW%7C%7CNGOEv9.hW%7C%7CGkj1yv9%7C%7COYYv&vgd_is_amp=0&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&oRurl=http%3A%2F%2Fcdn3nc%2Fmediamain.html%3F%26esi%3D1%26%26cid%3D8CU5BD6EW%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253D%253D%26crid%3D762221962%26pid%3D8PO5M70HK%26size%3D300x250%26cpnet%3DyVb1sHm-0KIh29BOFTjjrEBbIZGw_v2fXpyZXRW3WVE%253D%26cme%3Dhmi3FHRUKMmzKimfb0JIDAbp_fyjVK7depiARrivsoxRj_hLfG7Sh7pIMMFBEH3GQmWMN5-SfqQXYweHSH8KKnPGVgvGQ_aPSf0OGKC6cBSpFVbTXU3f6_1duVJnBmigo-643UevFDALT110G-ESfQ%253D%253D%257C%257CNDHRnZ9Gz3KXlI-i9OnZqQ%253D%253D%257C5gDUJdTGiJzedmq9hanWYg%253D%253D%257CN7fu2vKt8_s%253D%257Cq-6hGTGi_Gb8qnAezGKJeWNa85AapA8Th5FcMSeR34__Dyh8hafgsrGTmOlO-kzWx3Z5GgLYC9lf3kI5GK-yU5y237AMkDVPU68KaQ3qCjY%253D%257CsRBSg3CPSiQ%253D%257C%26https%3D1%26cc%3DNL%26bf%3D0%26staticIframe%3D1%26vif%3D1%26nse%3D3%26vi%3D1569937438796240605%26lw%3D1%26ugd%3D4%26ib%3D0%26katid%3D801338199%26katbid%3D-21%26katen%3D1%26nb%3D1%26chost%3Dcontextual.media.net%26fvips%3D0%26vpf%3D000%26ap%3D0%26pf%3D0%26isOffice%3D0&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A5&vgd_end=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/__media__/js/util/nrrV2325.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:59 GMT
server
Apache
status
200
ntcoent-length
15
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
15
expires
Tue, 01 Oct 2019 13:43:59 GMT
log
navvy.media.net/ Frame 67CC
807 B
997 B
Other
General
Full URL
https://navvy.media.net/log
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/__media__/js/util/nrrV2325.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.121.29 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-121-29.us-west-1.compute.amazonaws.com
Software
Jetty(9.4.7.v20170914) /
Resource Hash
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:59 GMT
server
Jetty(9.4.7.v20170914)
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache,no-store
content-length
807
expires
Tue, 01 Oct 2019 13:43:59 GMT
bql.php
lg3.media.net/ Frame CC4B
15 B
204 B
Script
General
Full URL
https://lg3.media.net/bql.php?v=1&gdpr=1&hvsid=00001569937438585014956871685152&geo=52.35|4.92&lper=100&bdrid=4&subBdr=426&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYNEO3V26ZGEJEhQcuHceBo0lykHlHqZQoisUb8TlqhRmWxOXJiAy-ovvCO10unqq_12j3mXAkclb&lpid=&tsid=18&ksu=207&q=&prv=&type=&ps=&cme=bZfsoLTPqPzkzEJvQDWXIomYL-C9z_Jdbp27SlQ52eaB8vrF0A99wUUT7Pf-rw3Y-5ctDkPFouIufxHcLdNDKVB-8szleg_jU3ZcTQZalUmu9h0kAE7SaqwczDkP6MZZtXjvrASJv5eQrjsVv9TQwD3cL1ictOdgYQU8UFBBNnz7kvL45Bu_HCC7WGloDqOBVOIN1iluNzG9uyQI-28_NnIhi1yuYVJUWpYgkfb7N9g%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7Cq-6hGTGi_Gb8qnAezGKJeWNa85AapA8Th5FcMSeR34__Dyh8hafgsrGTmOlO-kzWx3Z5GgLYC9lf3kI5GK-yU5y237AMkDVPU68KaQ3qCjY%3D%7CsRBSg3CPSiQ%3D%7C7gUR5MVisQteGzC-n4KuVBtfmqoqe3li_qEBrYuhZ6knCcDi2l6Xth_btHyswp7QFyrdKab3x_B3MQbKEQT6sxSH0O0