urlscan.io logo urlscan.io
SecurityTrails logo

blog.sekoia.io Open in urlscan Pro
35.214.255.233  Public Scan

Go To Rescan Add Verdict Report
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Submission: On July 18 via api from US — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 21 IPs in 5 countries across 18 domains to perform 85 HTTP transactions. The main IP is 35.214.255.233, located in Groningen, Netherlands and belongs to GOOGLE, US. The main domain is blog.sekoia.io.
TLS certificate: Issued by AlphaSSL CA - SHA256 - G4 on January 9th 2024. Valid for: a year.
This is the only time blog.sekoia.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 35.214.255.233 15169 (GOOGLE)
38 2400:52e0:1e0... 60068 (CDN77 _)
1 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
10 2606:4700:10:... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 18.66.102.11 16509 (AMAZON-02)
2 54.217.199.120 16509 (AMAZON-02)
6 2a00:1450:400... 15169 (GOOGLE)
1 13.32.27.19 16509 (AMAZON-02)
1 54.220.85.109 16509 (AMAZON-02)
3 2001:4860:480... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:480... 20940 (AKAMAI-ASN1)
2 88.221.60.75 16625 (AKAMAI-AS)
1 3 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
2 2a00:1450:400... 15169 (GOOGLE)
1 130.248.173.59 15224 (OMNITURE)
85 21
2    35.214.255.233 (Groningen, Netherlands)

ASN15169 (GOOGLE, US)
PTR: 233.255.214.35.bc.googleusercontent.com
blog.sekoia.io
38    2400:52e0:1e00::1080:1 (Germany)

ASN60068 (CDN77 _, GB)
t7f4e9n3.rocketcdn.me
1    2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
5    2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
10    2606:4700:10::6816:3a5b (United States)

ASN13335 (CLOUDFLARENET, US)
cdn-cookieyes.com
1    2606:4700::6810:8ad1 (United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-scripts.com
2    18.66.102.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-11.fra56.r.cloudfront.net
static.hotjar.com
2    54.217.199.120 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-217-199-120.eu-west-1.compute.amazonaws.com
log.cookieyes.com
6    2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    13.32.27.19 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-19.fra56.r.cloudfront.net
script.hotjar.com
1    54.220.85.109 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-220-85-109.eu-west-1.compute.amazonaws.com
content.hotjar.io
3    2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)
region1.analytics.google.com
region1.google-analytics.com
1    2a00:1450:400c:c02::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.nl
1    2a02:26f0:480:15::213:7e63 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
2    88.221.60.75 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a88-221-60-75.deploy.static.akamaitechnologies.com
munchkin.marketo.net
3    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px4.ads.linkedin.com
2    2a00:1450:4001:802::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    130.248.173.59 (United States)

ASN15224 (OMNITURE, US)
362-pti-203.mktoresp.com
Apex Domain
Subdomains		 Transfer
38 rocketcdn.me
t7f4e9n3.rocketcdn.me
848 KB
10 cdn-cookieyes.com
cdn-cookieyes.com — Cisco Umbrella Rank: 12284
79 KB
6 gstatic.com
fonts.gstatic.com
85 KB
5 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 112
447 KB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 669
px4.ads.linkedin.com — Cisco Umbrella Rank: 7330
3 KB
4 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 3123
www.google-analytics.com — Cisco Umbrella Rank: 104
21 KB
3 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 1335
script.hotjar.com — Cisco Umbrella Rank: 2017
64 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 8471
6 KB
2 cookieyes.com
log.cookieyes.com — Cisco Umbrella Rank: 14171
305 B
2 sekoia.io
blog.sekoia.io
34 KB
1 mktoresp.com
362-pti-203.mktoresp.com
318 B
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 1884
14 KB
1 google.nl
www.google.nl — Cisco Umbrella Rank: 9563
408 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 252
244 B
1 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 3773
1 hotjar.io
content.hotjar.io — Cisco Umbrella Rank: 8904
171 B
1 hs-scripts.com
js.hs-scripts.com — Cisco Umbrella Rank: 5414
1 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 110
1 KB
85 18
Domain Requested by
38 t7f4e9n3.rocketcdn.me blog.sekoia.io
t7f4e9n3.rocketcdn.me
10 cdn-cookieyes.com blog.sekoia.io
cdn-cookieyes.com
www.googletagmanager.com
6 fonts.gstatic.com fonts.googleapis.com
5 www.googletagmanager.com blog.sekoia.io
www.googletagmanager.com
3 px.ads.linkedin.com 1 redirects snap.licdn.com
2 www.google-analytics.com www.googletagmanager.com
blog.sekoia.io
2 region1.google-analytics.com www.googletagmanager.com
2 munchkin.marketo.net blog.sekoia.io
munchkin.marketo.net
2 log.cookieyes.com cdn-cookieyes.com
2 static.hotjar.com blog.sekoia.io
www.googletagmanager.com
2 blog.sekoia.io t7f4e9n3.rocketcdn.me
1 362-pti-203.mktoresp.com munchkin.marketo.net
1 px4.ads.linkedin.com blog.sekoia.io
1 snap.licdn.com www.googletagmanager.com
1 www.google.nl blog.sekoia.io
1 stats.g.doubleclick.net www.googletagmanager.com
1 region1.analytics.google.com www.googletagmanager.com
1 content.hotjar.io script.hotjar.com
1 script.hotjar.com static.hotjar.com
1 js.hs-scripts.com blog.sekoia.io
1 fonts.googleapis.com blog.sekoia.io
85 21
Subject Issuer Validity Valid
*.sekoia.io
AlphaSSL CA - SHA256 - G4		 2024-01-09 -
2025-02-09		 a year crt.sh
*.rocketcdn.me
R3		 2024-05-14 -
2024-08-12		 3 months crt.sh
upload.video.google.com
WR2		 2024-06-24 -
2024-09-16		 3 months crt.sh
*.google-analytics.com
WR2		 2024-06-24 -
2024-09-16		 3 months crt.sh
cdn-cookieyes.com
GTS CA 1P5		 2024-05-27 -
2024-08-25		 3 months crt.sh
hs-scripts.com
E1		 2024-05-31 -
2024-08-29		 3 months crt.sh
*.hotjar.com
Amazon RSA 2048 M03		 2024-05-22 -
2025-06-20		 a year crt.sh
log.cookieyes.com
Amazon RSA 2048 M02		 2024-03-26 -
2025-04-25		 a year crt.sh
*.gstatic.com
WR2		 2024-06-24 -
2024-09-16		 3 months crt.sh
*.hotjar.io
Amazon ECDSA 256 M02		 2024-01-31 -
2025-03-01		 a year crt.sh
*.g.doubleclick.net
WR2		 2024-06-24 -
2024-09-16		 3 months crt.sh
*.google.nl
WR2		 2024-06-24 -
2024-09-16		 3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA		 2023-12-13 -
2024-12-12		 a year crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1		 2023-12-08 -
2024-12-11		 a year crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA		 2024-07-01 -
2025-01-01		 6 months crt.sh
*.mktoresp.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-09-07 -
2024-10-07		 a year crt.sh

This page contains 1 frames:

Primary Page: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Frame ID: 4C16CE3BBDCE07CC6E73E154078525A9
Requests: 94 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

MuddyWater replaces Atera by custom MuddyRot implant in a recent campaign

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/
Overall confidence: 100%
Detected patterns
  • lightbox(?:-plus-jquery)?.{0,32}\.js
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js
Overall confidence: 100%
Detected patterns
  • swiper(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

85
Requests

96 %
HTTPS

60 %
IPv6

18
Domains

21
Subdomains

21
IPs

5
Countries

1603 kB
Transfer

4053 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 78
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5046826&time=1721285892054&url=https%3A%2F%2Fblog.sekoia.io%2Fmuddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign%2F&tm=gtmv2 HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5046826&time=1721285892054&url=https%3A%2F%2Fblog.sekoia.io%2Fmuddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign%2F&tm=gtmv2&e_ipv6=AQLeIfJhwQ0-jgAAAZDEoliBvJvivtaFxRnW_IAfdPiVrkZDoTXtVVq9ay04zTeo1sUGGBM3