M1Ptd5aHgTEwkDDh8xA6MEdPs1DrIy7X3rUonxK8mu29gMhT-xJuVo-UJb-5d4m7MPO18vO8IYBGkhrR91g-nB159eWzh81Ex0c0n-xH3jmHUF9c%3D%7C&hint=&td=&cc=NL&wsip=2886935974&bca=0&ugd=4&&rc=0&vgd_aid=257419550668695101569937438586&fdkt=244&kwd[]=Mobile%20Phone%20Tracking&kwt[]=244&kbc[]=1203023066&kwp[]=1&kid[]=19457822&kbc2[]=ir%3D1%7C%7Ciid%3D436887%7C%7Cps%3D0.791%7C%7Crpc%3D0.06%7C%7Clvl%3D1.00&ktd[]=278401454336&kwd[]=Best%20Investment%20Plans&kwt[]=244&kbc[]=1203023066&kwp[]=2&kid[]=3473948&kbc2[]=ir%3D1%7C%7Ciid%3D1363540%7C%7Cps%3D0.791%7C%7Crpc%3D0.83%7C%7Clvl%3D1.00&ktd[]=278938325248&kwd[]=Free%20Cell%20Phone%20Tracking&kwt[]=244&kbc[]=1203023066&kwp[]=3&kid[]=11531083&kbc2[]=ir%3D1%7C%7Ciid%3D436823%7C%7Cps%3D0.791%7C%7Crpc%3D0.08%7C%7Clvl%3D1.00&ktd[]=278133018880&kwd[]=Track%20Cell%20Phone%20Location&kwt[]=244&kbc[]=1203023066&kwp[]=4&kid[]=172728028&kbc2[]=ir%3D2%7C%7Ciid%3D440387%7C%7Cps%3D0.791%7C%7Crpc%3D0.06%7C%7Clvl%3D1.29&ktd[]=275717099776&kwd[]=Reverse%20Cell%20Phone%20Lookup&kwt[]=240&kbc[]=b929ad6d4b2dae39694d8837c0866b17.d2s&kwp[]=5&kid[]=24403798&kbc2[]=101%7C%7Cir%3D1%7C%7Ciid%3D148061%7C%7Cps%3D0.065%7C%7Crpc%3D0.07%7C%7Clvl%3D1.00&ktd[]=277327773952&kwd[]=Life%20Lock%20Security&kwt[]=240&kbc[]=b929ad6d4b2dae39694d8837c0866b17.d2s&kwp[]=6&kid[]=17469589&kbc2[]=101%7C%7Cir%3D1%7C%7Ciid%3D8781590%7C%7Cps%3D0.065%7C%7Crpc%3D0.01%7C%7Clvl%3D1.00&ktd[]=277042561280&kwd[]=Track%20a%20Cell%20Phone&kwt[]=240&kbc[]=b929ad6d4b2dae39694d8837c0866b17.d2s&kwp[]=7&kid[]=28778022&kbc2[]=101%7C%7Cir%3D3%7C%7Ciid%3D436831%7C%7Cps%3D0.065%7C%7Crpc%3D0.08%7C%7Clvl%3D1.38&ktd[]=278401515776&kwd[]=Trace%20Phone%20Number&kwt[]=240&kbc[]=b929ad6d4b2dae39694d8837c0866b17.d2s&kwp[]=8&kid[]=28775317&kbc2[]=101%7C%7Cir%3D1%7C%7Ciid%3D854091%7C%7Cps%3D0.065%7C%7Crpc%3D0.07%7C%7Clvl%3D1.47&ktd[]=277327773952&kwd[]=Online%20Cell%20Phone%20Tracker&kwt[]=240&kbc[]=b929ad6d4b2dae39694d8837c0866b17.d2s&kwp[]=9&kid[]=133442615&kbc2[]=101%7C%7Cir%3D1%7C%7Ciid%3D3053974%7C%7Cps%3D0.065%7C%7Crpc%3D0.03%7C%7Clvl%3D1.00&ktd[]=277327773952&kwd[]=Mobile%20Number%20Tracker&kwt[]=240&kbc[]=b929ad6d4b2dae39694d8837c0866b17.d2s&kwp[]=10&kid[]=124354015&kbc2[]=101%7C%7Cir%3D1%7C%7Ciid%3D1572837%7C%7Cps%3D0.065%7C%7Crpc%3D0.07%7C%7Clvl%3D1.17&ktd[]=278938386688&kwd[]=Phone%20Number%20Search&kwt[]=240&kbc[]=b929ad6d4b2dae39694d8837c0866b17.d2s&kwp[]=11&kid[]=22323535&kbc2[]=101%7C%7Cir%3D1%7C%7Ciid%3D1902070%7C%7Cps%3D0.065%7C%7Crpc%3D0.05%7C%7Clvl%3D1.00&ktd[]=278401515776&kwd[]=How%20to%20File%20for%20Disability&kwt[]=438&kbc[]=500985&kwp[]=12&kid[]=14346692&kbc2[]=ir%3D1%7C%7Ciid%3D4681434%7C%7Cps%3D0.084%7C%7Crpc%3D0.47%7C%7Clvl%3D1.00&ktd[]=275716899072&rand=1569937439418&cid=8CU5BD6EW&vwid=1569937438891765566&vi=1569937438891765566&l3ch=0&slnkp=no&bdrct=0.09&vgd_rt=367&bto=0&tdAdd[]=rtbsd%3D10&tdAdd[]=ib=0&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&axbx=bl5&vgd_refimp=0&sttm=1569937438585&upk=1569937439.28312&hvsid=00001569937438585014956871685152&verid=3121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D49981&vgd_hbReqId=T1569925803C8S21U93&vgd_isiolc=1&npgv=1&rtbsd=10&dytm=1569937438923&matchstring=&matm=1569937439430&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D49981&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l2ch=0&vgd_l1ch=1&vgd_katid=801338173&vgd_katbid=-21&vgd_kals=ttype%3D10002%7C%7Cpc%3D91&vgd_kalog=TPTD%3D549797925764%7C%7CCI%3D1604%7C%7CSID%3D12%7C%7CMI%3D1604%7C%7CMPTD%3D192%7C%7CSI%3D1604%7C%7CHID%3D7%7C%7CUUID%3D49LYcJSyt5Ddyq99ZY&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_refcnf=%7B%22a2y%22%3A%7B%22afterLoadSecs%22%3A30%2C%22afterViewSecs%22%3A10%2C%22percentTraffic%22%3A95%2C%22ignoreSessionDisable%22%3Atrue%2C%22both%22%3Afalse%7D%7D&vgd_dfp_tgt=%7B%22crid%22%3A%22639665355%22%2C%22mnet_segment%22%3A%220.09%22%2C%22mnet_variant%22%3A%22426%22%2C%22pub_domain%22%3A%22securityaffairs.co%22%2C%22mnet_cc%22%3A%22NL%22%2C%22mnet_bucketid%22%3A%22b3%22%2C%22mnet_ref_ybn%22%3A1%2C%22PubMaticSS%22%3A%221610%22%2C%22RubiconSS%22%3A%222209%22%7D&vgd_sbSup=1&vgd_l2wsip=2886940717&vgd_nrrv=2325&vgd_nrrs=2325&vgd_optout=0&vgd_x_pos=973&vgd_y_pos=1639&vgd_ren_page_h=5185&vgde_bdata=8xLjMjvH9%7C%7CmyJLEYv9.9X%7C%7Ce8QMQOvf9ui9iA9ui%7C%7C-yGmmQ7Mjv9%7C%7CQNOvlw%7C%7CejfLMQOvf9uiu99u9A%7C%7C8xLjMGvuXF9.FX%7C%7C-yGMQOvf9ui9ifW99%7C%7Cj1Q7v9%7C%7COJe8NJMGv9.hF%7C%7CejfLM8kMQOvf9ui9ififA%7C%7CkGGv9%7C%7C-yGMz7vu9u%7C%7CLNvu%7C%7CLEQMQOvf9uiu99u99%7C%7Ce8QMGvAuH.9u%7C%7CxLjMGv9.9F%7C%7CxLjMjvX9%7C%7C-yGMGv9%7C%7Ce8QMjvf9%7C%7CyN17vX99HAF%7C%7CGGvuiF%7C%7Ceev9%7C%7CjfLMGvu999%7C%7CejfLMjvou%7C%7CJLEYv9.9X%7C%7CQOvu%7C%7CjfLMjvou%7C%7CG7OvuuuFFifuF9Xuf%7C%7Cx8YvXfi%7C%7CLEQMjvou%7C%7COJe8NJMjv9%7C%7CQQvuF99-uf99%7C%7Cx8Bvuf%7C%7CLEQMGvuFf.9H%7C%7C%3DVvuF9H%7C%7C7Gvou%7C%7CN7vz11jOB8dU%7C%7CG1Q8QfvuiF%7C%7CG1Q8QuvuiF%7C%7C8QDJkv9%7C%7C8Q8kv9%7C%7CjNv9%7C%7C-yGmmQ7MGv9%7C%7CG8Ov9.9i%7C%7CONvh%7C%7CejfLMGvf9H.fi%7C%7CmyG8Ov9.9i%7C%7CNGOEv9.9i%7C%7CGkj1yv9%7C%7COYYv&vgd_is_amp=0&vgd_rensize=300_600&vgd_scr_h=1200&vgd_scr_w=1600&oRurl=http%3A%2F%2Fcdn3nc%2Fmediamain.html%3F%26esi%3D1%26%26cid%3D8CU5BD6EW%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253D%253D%26crid%3D639665355%26pid%3D8PO5M70HK%26size%3D300x600%26cpnet%3DyVb1sHm-0KIh29BOFTjjrOMbY3Wy7OSYfNFL7sC0vVY%253D%26cme%3Dhmi3FHRUKMkilTzseEeahYBK0Dc9Iehoc--eJ91ZbJOU32yPMPHcgTcILw-vm_YLN7Vl26zwtvAWFY8-y5nJkY74VltIAgM5qiRWJ1RL1t9F_RjSHP5de0JanKU1hKV6Xa5xAjKNU5clkdmKXRb2-Q%253D%253D%257C%257CNDHRnZ9Gz3KXlI-i9OnZqQ%253D%253D%257C5gDUJdTGiJzedmq9hanWYg%253D%253D%257CN7fu2vKt8_s%253D%257Cq-6hGTGi_Gb8qnAezGKJeWNa85AapA8Th5FcMSeR34__Dyh8hafgsrGTmOlO-kzWx3Z5GgLYC9lf3kI5GK-yU5y237AMkDVPU68KaQ3qCjY%253D%257CsRBSg3CPSiQ%253D%257C%26https%3D1%26cc%3DNL%26