85 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/ 		181 KB
32 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.214.255.233 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
233.255.214.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
bc7971711b19921f19647d34c88511a16715c880a968a8a594a419143b178dc2
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Security-Policy default-src 'self'; img-src *; media-src * data:;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Content-Type, Authorization
access-control-allow-methods
GET,POST
cache-control
max-age=0
content-encoding
br
content-security-policy
upgrade-insecure-requests;
content-type
text/html; charset=UTF-8
cross-origin-embedder-policy
unsafe-none; report-to='default'
cross-origin-embedder-policy-report-only
unsafe-none; report-to='default'
cross-origin-opener-policy
unsafe-none
cross-origin-opener-policy-report-only
unsafe-none; report-to='default'
cross-origin-resource-policy
cross-origin
date
Thu, 18 Jul 2024 06:58:11 GMT
expires
Thu, 18 Jul 2024 06:58:11 GMT
host-header
6b7412fb82ca5edfd0917e3957f05d89
last-modified
Thu, 18 Jul 2024 01:30:03 GMT
permissions-policy
accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
referrer-policy
strict-origin-when-cross-origin
server
nginx
strict-transport-security
max-age=63072000; includeSubDomains
vary
Accept-Encoding Accept-Encoding,User-Agent
x-content-security-policy
default-src 'self'; img-src *; media-src * data:;
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-httpd-modphp
1
x-permitted-cross-domain-policies
none
x-proxy-cache
MISS
x-proxy-cache-info
0 NC:000000 UP:
x-xss-protection
1; mode=block
mostafa-meraji-y8nK_KcAPZU-unsplash-scaled.jpg
t7f4e9n3.rocketcdn.me/wp-content/uploads/2024/07/ 		360 KB
361 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/uploads/2024/07/mostafa-meraji-y8nK_KcAPZU-unsplash-scaled.jpg
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
9f66311969750e1c47b412eae12aa01a6bcf9ed5cee9df5bce7613860dd7ee67

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
07/15/2024 20:04:56
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
content-length
368889
last-modified
Mon, 15 Jul 2024 19:20:32 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
"66957680-5a0f9"
vary
Accept-Encoding
content-type
image/jpeg
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
930591016ded7f2db49cbf96a3139fa1
accept-ranges
bytes
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/uploads/2024/07/mostafa-meraji-y8nK_KcAPZU-unsplash-scaled.jpg>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
style.min.css
t7f4e9n3.rocketcdn.me/wp-includes/css/dist/block-library/ 		111 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-includes/css/dist/block-library/style.min.css?ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
98cecf88a23542fa047ce46eedb650b5c5128761ed4386c0977b847094ddfa20

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
05/16/2024 13:02:49
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 03 Apr 2024 09:35:39 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"660d22eb-1bae5"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
23a3d0bdd75e23c3c11e3691462cb9de
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-includes/css/dist/block-library/style.min.css?ver=6.5.3>; rel="canonical"
cdn-requestpullsuccess
True
style.min.css
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/css/ 		454 KB
44 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/css/style.min.css?ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
6cebe21539559e9c48fbfe65e91dee01455111406e02929814d913b1ec5ea942

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:10:29 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b596e5-716b5"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
68f546c5a81d324a3a763c4c0196e974
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/css/style.min.css?ver=6.4.3>; rel="canonical"
cdn-requestpullsuccess
True
style.css
t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/ 		88 B
914 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/style.css?ver=1717663978
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
129c8dd408b302e29db500ca187cac1136fde1e3f8731e91ecf3129f4148f23f

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
06/05/2024 07:05:41
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Mon, 03 Jun 2024 08:05:58 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"665d7966-58"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
f90da2aa00fbc2cda5810a03415cf045
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/cache/min/1/wp-content/themes/notizia/style.css?ver=1717401958>; rel="canonical"
cdn-requestpullsuccess
True
all.min.css
t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/fontawesome/css/ 		54 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/fontawesome/css/all.min.css?ver=1717663978
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
b69bbf76924f3f2cb2b8a48ad8879f94c41350bcaaa1e2f5bad1ef26c1023313

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Fri, 08 Mar 2024 14:07:02 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"65eb1b86-d689"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
504d17c41df88518312a56de0c9a14d8
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/fontawesome/css/all.min.css?ver=1709906822>; rel="canonical"
cdn-requestpullsuccess
True
swiper.min.css
t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/swiper/css/ 		15 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/swiper/css/swiper.min.css?ver=1717663978
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
fd2d3909ddff9145977ab7f4deef6257278aa7601dbcc5482ac59ec3af69ff42

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1081
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:12
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Fri, 08 Mar 2024 14:07:02 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"65eb1b86-3bd4"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
8aae08f4c1e4a6c7ee97a8bff6a8a7ba
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/swiper/css/swiper.min.css?ver=1709906822>; rel="canonical"
cdn-requestpullsuccess
True
magnific-popup.min.css
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/magnific-popup/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/magnific-popup/magnific-popup.min.css?ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
9af0f4e90a7cba0dbe38575666bfedf0e853278155957eb78e63761e33b88a11

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:01 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59741-1473"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
2de5765db6e2a094e372c69b2d8a12a3
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/magnific-popup/magnific-popup.min.css?ver=6.4.3>; rel="canonical"
cdn-requestpullsuccess
True
hamburgers.min.css
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/hamburgers/ 		22 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/hamburgers/hamburgers.min.css?ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
24fbf98a0312aa6db3b49c6d8e2ba9d2ae8d316bbb2f731b327f45ab23e07dda

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:01 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59741-57ba"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
56df3eb294f696308af8daa8ac7658d6
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/hamburgers/hamburgers.min.css?ver=6.4.3>; rel="canonical"
cdn-requestpullsuccess
True
animate.min.css
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/animate/ 		70 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/animate/animate.min.css?ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
eb2798553d86c6b1806d208320f645bd79eab0cebcf22176bddbc648e8f3ccd4

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1081
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:12
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:01 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59741-11848"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
b34a8b9b38bef5a089a413ff8855b8f8
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/animate/animate.min.css?ver=6.4.3>; rel="canonical"
cdn-requestpullsuccess
True
lightbox.min.css
t7f4e9n3.rocketcdn.me/wp-content/cache/background-css/t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/lightbox/css/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/cache/background-css/t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/lightbox/css/lightbox.min.css?ver=6.6&wpr_t=1721273403
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
871876a93786ce9cbcf5cff222a14cf184da2c2b4aa74de28a3ec68aba508541

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:12
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Fri, 08 Mar 2024 14:07:02 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"65eb1b86-9c0"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
c778a2fe88b584d5f62dcf20e765d215
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/cache/background-css/t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/lightbox/css/lightbox.min.css?ver=6.4.3&wpr_t=1709910836>; rel="canonical"
cdn-requestpullsuccess
True
css
fonts.googleapis.com/ 		13 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Poppins%3Aital%2Cwght%400%2C400%3B0%2C500%3B0%2C600%3B1%2C300%3B1%2C400%3B1%2C500%3B1%2C600%7CNoto+Sans%3Aital%2Cwght%400%2C400%3B0%2C700%3B1%2C400%3B1%2C700&display=swap&ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
175202eabfde37a4bfc6d0d646ff0818908491e556eda5a911d204e00afa5859
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 18 Jul 2024 06:58:11 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 18 Jul 2024 06:58:11 GMT
front.css
t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/plugins/easy-notification-bar/assets/css/ 		4 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/plugins/easy-notification-bar/assets/css/front.css?ver=1717663978
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
67e602a944bcceb8eec54d907ddac6feca2610c15f37bba5877a410826bf78c0

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
05/29/2024 20:08:35
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 29 May 2024 09:48:18 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"6656f9e2-e82"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
67e7fed7e625eac155cb639ada883bfe
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/cache/min/1/wp-content/plugins/easy-notification-bar/assets/css/front.css?ver=1716976098>; rel="canonical"
cdn-requestpullsuccess
True
feather.min.js
t7f4e9n3.rocketcdn.me/wp-content/plugins/notizia-reading-center/assets/libraries/feather-icons/ 		74 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/plugins/notizia-reading-center/assets/libraries/feather-icons/feather.min.js?ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
5dfcdd882f92d647a26beb3d974ef2ef27b96bcef8b01abaef32b8bbb2d38ef9