bf%3D0%26staticIframe%3D1%26vif%3D1%26nse%3D3%26vi%3D1569937438891765566%26lw%3D1%26ugd%3D4%26ib%3D0%26katid%3D801338173%26katbid%3D-21%26katen%3D1%26nb%3D1%26chost%3Dcontextual.media.net%26fvips%3D0%26vpf%3D000%26ap%3D0%26pf%3D0%26isOffice%3D0&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A600%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A12&vgd_end=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/__media__/js/util/nrrV2325.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:59 GMT
server
Apache
status
200
ntcoent-length
15
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
15
expires
Tue, 01 Oct 2019 13:43:59 GMT
log
navvy.media.net/ Frame CC4B
807 B
997 B
Other
General
Full URL
https://navvy.media.net/log
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/__media__/js/util/nrrV2325.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.121.29 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-121-29.us-west-1.compute.amazonaws.com
Software
Jetty(9.4.7.v20170914) /
Resource Hash
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:59 GMT
server
Jetty(9.4.7.v20170914)
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache,no-store
content-length
807
expires
Tue, 01 Oct 2019 13:43:59 GMT
analytics.js
google-analytics.com/
43 KB
18 KB
Script
General
Full URL
https://google-analytics.com/analytics.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
6526
date
Tue, 01 Oct 2019 11:55:13 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Tue, 01 Oct 2019 13:55:13 GMT
collect
www.google-analytics.com/r/
35 B
111 B
Image
General
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j79&a=801912158&t=pageview&_s=1&dl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&ul=en-us&de=UTF-8&dt=Botnet%20exploits%20recent%20vBulletin%20flaw%20to%20protect%20its%20botsSecurity%20Affairs&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=361904056&gjid=1197981946&cid=1761445857.1569937440&tid=UA-59069958-1&_gid=1745117554.1569937440&_r=1&z=388021313
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:59 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
bqi.php
lg3.media.net/
15 B
15 B
Image
General
Full URL
https://lg3.media.net/bqi.php?lf=3&&gdpr=1&prid=8PRHGG6T9&vi=1569937438851172487&cid=8CU5BD6EW&crid=184323154&ugd=4&cc=NL&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F91759%2Fhacking%2Fvbulletin-exploit-botnet.html&pid=8PO5M70HK&hvsid=00001569937438579014956871685242&bdrid=4&subBdr=426&cme=ddF3tVt6Jgwc0vmFKxq3sxZQnh0iZwpa5KhKGcDHJFxEgLz35A0naNpam52fKJe_u9tIkCm3_lVs8UO_TWiOPSCbQBfwxs5LQx8hOuBd8dcPClRiQGYMWhkgJLSjI5BzpX_yLx7ECLkDeliuUBQP2w%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7Cq-6hGTGi_Gb8qnAezGKJeWNa85AapA8Th5FcMSeR34__Dyh8hafgsrGTmOlO-kzWx3Z5GgLYC9lf3kI5GK-yU5y237AMkDVPU68KaQ3qCjY%3D%7CsRBSg3CPSiQ%3D%7C&abpl=2&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