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:12
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:11:12 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59710-12803"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
0603255e2195f52b225b6dcfe908abef
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/plugins/notizia-reading-center/assets/libraries/feather-icons/feather.min.js?ver=6.4.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
jquery.min.js
t7f4e9n3.rocketcdn.me/wp-includes/js/jquery/ 		86 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 29 Nov 2023 09:31:15 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"656704e3-15601"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
df45aa5793cd6497a9ecb021755dc7fb
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-includes/js/jquery/jquery.min.js?ver=3.7.1>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
jquery-migrate.min.js
t7f4e9n3.rocketcdn.me/wp-includes/js/jquery/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Fri, 11 Aug 2023 10:22:55 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"64d60bff-3509"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
53b1682cc33e98d3044fa5bb120880a9
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
script.js
t7f4e9n3.rocketcdn.me/wp-content/plugins/notizia-reading-center/assets/js/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/plugins/notizia-reading-center/assets/js/script.js?ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
5da7118ba9a235cf7886a940fee43e57077adbe94af4d3f6117ca3aee39946a1

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:09:26 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b596a6-10a3"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
580931af4588cdeea0c7910e53913f12
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/plugins/notizia-reading-center/assets/js/script.js?ver=6.4.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
ajax.js
t7f4e9n3.rocketcdn.me/wp-content/plugins/notizia-reading-center/assets/js/ 		18 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/plugins/notizia-reading-center/assets/js/ajax.js?ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
f95dafc4dfe117d050194c7812377df2e9c1b1b476b12bc0a38503e786fd04ac

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1081
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
07/16/2024 16:04:39
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:09:26 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b596a6-47f4"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
975b5f0b3f9b8364edbdd15adbe27092
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/plugins/notizia-reading-center/assets/js/ajax.js?ver=6.5.5>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
script.min.js
t7f4e9n3.rocketcdn.me/wp-content/plugins/notizia-tools/assets/js/ 		35 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/plugins/notizia-tools/assets/js/script.min.js?ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
1b0e165a72588997e984e9055ce36b40c4aba3a4d45567b7af95f1cf2af23ba4

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:12
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:09:27 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b596a7-8d6c"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
49c4a9435306ae5cfa5fc2ac227bd6cc
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/plugins/notizia-tools/assets/js/script.min.js?ver=6.4.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
foundation.core.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/foundation.core.min.js?ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
5e3b5a5069534703b6b441668a33d3aecd877044e2bb8ff0bbb564c5f23a29ae

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:00 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59740-3579"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
1ebab9ea36d9667d04ebc8d99c318dbd
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/foundation/foundation.core.min.js?ver=6.4.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
foundation.util.nest.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/foundation.util.nest.min.js?ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
a43dd50b7d497a8b9964fc6a08dfe9895a73e588eeffbe0bb1b659d6ac5703b1

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:12
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:00 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59740-baa"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
85b7c56de1b705138a85370a224325da
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/foundation/foundation.util.nest.min.js?ver=6.4.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
foundation.util.keyboard.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/foundation.util.keyboard.min.js?ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
5259d3d1db0ab9bbb835ea4bb25b69be5db7366bda907678b2d9272b52fbc1ed

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:00 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59740-e0c"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
32e014c44eb357236478e97211099926
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/foundation/foundation.util.keyboard.min.js?ver=6.4.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
foundation.util.box.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/foundation.util.box.min.js?ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
28b58d1719430b0a469ec4afa2b8b7c1a4a801fe8734d73b273db0d01b788ea3

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/26/2024 21:23:04
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:00 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59740-e65"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
c1ebf7738090102f7bd654c4c14db625
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/foundation/foundation.util.box.min.js?ver=6.4.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
foundation.util.touch.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/foundation.util.touch.min.js?ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
48ad7fc9c26959cc4e41c1addf2f513215b9f48f6e46e587286215ea3b3e1d2b

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
07/14/2024 21:47:26
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:00 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59740-1192"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
22b676c45e9e04a106fc7ed4460087eb
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/foundation/foundation.util.touch.min.js?ver=6.5.5>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
foundation.dropdownMenu.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/foundation.dropdownMenu.min.js?ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
b7c769c34783e3dfd90f07e035efafd8cc1b57a4b1db3e027c42c207802271e6

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1081
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
07/04/2024 12:48:54
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:00 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59740-2912"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
546b02ba5084deb1fd486cc40d157673
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/foundation/foundation.dropdownMenu.min.js?ver=6.5.5>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
foundation.accordionMenu.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/foundation/foundation.accordionMenu.min.js?ver=6.6
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
250354fad29f1a85fc4e431b09faeccbf0275f5d5afdf6faf422936b206f25ab

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:12
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:00 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59740-2237"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
2a067be9bbf2b9fee7a18be81f8d5cad
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/foundation/foundation.accordionMenu.min.js?ver=6.4.3>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
js
www.googletagmanager.com/gtag/ 		264 KB
93 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=GT-MQXZQ8K
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
5b388f85bceb67fb8b1c34b53fc8c444731a351085a70d1ae9dd95694821ee85
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
94701
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 18 Jul 2024 06:58:11 GMT
js
www.googletagmanager.com/gtag/ 		308 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-12N1XPRQ0H
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
81230168c2bab52160e88f2f2d49935f2950b35952aec0a05fec4953c268dcad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
105820
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 18 Jul 2024 06:58:11 GMT
script.js
cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/ 		97 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/script.js
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3a5b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
04e8cde8d717404bb5cd8983f6a7817994b4434b70c0a2d834dd02dfb8297187

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 15 Jul 2024 01:09:27 GMT
server
cloudflare
age
260058
etag
"184e0-61d3ee17323ea-gzip"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate, s-maxage=604800, proxy-revalidate
accept-ranges
bytes
cf-ray
8a5094f58d021c10-AMS
content-length
34387
cropped-logo-sekoia-io-blog-light.png
t7f4e9n3.rocketcdn.me/wp-content/uploads/2023/03/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/uploads/2023/03/cropped-logo-sekoia-io-blog-light.png
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
08674dbb7419f9e5a5e6310436d0cd84559d92789fa278b9876fdedac7dec06f

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 16:36:53
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
content-length
4586
last-modified
Thu, 30 Mar 2023 20:01:58 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
"6425eab6-11ea"
vary
Accept-Encoding
content-type
image/png
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
ac5ae5c16981e206e5496af87924ff19
accept-ranges
bytes
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/uploads/2023/03/cropped-logo-sekoia-io-blog-light.png>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
TDR-badge.png
t7f4e9n3.rocketcdn.me/wp-content/uploads/2024/04/ 		149 KB
149 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/uploads/2024/04/TDR-badge.png
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
7a7b012e35bc2b06abf67da8daaa78cf31e38a5a540dc2722363e6800c834a89

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
cdn-edgestorageid
1079
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
04/30/2024 10:27:22
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
content-length
152119
last-modified
Tue, 30 Apr 2024 09:41:57 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
"6630bce5-25237"
vary
Accept-Encoding
content-type
image/png
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
bf2ded43e6a0cefa939a14c0855e1e5c
accept-ranges
bytes
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/uploads/2024/04/TDR-badge.png>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
gtm.js
www.googletagmanager.com/ 		210 KB
73 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-K8T6VX2
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
bd09a9669ea08ff9d011c4dfedd3e61494748ed8a4742d5165b74558915d5d22
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
74931
x-xss-protection
0
last-modified
Thu, 18 Jul 2024 06:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 18 Jul 2024 06:58:11 GMT
view.min.js
t7f4e9n3.rocketcdn.me/wp-includes/blocks/image/ 		0
0
interactivity.min.js
t7f4e9n3.rocketcdn.me/wp-includes/js/dist/ 		0
0
7095517.js
js.hs-scripts.com/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-scripts.com/7095517.js?integration=WordPress&ver=11.1.22
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:8ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
22d29172144c3bb951f877db6a5329ea93343786168cb2fc884609b3eb74a07b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
x-evy-trace-route-service-name
envoyset-translator
x-hubspot-correlation-id
b870a9cb-7d88-43bd-8f25-6667406999e0
cf-polished
origSize=2599
age
27
x-envoy-upstream-service-time
14
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-listener
listener_https
x-request-id
b870a9cb-7d88-43bd-8f25-6667406999e0
cf-bgj
minify
last-modified
Thu, 18 Jul 2024 06:57:44 GMT
server
cloudflare
access-control-max-age
3600
vary
origin, Accept-Encoding
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://blog.sekoia.io
x-evy-trace-served-by-pod
iad02/hubapi-td/envoy-proxy-7dd59b876-4rbtd
x-evy-trace-virtual-host
all
access-control-allow-credentials
true
cache-control
public, max-age=90
cf-ray
8a5094f589f00bad-AMS
expires
Thu, 18 Jul 2024 06:59:41 GMT
byline.334a.min.js
t7f4e9n3.rocketcdn.me/wp-content/plugins/molongui-authorship/assets/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/plugins/molongui-authorship/assets/js/byline.334a.min.js?ver=4.9.5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
9df6c4c7c9ded0611ccf30c49f5a271fe7ab2405cdecbfbf38413a1430d5f75e

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:13
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Fri, 01 Mar 2024 08:07:13 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"65e18cb1-1095"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
cc58862ae32e1301f242d98dfc53768c
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/plugins/molongui-authorship/assets/js/byline.334a.min.js?ver=4.7.10>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
intersection-observer.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/intersection-observer/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/intersection-observer/intersection-observer.min.js?ver=1.1
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
d89933395cd19a7fcf51defdc49031608af28bd675c9f3524e7bc8e1e261495d

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:13
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:01 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59741-22f1"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
088f8a94042bcc62eb9d96f7528ae039
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/intersection-observer/intersection-observer.min.js?ver=1.1>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
theme.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/ 		81 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/theme.min.js?ver=1.1
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
bc7dbcdf8032d1fa2b724cdd699a0f80e3d9fa4bfecca91eb802abde8b919e2d

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1081
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
07/11/2024 10:14:54
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:10:29 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b596e5-145ad"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
349c856180b6722f1da34902ca6fef9a
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/theme.min.js?ver=1.1>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
swiper.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/swiper/js/ 		133 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/swiper/js/swiper.min.js
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
9ee89affccbb6f24bf0dbfd697a97d13a1dfb9a94227c6b7daf7f697ceaf073f

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 16:37:03
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:13:15 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b5978b-212ea"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
24043d79e1afc6b8f717dbb167b291be
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/swiper/js/swiper.min.js>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
hoverintent.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/hoverintent/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/hoverintent/hoverintent.min.js
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
0ab10cbd66e537859e4a75a22fd8e3ac547eec9b4276e12e70e13700817763e9

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 16:37:03
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:01 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59741-913"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
35f89ec9e686dc0db082f675883997af
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/hoverintent/hoverintent.min.js>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
magnific-popup.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/magnific-popup/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/magnific-popup/magnific-popup.min.js
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
fc7109dd6428c821842660a87bda6494e52c0f4ecad22105a1aed87e440ee0b1

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1081
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 16:37:03
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:12:02 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b59742-4f29"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
3ab24da415c2f91c171b6f75cb66368b
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/magnific-popup/magnific-popup.min.js>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
lightbox.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/lightbox/js/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/lightbox/js/lightbox.min.js
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
d3ef3695bb858983c86f962d408897ea6742380534b225ba3ecfb5d47820ad06

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1081
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 16:37:03
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:13:15 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b5978b-2503"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
8388465d6c559205a66dccc55d26368b
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/lightbox/js/lightbox.min.js>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
ajax.min.js
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/js/ajax.min.js?ver=1.1
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
e43b5d8e33e7e90b8a0ee4962984feb08e72d030794dbcf94b8b292dbe8ee6c5

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:36:13
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Wed, 04 Jan 2023 15:10:29 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"63b596e5-eec"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
bca4557c279148d24fa95396ea924c0d
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/js/ajax.min.js?ver=1.1>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
lazyload.min.js
t7f4e9n3.rocketcdn.me/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
f40767552e5e94b2d5f9a65d7f640cfa7d225298023dbd682095e040809a3d1a

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cdn-edgestorageid
1080
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
07/17/2024 14:01:35
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Mon, 15 Jul 2024 08:04:56 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"6694d828-22bc"
vary
Accept-Encoding
content-type
application/javascript
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
42025170bbd49b473098dfd2932a5a43
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
hotjar-3347717.js
static.hotjar.com/c/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hotjar.com/c/hotjar-3347717.js?sv=5
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-102-11.fra56.r.cloudfront.net
Software
/
Resource Hash
97fc02db8828253e84cea3bbe7c9cf8e1a1e11b600513fde4cbc90cd66b7755a
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Thu, 18 Jul 2024 06:58:11 GMT
via
1.1 985c0b2ec44bdebc7f24f26d1e427d30.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
etag
W/5a6a1c96dd65120551d28871f344151f
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
cache-control
max-age=60
cross-origin-resource-policy
cross-origin
x-amz-cf-id
0wvNWauv9B6MyJGvO406Ez5YqgQE--xw7A99jz8ctrUq_EHW5FYpdA==
log
log.cookieyes.com/api/v1/ 		2 B
153 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://log.cookieyes.com/api/v1/log
Requested by
Host: cdn-cookieyes.com
URL: https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/script.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.217.199.120 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-217-199-120.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundarySyFEr8ol3Hj3mrA3

Response headers

access-control-allow-origin
*
date
Thu, 18 Jul 2024 06:58:11 GMT
x-powered-by
Express
content-length
2
etag
W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
content-type
text/plain; charset=utf-8
banner.js
cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/ 		100 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/banner.js
Requested by
Host: cdn-cookieyes.com
URL: https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3a5b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc6e25b5e46d2425859baf61b00e552a3fe4445c4ac77f0d2204f30eacdc84f6

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 15 Jul 2024 01:09:27 GMT
server
cloudflare
age
260057
etag
"18f0c-61d3ee17323ea-gzip"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate, s-maxage=604800, proxy-revalidate
accept-ranges
bytes
cf-ray
8a5094f68db11c10-AMS
content-length
33449
truncated
/ 		66 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
86db658dfe497e14c80a844f99abed48bb368b88a7ebc047dc3b133267c67bf0

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		69 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6a164af34c556f0a592b677c61f240426793b0236075d2804487783396842dd0

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		69 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
beca2ecd7bef7124951c885429edfc3b6da377364a1c9f953240b6eae4db8862

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
80ac6e543c18d3563e8fcf5d6e40998df8d967d94776a358b608331b9d2eb0f1

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dd042625a1a9c90986f6d33e25db075b5e6e6dff4e3cc19befa1128fb0d5d1a9

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
79572da3b65f887c852df3c47d4c00ce327ef746d4c86e325acc401e0fef2cee

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		66 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c2103f98dab7e47abd92c47030caa47d0dd0595ad21446d0f396a1c1df017da7

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v21/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v21/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3Aital%2Cwght%400%2C400%3B0%2C500%3B0%2C600%3B1%2C300%3B1%2C400%3B1%2C500%3B1%2C600%7CNoto+Sans%3Aital%2Cwght%400%2C400%3B0%2C700%3B1%2C400%3B1%2C700&display=swap&ver=6.6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blog.sekoia.io
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 11:56:33 GMT
x-content-type-options
nosniff
age
154898
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7748
x-xss-protection
0
last-modified
Fri, 22 Mar 2024 00:01:14 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 16 Jul 2025 11:56:33 GMT
pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v21/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v21/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3Aital%2Cwght%400%2C400%3B0%2C500%3B0%2C600%3B1%2C300%3B1%2C400%3B1%2C500%3B1%2C600%7CNoto+Sans%3Aital%2Cwght%400%2C400%3B0%2C700%3B1%2C400%3B1%2C700&display=swap&ver=6.6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blog.sekoia.io
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 11:49:33 GMT
x-content-type-options
nosniff
age
155318
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8000
x-xss-protection
0
last-modified
Fri, 22 Mar 2024 00:00:59 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 16 Jul 2025 11:49:33 GMT
o-0bIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjc5a7duw.woff2
fonts.gstatic.com/s/notosans/v36/ 		38 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/notosans/v36/o-0bIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjc5a7duw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3Aital%2Cwght%400%2C400%3B0%2C500%3B0%2C600%3B1%2C300%3B1%2C400%3B1%2C500%3B1%2C600%7CNoto+Sans%3Aital%2Cwght%400%2C400%3B0%2C700%3B1%2C400%3B1%2C700&display=swap&ver=6.6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
91c01ec0de315f973f4c00041b7ae25e1a790cedff79a6fbb56c571bba379142
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blog.sekoia.io
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 14:53:25 GMT
x-content-type-options
nosniff
age
144286
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39412
x-xss-protection
0
last-modified
Wed, 14 Feb 2024 22:43:09 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 16 Jul 2025 14:53:25 GMT
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v21/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3Aital%2Cwght%400%2C400%3B0%2C500%3B0%2C600%3B1%2C300%3B1%2C400%3B1%2C500%3B1%2C600%7CNoto+Sans%3Aital%2Cwght%400%2C400%3B0%2C700%3B1%2C400%3B1%2C700&display=swap&ver=6.6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blog.sekoia.io
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 12:09:47 GMT
x-content-type-options
nosniff
age
154104
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7884
x-xss-protection
0
last-modified
Fri, 22 Mar 2024 00:00:38 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 16 Jul 2025 12:09:47 GMT
o-0kIpQlx3QUlC5A4PNr4C5OaxRsfNNlKbCePevHtVtX57DGjDU1QDce2VDSyA.woff2
fonts.gstatic.com/s/notosans/v36/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/notosans/v36/o-0kIpQlx3QUlC5A4PNr4C5OaxRsfNNlKbCePevHtVtX57DGjDU1QDce2VDSyA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3Aital%2Cwght%400%2C400%3B0%2C500%3B0%2C600%3B1%2C300%3B1%2C400%3B1%2C500%3B1%2C600%7CNoto+Sans%3Aital%2Cwght%400%2C400%3B0%2C700%3B1%2C400%3B1%2C700&display=swap&ver=6.6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
50ee69eaa26f0d0f1b40bbbf32dd02ef15ff00c9be25938512ebc1e1d3ec2506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blog.sekoia.io
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 12:26:32 GMT
x-content-type-options
nosniff
age
153099
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14068
x-xss-protection
0
last-modified
Wed, 14 Feb 2024 22:38:47 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 16 Jul 2025 12:26:32 GMT
fa-brands-400.woff2
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/fontawesome/webfonts/ 		73 KB
73 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/fontawesome/webfonts/fa-brands-400.woff2
Requested by
Host: t7f4e9n3.rocketcdn.me
URL: https://t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/fontawesome/css/all.min.css?ver=1717663978
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
eed474a49bdbf745c19e463f070e67977c1ab27835603eb749d9e5c249cf81f8