&kalog=MPTD%3D192%7C%7CCI%3D1604%7C%7CHID%3D1%7C%7CSI%3D1604%7C%7CUUID%3DpMcdQygNyOXwIJn2r%7C%7CMI%3D1604%7C%7CTPTD%3D549806314372%7C%7CSID%3D12&kata=aton&kals=ttype%3D10002%7C%7Cpc%3D58&kapc=58&katid=801344920&katbid=-21&l2wsip=2886935974&l2ch=0&dytm=1569937438911&rtbsd=10&npgv=1&vgd_isiolc=1&vgd_hbReqId=T1569925803C8S21U93&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&verid=3121199&upk=1569937439.28312&sttm=1569937438579&l1ch=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://securityaffairs.co/wordpress/91759/hacking/vbulletin-exploit-botnet.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 01 Oct 2019 13:43:59 GMT
server
Apache
ntcoent-length
15
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
status
200
cache-control
max-age=0, no-cache, no-store
content-length
15
expires
Tue, 01 Oct 2019 13:43:59 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Roboto+Condensed%3A400italic%2C700italic%2C400%2C700&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Cgreek%2Ccyrillic%2Clatin-ext%2Cvietnamese&ver=20c1c3d11da1b4e08243d653861d5e28
Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=20c1c3d11da1b4e08243d653861d5e28
Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Playfair+Display%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=20c1c3d11da1b4e08243d653861d5e28
Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=20c1c3d11da1b4e08243d653861d5e28

Verdicts & Comments Add Verdict or Comment

68 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| _wpemojiSettings undefined| $ function| jQuery object| Cli_Data object| log_object object| CLI_Cookie object| CLI string| CLI_ACCEPT_COOKIE_NAME number| CLI_ACCEPT_COOKIE_EXPIRE boolean| CLI_COOKIEBAR_AS_POPUP object| stlib boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus boolean| sop_pview_logged string| stWidgetVersion object| stLight boolean| st_showing object| __stdos__ function| __sharethis__docReady object| __sharethis__ number| cli_flush_cache object| _mNHandle string| medianet_versionId object| FB object| __twttrll object| twttr object| __twttr string| cli_cookiebar_settings object| click_object object| _mN function| setup string| _mN_Idf string| _mN_ctrM number| _mN_ctr object| hbCMBidxc function| _cR function| _cD object| _mNDetails function| _cmL1Require function| _cmL1Define object| _mN_dy object| wpcom_img_zoomer object| detectZoom object| Main object| twemoji object| wp object| BrowserDetect object| jQuery1124021508586288878107 object| mejs function| onYouTubePlayerAPIReady function| onYouTubePlayerReady function| MediaElement function| MediaElementPlayer function| $j function| imagePreview object| _stq function| st_go function| linktracker_init object| wpcom object| google_reactive_ads_global_state string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData

1 Cookies

Domain/Path Name / Value