Request headers

Referer
https://t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/fontawesome/css/all.min.css?ver=1717663978
Origin
https://blog.sekoia.io
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
06/23/2024 12:16:25
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
content-length
74288
last-modified
Wed, 04 Jan 2023 15:13:13 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
"63b59789-12230"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
e3205e44688cdac0d16137ed7adcad18
accept-ranges
bytes
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/fontawesome/webfonts/fa-brands-400.woff2>; rel="canonical"
cdn-requestpullsuccess
True
fa-regular-400.woff2
t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/fontawesome/webfonts/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/themes/notizia/assets/libraries/fontawesome/webfonts/fa-regular-400.woff2
Requested by
Host: t7f4e9n3.rocketcdn.me
URL: https://t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/fontawesome/css/all.min.css?ver=1717663978
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
0ecdc6188a4b2ec48e2ebf84a2a6584e78473f1216d7119832b5dc109bec7492

Request headers

Referer
https://t7f4e9n3.rocketcdn.me/wp-content/cache/min/1/wp-content/themes/notizia/assets/libraries/fontawesome/css/all.min.css?ver=1717663978
Origin
https://blog.sekoia.io
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
06/08/2024 05:10:32
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
content-length
14872
last-modified
Wed, 04 Jan 2023 15:13:13 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
"63b59789-3a18"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=31919000
cdn-requestid
30e52205da9fd123d165e7b99cb0289d
accept-ranges
bytes
cdn-requestcountrycode
NL
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status
200
link
<https://blog.sekoia.io/wp-content/themes/notizia/assets/libraries/fontawesome/webfonts/fa-regular-400.woff2>; rel="canonical"
cdn-requestpullsuccess
True
pxiGyp8kv8JHgFVrJJLucHtA.woff2
fonts.gstatic.com/s/poppins/v21/ 		8 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v21/pxiGyp8kv8JHgFVrJJLucHtA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins%3Aital%2Cwght%400%2C400%3B0%2C500%3B0%2C600%3B1%2C300%3B1%2C400%3B1%2C500%3B1%2C600%7CNoto+Sans%3Aital%2Cwght%400%2C400%3B0%2C700%3B1%2C400%3B1%2C700&display=swap&ver=6.6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
50d0c1742d80ac71f4cde20e8c04d41a24806af342831f479938b527fbff0972
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blog.sekoia.io
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 11:59:31 GMT
x-content-type-options
nosniff
age
154720
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8668
x-xss-protection
0
last-modified
Fri, 22 Mar 2024 00:00:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 16 Jul 2025 11:59:31 GMT
admin-ajax.php
blog.sekoia.io/wp-admin/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://blog.sekoia.io/wp-admin/admin-ajax.php
Requested by
Host: t7f4e9n3.rocketcdn.me
URL: https://t7f4e9n3.rocketcdn.me/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.214.255.233 Groningen, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
233.255.214.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
a2c43eefd1ba78e4297fbc14c5388a9147664cde72814be9cbbb558d532063c7
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Security-Policy default-src 'self'; img-src *; media-src * data:;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

expires
Wed, 11 Jan 1984 05:00:00 GMT
date
Thu, 18 Jul 2024 06:58:11 GMT
content-security-policy
upgrade-insecure-requests;
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains
content-encoding
br
x-permitted-cross-domain-policies
none
cross-origin-embedder-policy
unsafe-none; report-to='default'
x-proxy-cache-info
DT:1
cross-origin-resource-policy
cross-origin
x-httpd-modphp
1
host-header
8441280b0c35cbc1147f8ba998a563a7
x-xss-protection
1; mode=block
cross-origin-embedder-policy-report-only
unsafe-none; report-to='default'
referrer-policy
strict-origin-when-cross-origin
server
nginx
cross-origin-opener-policy
unsafe-none
vary
Accept-Encoding, Accept-Encoding,User-Agent
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://blog.sekoia.io
access-control-allow-methods
GET,POST
cache-control
no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
permissions-policy
accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
x-robots-tag
noindex
access-control-allow-headers
Content-Type, Authorization
cross-origin-opener-policy-report-only
unsafe-none; report-to='default'
x-content-security-policy
default-src 'self'; img-src *; media-src * data:;
truncated
/ 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		394 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0258a377207160921b4def95e08bde2b05f202a1d441850d49502f768e72307d

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
modules.e4b2dc39f985f11fb1e4.js
script.hotjar.com/ 		223 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.hotjar.com/modules.e4b2dc39f985f11fb1e4.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3347717.js?sv=5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.27.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-27-19.fra56.r.cloudfront.net
Software
/
Resource Hash
619feac205d68f6356fcad13d6758533011a8acc7830e3deb0f763249d7516c0
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 01 Jul 2024 08:11:07 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 b25bc331cb2e5e7e25d9488f5ecdc940.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C2
age
1464424
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
56291
last-modified
Mon, 01 Jul 2024 08:10:34 GMT
etag
"ca025d2d8ae4b3dc51e058b782590501"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
5v_iZ45a88JwOR3wuVlppXy9DY8-3AuYbi_tueLTLsW3S4GpWVnT5A==
/
content.hotjar.io/ 		56 B
171 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://content.hotjar.io/?site_id=3347717&gzip=1
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.e4b2dc39f985f11fb1e4.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.220.85.109 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-220-85-109.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
314eba2a2f37823e29f092a96c3f001bd4a24b894d660cf7aa7f3b79441c3369

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain; charset=UTF-8

Response headers

access-control-allow-origin
*
date
Thu, 18 Jul 2024 06:58:12 GMT
content-length
56
access-control-max-age
86400
content-type
application/json
collect
region1.analytics.google.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-9XJJ1LP075&gtm=45Pe47h0v9114055258za200&_p=1721285891399&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=0&gdid=dZTNiMT&cid=1228949147.1721285892&ul=nl-nl&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1721285891&sct=1&seg=0&dl=https%3A%2F%2Fblog.sekoia.io%2Fmuddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign%2F&dt=MuddyWater%20replaces%20Atera%20by%20custom%20MuddyRot%20implant%20in%20a%20recent%20campaign&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=697&_z=fetch
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=GT-MQXZQ8K
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 18 Jul 2024 06:58:11 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.sekoia.io
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/ 		0
244 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-9XJJ1LP075&cid=1228949147.1721285892&gtm=45Pe47h0v9114055258za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1&npa=1&frm=0
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=GT-MQXZQ8K
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c02::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 18 Jul 2024 06:58:12 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.sekoia.io
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		305 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-12N1XPRQ0H&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=GT-MQXZQ8K
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
07fcdc9fb4e61aacfd1bb1edc593565f6f7c5b56c8d798cd8e5c6e2e77567a3e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
104713
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 18 Jul 2024 06:58:11 GMT
ga-audiences
www.google.nl/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.nl/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-9XJJ1LP075&cid=1228949147.1721285892&gtm=45Pe47h0v9114055258za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1&npa=1&frm=0&z=2122656359
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 18 Jul 2024 06:58:12 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
script.js
cdn-cookieyes.com/client_data/src=%22https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/script.js%22/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-cookieyes.com/client_data/src=%22https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/script.js%22/script.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K8T6VX2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3a5b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
br
cf-cache-status
HIT
server
cloudflare
age
242400
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=0, s-maxage=604800, proxy-revalidate
cf-ray
8a5094f8cf501c10-AMS
hotjar-3133674.js
static.hotjar.com/c/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hotjar.com/c/hotjar-3133674.js?sv=7
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K8T6VX2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-102-11.fra56.r.cloudfront.net
Software
/
Resource Hash
6f52f3d51c65fc57c150493d4bef9fe0c0d3b07c6b3949740ec664493edab5ef
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Thu, 18 Jul 2024 06:58:11 GMT
via
1.1 985c0b2ec44bdebc7f24f26d1e427d30.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
etag
W/14638fb61e9d784dab8aa99e75c0e3f3
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
cache-control
max-age=60
cross-origin-resource-policy
cross-origin
x-amz-cf-id
gjTn0FQlqYD0zsWHDjI-0yuSQyyjoDtlyAieyCg303jDsn6nvIygpg==
insight.min.js
snap.licdn.com/li.lms-analytics/ 		38 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K8T6VX2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:15::213:7e63 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
dbfeb010a0c8acddc38dea97e228787f16ac5e30b4af96b764fa2252fe3827e4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Jul 2024 09:19:33 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
max-age=71235
accept-ranges
bytes
content-length
14011
munchkin.js
munchkin.marketo.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a88-221-60-75.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Thu, 18 Jul 2024 06:58:12 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
729
js
www.googletagmanager.com/gtag/ 		207 KB
75 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-152945562-2&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-12N1XPRQ0H
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
4760c3078c97a37bdfe704fb65c38b03794ef41fb58612ebad75ea4291695345
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:12 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
76382
x-xss-protection
0
last-modified
Thu, 18 Jul 2024 06:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 18 Jul 2024 06:58:12 GMT
collect
region1.google-analytics.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-12N1XPRQ0H&gtm=45je47h0v876103120z89105367108za200zb9114055258&_p=1721285891399&gcs=G100&gcd=13u3u3q2q5&npa=1&dma_cps=-&dma=1&tag_exp=0&gdid=dY2Q2ZW&cid=639878147.1721285892&ul=nl-nl&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=denied&_s=1&sid=1721285891&sct=1&seg=0&dl=https%3A%2F%2Fblog.sekoia.io%2Fmuddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign%2F&dt=MuddyWater%20replaces%20Atera%20by%20custom%20MuddyRot%20implant%20in%20a%20recent%20campaign&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=742&_z=fetch
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-12N1XPRQ0H
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 18 Jul 2024 06:58:12 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.sekoia.io
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
px.ads.linkedin.com/wa/ 		0
700 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://px.ads.linkedin.com/wa/
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*
Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Thu, 18 Jul 2024 06:58:12 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: AAF496B2A8C74F34A4BD0180C873D0DB Ref B: AMS04EDGE3110 Ref C: 2024-07-18T06:58:12Z
linkedin-action
1
vary
Origin
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
access-control-allow-origin
https://blog.sekoia.io
x-li-proto
http/2
access-control-allow-credentials
true
x-li-uuid
AAYdgBopPa7WNnMD3hVHqQ==
attribution_trigger
px.ads.linkedin.com/ 		2 B
815 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://px.ads.linkedin.com/attribution_trigger?pid=5046826&time=1721285892054&url=https%3A%2F%2Fblog.sekoia.io%2Fmuddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign%2F&tm=gtmv2
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept
*
Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:11 GMT
content-encoding
gzip
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 67DA602DCA174A759DEC07B5109E0A31 Ref B: AMS04EDGE1711 Ref C: 2024-07-18T06:58:12Z
access-control-allow-methods
GET, OPTIONS
x-li-fabric
prod-lor1
access-control-allow-origin
*
x-cache
CONFIG_NOCACHE
content-type
application/json
x-li-proto
http/2
x-restli-protocol-version
1.0.0
access-control-allow-headers
*
x-li-uuid
AAYdgBope+H1X3duOmvu/A==
x-fs-uuid
00061d801a297be1f55f776e3a6beefc
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5046826&time=1721285892054&url=https%3A%2F%2Fblog.sekoia.io%2Fmuddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign%2F&tm=gtmv2
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5046826&time=1721285892054&url=https%3A%2F%2Fblog.sekoia.io%2Fmuddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign%2F&tm=gtm...
0
266 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5046826&time=1721285892054&url=https%3A%2F%2Fblog.sekoia.io%2Fmuddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign%2F&tm=gtmv2&e_ipv6=AQLeIfJhwQ0-jgAAAZDEoliBvJvivtaFxRnW_IAfdPiVrkZDoTXtVVq9ay04zTeo1sUGGBM3
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:12 GMT
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 4886FB390F0648FAB4170F02C7C90433 Ref B: DUS30EDGE0916 Ref C: 2024-07-18T06:58:12Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lor1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYdgBotpE0WJKdOLDkN5w==

Redirect headers

date
Thu, 18 Jul 2024 06:58:12 GMT
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 5E0BB4503D2E4278BC7CB6C41359ECB1 Ref B: AMS04EDGE3110 Ref C: 2024-07-18T06:58:12Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lor1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=5046826&time=1721285892054&url=https%3A%2F%2Fblog.sekoia.io%2Fmuddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign%2F&tm=gtmv2&e_ipv6=AQLeIfJhwQ0-jgAAAZDEoliBvJvivtaFxRnW_IAfdPiVrkZDoTXtVVq9ay04zTeo1sUGGBM3
x-li-proto
http/2
content-length
0
x-li-uuid
AAYdgBopjA3PEsaNn9/pqg==
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-152945562-2&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 18 Jul 2024 06:29:07 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
server
Golfe2
age
1745
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Thu, 18 Jul 2024 08:29:07 GMT
collect
www.google-analytics.com/ 		35 B
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j101&a=726192966&t=pageview&_s=1&dl=https%3A%2F%2Fblog.sekoia.io%2Fmuddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign%2F&ul=nl-nl&de=UTF-8&dt=MuddyWater%20replaces%20Atera%20by%20custom%20MuddyRot%20implant%20in%20a%20recent%20campaign&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAgAAQABAAAAAAAAIk~&cid=639878147.1721285892&tid=UA-152945562-2&_gid=1169588268.1721285892&gtm=457e47h0z8876103120za200zb876103120&gcs=G100&gcd=13u3u3q2q5&dma_cps=-&dma=1&tag_exp=0&did=dY2Q2ZW&gdid=dY2Q2ZW&jsscut=1&npa=1&z=1612258549
Requested by
Host: blog.sekoia.io
URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 17 Jul 2024 10:24:46 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
74006
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
munchkin.js
munchkin.marketo.net/163/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
88.221.60.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a88-221-60-75.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Thu, 18 Jul 2024 06:58:12 GMT
Content-Encoding
gzip
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4741
Expires
Sat, 26 Oct 2024 06:58:12 GMT
visitWebPage
362-pti-203.mktoresp.com/webevents/ 		2 B
318 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://362-pti-203.mktoresp.com/webevents/visitWebPage?_mchNc=1721285892348&_mchCn=&_mchId=362-PTI-203&_mchTk=_mch-blog.sekoia.io-1721285892347-20795&_mchHo=blog.sekoia.io&_mchPo=&_mchRu=%2Fmuddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
130.248.173.59 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Thu, 18 Jul 2024 06:58:12 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
d7782d00-a841-4c63-a297-b7905841efed
bX3ufFas.json
cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/ 		44 B
336 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/bX3ufFas.json
Requested by
Host: cdn-cookieyes.com
URL: https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/banner.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3a5b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f8c098c6bed7611f3c2d1dc4c546ad3a3ee45ae270e3f1a68248e6481c2dd371