.securityaffairs.co/ Name: __gads
Value: ID=cf4dc528391e2998:T=1569937438:S=ALNI_MaifWUyuS5v6aPkC-etfOSiF1xv_A

5 Console Messages

Source Level URL
Text
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 23)
Message:
JQMIGRATE: Migrate is installed with logging active, version 1.4.1
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 45)
Message:
JQMIGRATE: jQuery.fn.load() is deprecated
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 47)
Message:
console.trace
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 45)
Message:
JQMIGRATE: jQuery.fn.unload() is deprecated
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 47)
Message:
console.trace

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
buttons-config.sharethis.com
c.sharethis.mgr.consensu.org
cdn.syndication.twimg.com
connect.facebook.net
contextual.media.net
fonts.googleapis.com
google-analytics.com
hblg.media.net
i0.wp.com
i1.wp.com
i2.wp.com
l.sharethis.com
lg3.media.net
maxcdn.bootstrapcdn.com
navvy.media.net
pbs.twimg.com
pixel.wp.com
platform-api.sharethis.com
platform.twitter.com
s0.wp.com
secure.gravatar.com
securepubads.g.doubleclick.net
securityaffairs.co
staticxx.facebook.com
stats.wp.com
syndication.twitter.com
tpc.googlesyndication.com
ws.sharethis.com
www.google-analytics.com
www.googletagservices.com
fonts.googleapis.com
104.244.42.200
172.217.16.194
18.195.80.102
192.0.76.3
192.0.77.2
192.0.77.32
2.18.235.93
2001:4de0:ac19::1:b:2a
2001:8d8:100f:f000::289
2600:9000:2047:ae00:1c:8a07:5e80:93a1
2600:9000:214f:4e00:3:c04e:c780:93a1
2600:9000:214f:8600:c:a9b7:ddc0:93a1
2600:9000:214f:c200:c:abe:f440:93a1
2606:2800:134:1a0d:1429:742:782:b6
2606:2800:234:46c:e8b:1e2f:2bd:694
2606:2800:234:59:254c:406:2366:268c
2a00:1450:4001:809::2001
2a00:1450:4001:809::2002
2a00:1450:4001:814::2002
2a00:1450:4001:815::200e
2a00:1450:4001:818::2004
2a03:2880:f02d:12:face:b00c:0:3
2a04:fa87:fffe::c000:4902
52.8.121.29
00a4c9aeb6f61ae7f260eea51d5d19a651544c01d202363463375992ef021960
00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286
00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584
0318d45b1e27a4c9d626763e1fc386b84d3347ba439d1efc624b7e84507caae6
0341a4478ce861ef85c819b913fa0a2501836a6a2ffda8643e95e39f4a2a7de0
03f9ce0e3b5c1796a72138abcec8469fce16791a19ae2e50263ffabd771b3f5d
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60
0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878
0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
133f926dc875cb0014b8d2e2f65e6e9aaa2a6711e98c3d0b288b68e073c4fa7c
13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742
1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea
185c9e2bc69d60f16dd75642555ec30aca7ed11607d624abff383b8c3ccbdbb1
18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19
1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f
2137b85fb02da63ebddb0df947618705e590cac29d7dd5e268337e92ebf6751e
2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3
2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732
2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f
2cbb8dfc4483c9ce680df342866531ac656e8bed029dcd37a1872327023da5f8
2f64b025cec8c93dcb01fe88f0e79c134bc0a6c751787360153865dfa9f3a962
31dd9b4f7ea697c2d0640510fbce7a4136209a712ae6f90a70574e948c169a08
3253c0f033164f38e0cc32f41cc71eb02c263c92bc54738ffc32a077c8c5801c
338e5578a7b3021caec1db415b93b214c378029d3cd8d19adc833d8b85ea7d29
33bab23e69957f20e39d83d1ccf32d6846b86b5d993744acf278aaac2b411852
35aefd2d1de0b25d9a5640cf3129dfc507a3c417a7da34f4bb6f9b4a79e19484
35c073a53df4dd054afab9758b90a88846802754ff15fc3b31cc9af133c8a401
3afe47d0fe0b16bc5bddecdc9bcaca94ed420b8fd0ddee2ae77364403c794bb8
41ae41dbf79250f10738fe6d7b3af43d5b83520b9b0f659f763fde04d8658371
4468e35646c229b518e5f398c5a3d6b15ba1351a71ef22692129bb32f5030ac0
45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6
45491009ecacd44a68ce929f718ec44a30d50b204a1c0302871ea801a2410171
47374c98881c854f070492cb2170394e9983559b7dc2cb63c93961f693b674d9
4fd1acd345a275a4bac18996c4de2352999db69b6a14a24bdda89af0e7c4ce3a
5043660f05ed1feb3879441fbb19c13705ddb2f44d732da7e08e3c75fed51932
5256d55a499ecb71f04dd716cfdf75bf9fe5f863620ec6634e3b43b4e6b11fd8
529a8625b1d79f8a672375f5acdefd683f86f29327461266fa428aa734cb697b
53270b71935310d01091c385fb610d324d59e3cb15354e98762445f658cb64bb
53ae914563ca9a506ecde6b72efbc109be28b72be94aaf341d3d216556d38ef6
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee
57811344d04a892ddcd3623c551ce97f268cdf0b300e2396cac5168dbc49d425
5ca3c1682657fb5ee83738de7e62e1c8d6d851c793b96828cfe8f02eb9697d45
5f224a13a15499778526423761125cbae8b8063bf0f90a46862671e17ccc9e7b
60b810eace07d67a34d692acc49a38b7b48d5d200aa56a13f307daf84cfa71f5
643a860832456b5a74825b79d625434b5c4c2a344b8f9bef3614b327bea52646
6828f1bdae5c7b89d801df314049a2d65159a4284ee530e5c848a153eadf8c87
6c567f5f0ea4a8f2b5ef941a4b6b4d4d616e8198a96b6fab88df74a5bc3b5dce
6dfe1e05661b087111ce1b280d4f082cbfd2b786a0941224da5af2ce1b29fb75
6e0488bae82bd65d223e31d6284d61d6f6bb84306e711f1cdf700c337b07f7ad
7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46
74e69d4e22a1174df1af2fb7e5be654a9ee551aed0ca2b437de0f1f8cd97611b
759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1
76a18f5f0637e0d73ce1afece898ce8b0fa75bb6b1c1990ae4a7ac6b083045ce
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
7a8cf6b7fce01f318e416ae1904132265526ca2b6ef3003f7fe831186a7380a0
7f69349ca60e8d9541cd2bb383c938c4ce0964fc6ec54e336559ae6702d8e699
81e82457fb12ef9a7b3981eceba4363763a703fd04bbe4da183903fd74e2cbcd
82362621d84dafedb468e0a04d88dcc0730114e52b6907a2e89141e7ae379aed
831d19d3c80ca082ccf9394743c71280aa5a2b7c40b8176382eb1ce20ad06ae7
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8630a5e9b221470e4baf94299937bbe590b50a2f8340c7a16533cddf9288224b