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:12 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 15 Jul 2024 01:09:27 GMT
server
cloudflare
age
260058
etag
W/"2c-61d3ee173144a"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate, s-maxage=604800, proxy-revalidate
cf-ray
8a5094fd0ec76668-AMS
Fav_Sekoia.svg
t7f4e9n3.rocketcdn.me/wp-content/uploads/2023/03/ 		2 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://t7f4e9n3.rocketcdn.me/wp-content/uploads/2023/03/Fav_Sekoia.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1080 / RocketCDN - b
Resource Hash
018478a657fb232c5d4284853dd8300c652bd905b23f47c66de77ed6e9c99031

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:12 GMT
content-encoding
br
cdn-edgestorageid
1082
x-powered-by
RocketCDN - b
x-proxy-cache-info
DT:1
cdn-cachedat
03/08/2024 14:27:14
cdn-pullzone
1701112
host-header
8441280b0c35cbc1147f8ba998a563a7
last-modified
Thu, 30 Mar 2023 12:30:54 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"642580fe-8b8"
vary
Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
cdn-cache
HIT
cdn-uid
9c62a85e-aade-42a0-9ab7-0e0ad624743f
cache-control
public, max-age=31919000
cdn-requestid
35ab3288db6087ebb68a91319a532c8d
cdn-requestcountrycode
NL
link
<https://blog.sekoia.io/wp-content/uploads/2023/03/Fav_Sekoia.svg>; rel="canonical"
cdn-status
200
cdn-requestpullsuccess
True
VDpUKax8.json
cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/config/ 		33 KB
6 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/config/VDpUKax8.json
Requested by
Host: cdn-cookieyes.com
URL: https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/banner.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3a5b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
21dcc17434f2b42d690903f15e98535281c54a53b79c3cde3e5a7e823f27602e

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:12 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 15 Jul 2024 01:09:27 GMT
server
cloudflare
age
260058
etag
W/"8527-61d3ee17323ea"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate, s-maxage=604800, proxy-revalidate
cf-ray
8a5094fd4eec6668-AMS
eDLVn6aq.json
cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/translations/ 		2 KB
815 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/translations/eDLVn6aq.json
Requested by
Host: cdn-cookieyes.com
URL: https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/banner.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3a5b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14612faefc54e67007084332e850f554ca6ba980bebd2f88beb4051dffa87d61

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:12 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 15 Jul 2024 01:09:27 GMT
server
cloudflare
age
260058
etag
W/"6ef-61d3ee17323ea"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate, s-maxage=604800, proxy-revalidate
cf-ray
8a5094fd6f206668-AMS
TzTSYOLe.json
cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/audit-table/ 		7 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/audit-table/TzTSYOLe.json
Requested by
Host: cdn-cookieyes.com
URL: https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/banner.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3a5b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7701df7dd40eb9b322409a3b14193dd8613222619445be2ee6797bb1721d1138

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:12 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 15 Jul 2024 01:09:27 GMT
server
cloudflare
age
260058
etag
W/"1afa-61d3ee173144a"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate, s-maxage=604800, proxy-revalidate
cf-ray
8a5094fd9f596668-AMS
revisit.svg
cdn-cookieyes.com/assets/images/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-cookieyes.com/assets/images/revisit.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3a5b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed7c487f915432d9464e2af0a83002ee93596e86e076f3c917e439e5b844d08b

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:12 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 15 Mar 2022 04:40:47 GMT
server
cloudflare
age
247596
etag
W/"923-5da3a668dacc0"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=0, s-maxage=604800, proxy-revalidate
cf-ray
8a5094fddba31c10-AMS
close.svg
cdn-cookieyes.com/assets/images/ 		1 KB
808 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-cookieyes.com/assets/images/close.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3a5b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a049e1abe441835a2bcf35258936072189a0a52d0000c4ed2094e59d2afd189b

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:12 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 15 Mar 2022 04:40:50 GMT
server
cloudflare
age
247596
etag
W/"541-5da3a66c769d4"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=0, s-maxage=604800, proxy-revalidate
cf-ray
8a5094fddba71c10-AMS
poweredbtcky.svg
cdn-cookieyes.com/assets/images/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-cookieyes.com/assets/images/poweredbtcky.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3a5b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
911f58b8d14bd6f73a83fd774e44bec97e896317c7093dc83e96921e64f1fbd5

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Thu, 18 Jul 2024 06:58:12 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 15 Mar 2022 04:41:24 GMT
server
cloudflare
age
247586
etag
W/"eb2-5da3a68c50d09"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=0, s-maxage=604800, proxy-revalidate
cf-ray
8a5094fddba81c10-AMS
log
log.cookieyes.com/api/v1/ 		2 B
152 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://log.cookieyes.com/api/v1/log
Requested by
Host: cdn-cookieyes.com
URL: https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/script.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.217.199.120 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-217-199-120.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryLmBRCOlJYZeCElPX

Response headers

access-control-allow-origin
*
date
Thu, 18 Jul 2024 06:58:12 GMT
x-powered-by
Express
content-length
2
etag
W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
content-type
text/plain; charset=utf-8
collect
region1.google-analytics.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-12N1XPRQ0H&gtm=45je47h0v876103120za200zb9114055258&_p=1721285891399&gcs=G100&gcd=13u3u3q2q5&npa=1&dma_cps=-&dma=1&tag_exp=0&gdid=dY2Q2ZW.dZTNiMT&cid=639878147.1721285892&ul=nl-nl&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=denied&_eu=AAAC&_s=2&sid=1721285891&sct=1&seg=1&dl=https%3A%2F%2Fblog.sekoia.io%2Fmuddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign%2F&dt=MuddyWater%20replaces%20Atera%20by%20custom%20MuddyRot%20implant%20in%20a%20recent%20campaign&en=page_view&_ee=1&_et=2&tfd=5744&_z=fetch
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-12N1XPRQ0H
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

Referer
https://blog.sekoia.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 18 Jul 2024 06:58:17 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.sekoia.io
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
t7f4e9n3.rocketcdn.me
URL
https://t7f4e9n3.rocketcdn.me/wp-includes/blocks/image/view.min.js?ver=6.6
Domain
t7f4e9n3.rocketcdn.me
URL
https://t7f4e9n3.rocketcdn.me/wp-includes/js/dist/interactivity.min.js?ver=6.6

Verdicts & Comments Add Verdict or Comment

101 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| dataLayer object| feather function| jQuery number| s_s_width function| notizia_show_reading_center function| notizia_show_reading_list object| alerts object| notiziaUrls function| notizia_get_reading_center_data function| notizia_reading_center_bind_load_more function| notizia_reading_center_bind_close function| notizia_get_reading_list_data function| notizia_reading_list_bind_load_more function| notizia_reading_list_bind_remove function| notizia_reading_list_auto_remove object| notizia_Tools_Urls object| localized_tools_string string| user_menu boolean| has_main_menu string| header_type number| display_width boolean| login_error function| notizia_tools_bind_user_buttons function| notizia_tools_bind_load_more function| notizia_tools_load_more function| notizia_tools_adjust_blocks_css object| __FOUNDATION_EXTERNAL__ object| Foundation function| gtag object| _hsq function| hj object| _hjSettings object| cookieyes object| leadin_wordpress object| molongui_authorship_byline_params function| _createClass function| _classCallCheck function| RocketBrowserCompatibilityChecker object| RocketPreloadLinksConfig object| rocket_lazyload_css_data object| notizia_t_Urls object| localized_strings string| bg_src string| decorations_type string| decorations_classes number| tags_container_height number| menu_elements_total_width string| category_text number| s_width number| scrollb number| count_loops object| notizia_main_menu_1 function| notizia_add_body_classes function| notizia_set_menu_elements_alignment function| notizia_animate_elements_scroll function| notizia_append_loaders function| notizia_hide_alert function| notizia_place_elements function| notizia_initialize_lightbox function| notizia_email_validation function| notizia_close_panel function| notizia_change_logo function| notizia_adjust_columns function| notizia_eye_catching_swiper function| notizia_adjust_eye_catching_elements function| notizia_bind_eye_catching_events function| notizia_observe_dom function| Swiper object| lightbox object| notizia_Urls function| notizia_set_categories_style object| lazyLoadOptions object| regeneratorRuntime function| revisitCkyConsent function| performBannerAction function| getCkyConsent function| LazyLoad object| images object| iframes object| rocket_lazy object| hjSiteSettings function| hjBootstrap object| hjLazyModules object| hjBootstrapCalled object| google_tag_manager object| google_tag_data object| gaGlobal object| _linkedin_data_partner_ids boolean| _already_called_lintrk function| onYouTubeIframeAPIReady function| lintrk object| ORIBILI string| GoogleAnalyticsObject function| ga object| gaplugins object| gaData function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| MunchkinTracker