8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535
90c24135dc23d0aad6b1a7639f178e4020b5301323cf343d0ea09e2c19e463c0
94deff5cec03e6e7fcecce2bfb0a845de50b36eb46eab7980ce33599c39edf97
9880786f13259e603d90405c059eb5a4a9b01e0edcdc97f2a98880b13b00e24f
9972a15eb710be8f40584df58ffd5b892e3c65a99ded73f091d77ad4cf3a6b81
9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b
9be975407bce49a3666d53ca6553fd2500a022169c51af16b44497c49046e811
9eade11ffd772c4492d46969c94db94238be90cb2fc9ed98b199a64113d33920
9f43a0e47799e5385f63bc19f691407c31ccc5108087f2635c99e8d2d9bd7b97
a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833
a2789929aecd0e896ebade7618b39d20f6c27d4ab1edcb4bb19182be651df31a
a7708a738c64bd02df7ae231ab503159ab3336fa03de1853675631309ec07ada
a8451c3757b0729edcecf6edb54abacce58e3773b0e228073658377931523c29
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aecbb7494580f4902d9b6686614623951c0d599a7a21fe0f855491b0f52987a7
b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8
b35e08c980ed59f98bb4797a4df415c31b0bb8fee73d66d16ad70f318cdcc01a
b7c2309c6e08de495b618ca1d7325a767ce1f1921447efad9eb29fb42824d611
c026c385573035118cb24fe5315dceea3f26646af3e91df1ad530e49121753d0
c067a7d5bc50ed4ba554421966d6c4b0140ff2ed4574640fd5abcfa1ab35be11
c1e18edc7bd1afaeeb0b78b6dc289bd98f8d30fe6544cd1022281541c160b533
c250e061b0e245d6c3dad48f7093ac60cbab48ce4e65078cf436f4c3b06242eb
c255d6cac869be47d929ac6aa30d708482b94258921f91d90e9740b7650354ba
c3531ed2c934e5daee80955db42a0245d666131e6322c6ec6985992922520ab4
c50a17e8272b9359e4b62e0f305e201f359cb5bd2245671c115d031f2b7f68d0
c5216d8d82c0c227f6efb8d924f603fe922e2608740205873d74c8d3e0f3e0c9
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24
cb049a37fbac86a3d282e1946c57703c3d3078667362e694b324f5560629f308
cbafc8a187cbe3e3e70abe865ae8482984af1b3361f97a7759b25324bab3ec45
d71d5d3c7599fea2708a390106f99aff6c764e5e043b8095a2c7d2e85e392ddd
d931ba2089021a1357761939c18bcc09aa856d39be2a707ea450333f5b3443c4
d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dce50148adaff4dccd1d95c9b25563011436e398272d530e974193b8685340a2
ded16b9cb72df85ea242aaef8878c716abb57c746f0bfda6eabd2b9ddb2a23b5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964
ede50408d9975eb59f99b6525984e2c1cf091977e1bbc37d49a1aee6e75bcc90
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f08920f16a4fb284b9f0b2f9d7453ef80388854e7eed8a00260886db6dd16103
f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5
f184f9b4ee160da5ab5ef268074da09846272433305a86394de7046fd3b91296
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f64a19c5e65d43242870597af0a9ee5424ec221c86938d761cbaa81edc23e5d8
f9e78732764c87ee679cb28f3a2c3ea3d0919690caa7509991c3bd25e05013b4
fcb7e630770077694f06c279fb4a785de12b5c08004e415ca9b6a32354de4b61
ffa31f5802b20d64a10c71ad93394c1e2b4b16f33e2f479d8274fd02ce0a594f