4 Cookies

Domain/Path Name / Value
.linkedin.com/ Name: bcookie
Value: "v=2&e499d409-5c27-408b-82e2-b56a30966e65"
.linkedin.com/ Name: li_gc
Value: MTswOzE3MjEyODU4OTI7MjswMjGFv3InAGg/5AWJJgu5H9OE1PwBiRclccyAx/lTA2V96g==
.linkedin.com/ Name: lidc
Value: "b=OGST05:s=O:r=O:a=O:p=O:g=3124:u=1:x=1:i=1721285892:t=1721372292:v=2:sig=AQHO9Qhu8A-RvYUhywsY3-cK0BbRCJpf"
.blog.sekoia.io/ Name: cookieyes-consent
Value: consentid:b2t0MjBvMnBTTThuRjVwZTFYSmZlSmtDeHpYTnV2M2k,consent:no,action:,necessary:yes,functional:no,analytics:no,performance:no,advertisement:no,other:no,lastRenewedDate:1716906604000

5 Console Messages

Source Level URL
Text
javascript error URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Message:
Access to script at 'https://t7f4e9n3.rocketcdn.me/wp-includes/blocks/image/view.min.js?ver=6.6' from origin 'https://blog.sekoia.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://t7f4e9n3.rocketcdn.me/wp-includes/blocks/image/view.min.js?ver=6.6
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://blog.sekoia.io/muddywater-replaces-atera-by-custom-muddyrot-implant-in-a-recent-campaign/
Message:
Access to script at 'https://t7f4e9n3.rocketcdn.me/wp-includes/js/dist/interactivity.min.js?ver=6.6' from origin 'https://blog.sekoia.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://t7f4e9n3.rocketcdn.me/wp-includes/js/dist/interactivity.min.js?ver=6.6
Message:
Failed to load resource: net::ERR_FAILED
network error URL: https://cdn-cookieyes.com/client_data/src=%22https://cdn-cookieyes.com/client_data/8e62bd9aea8528cd3a8c337f/script.js%22/script.js
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Security-Policy default-src 'self'; img-src *; media-src * data:;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

362-pti-203.mktoresp.com
blog.sekoia.io
cdn-cookieyes.com
content.hotjar.io
fonts.googleapis.com
fonts.gstatic.com
js.hs-scripts.com
log.cookieyes.com
munchkin.marketo.net
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
region1.google-analytics.com
script.hotjar.com
snap.licdn.com
static.hotjar.com
stats.g.doubleclick.net
t7f4e9n3.rocketcdn.me
www.google-analytics.com
www.google.nl
www.googletagmanager.com
t7f4e9n3.rocketcdn.me
13.107.42.14
13.32.27.19
130.248.173.59
18.66.102.11
2001:4860:4802:34::36
2400:52e0:1e00::1080:1
2606:4700:10::6816:3a5b
2606:4700::6810:8ad1
2620:1ec:21::14
2a00:1450:4001:802::200e
2a00:1450:4001:80f::2003
2a00:1450:4001:811::2003
2a00:1450:4001:811::200a
2a00:1450:4001:813::2008
2a00:1450:400c:c02::9b
2a02:26f0:480:15::213:7e63
35.214.255.233
54.217.199.120
54.220.85.109
88.221.60.75
018478a657fb232c5d4284853dd8300c652bd905b23f47c66de77ed6e9c99031
0258a377207160921b4def95e08bde2b05f202a1d441850d49502f768e72307d
04e8cde8d717404bb5cd8983f6a7817994b4434b70c0a2d834dd02dfb8297187
07fcdc9fb4e61aacfd1bb1edc593565f6f7c5b56c8d798cd8e5c6e2e77567a3e
08674dbb7419f9e5a5e6310436d0cd84559d92789fa278b9876fdedac7dec06f
0ab10cbd66e537859e4a75a22fd8e3ac547eec9b4276e12e70e13700817763e9
0ecdc6188a4b2ec48e2ebf84a2a6584e78473f1216d7119832b5dc109bec7492
129c8dd408b302e29db500ca187cac1136fde1e3f8731e91ecf3129f4148f23f
14612faefc54e67007084332e850f554ca6ba980bebd2f88beb4051dffa87d61
175202eabfde37a4bfc6d0d646ff0818908491e556eda5a911d204e00afa5859
1b0e165a72588997e984e9055ce36b40c4aba3a4d45567b7af95f1cf2af23ba4
21dcc17434f2b42d690903f15e98535281c54a53b79c3cde3e5a7e823f27602e
22d29172144c3bb951f877db6a5329ea93343786168cb2fc884609b3eb74a07b
24fbf98a0312aa6db3b49c6d8e2ba9d2ae8d316bbb2f731b327f45ab23e07dda
250354fad29f1a85fc4e431b09faeccbf0275f5d5afdf6faf422936b206f25ab
28b58d1719430b0a469ec4afa2b8b7c1a4a801fe8734d73b273db0d01b788ea3
314eba2a2f37823e29f092a96c3f001bd4a24b894d660cf7aa7f3b79441c3369
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4760c3078c97a37bdfe704fb65c38b03794ef41fb58612ebad75ea4291695345
48ad7fc9c26959cc4e41c1addf2f513215b9f48f6e46e587286215ea3b3e1d2b
50d0c1742d80ac71f4cde20e8c04d41a24806af342831f479938b527fbff0972
50ee69eaa26f0d0f1b40bbbf32dd02ef15ff00c9be25938512ebc1e1d3ec2506
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
5259d3d1db0ab9bbb835ea4bb25b69be5db7366bda907678b2d9272b52fbc1ed
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5b388f85bceb67fb8b1c34b53fc8c444731a351085a70d1ae9dd95694821ee85
5da7118ba9a235cf7886a940fee43e57077adbe94af4d3f6117ca3aee39946a1
5dfcdd882f92d647a26beb3d974ef2ef27b96bcef8b01abaef32b8bbb2d38ef9
5e3b5a5069534703b6b441668a33d3aecd877044e2bb8ff0bbb564c5f23a29ae
619feac205d68f6356fcad13d6758533011a8acc7830e3deb0f763249d7516c0
67e602a944bcceb8eec54d907ddac6feca2610c15f37bba5877a410826bf78c0
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6a164af34c556f0a592b677c61f240426793b0236075d2804487783396842dd0
6cebe21539559e9c48fbfe65e91dee01455111406e02929814d913b1ec5ea942
6f52f3d51c65fc57c150493d4bef9fe0c0d3b07c6b3949740ec664493edab5ef
7701df7dd40eb9b322409a3b14193dd8613222619445be2ee6797bb1721d1138
79572da3b65f887c852df3c47d4c00ce327ef746d4c86e325acc401e0fef2cee
7a7b012e35bc2b06abf67da8daaa78cf31e38a5a540dc2722363e6800c834a89
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
80ac6e543c18d3563e8fcf5d6e40998df8d967d94776a358b608331b9d2eb0f1
81230168c2bab52160e88f2f2d49935f2950b35952aec0a05fec4953c268dcad
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
86db658dfe497e14c80a844f99abed48bb368b88a7ebc047dc3b133267c67bf0
871876a93786ce9cbcf5cff222a14cf184da2c2b4aa74de28a3ec68aba508541
911f58b8d14bd6f73a83fd774e44bec97e896317c7093dc83e96921e64f1fbd5
91c01ec0de315f973f4c00041b7ae25e1a790cedff79a6fbb56c571bba379142
97fc02db8828253e84cea3bbe7c9cf8e1a1e11b600513fde4cbc90cd66b7755a
98cecf88a23542fa047ce46eedb650b5c5128761ed4386c0977b847094ddfa20
9af0f4e90a7cba0dbe38575666bfedf0e853278155957eb78e63761e33b88a11
9df6c4c7c9ded0611ccf30c49f5a271fe7ab2405cdecbfbf38413a1430d5f75e
9ee89affccbb6f24bf0dbfd697a97d13a1dfb9a94227c6b7daf7f697ceaf073f
9f66311969750e1c47b412eae12aa01a6bcf9ed5cee9df5bce7613860dd7ee67
a049e1abe441835a2bcf35258936072189a0a52d0000c4ed2094e59d2afd189b
a2c43eefd1ba78e4297fbc14c5388a9147664cde72814be9cbbb558d532063c7
a43dd50b7d497a8b9964fc6a08dfe9895a73e588eeffbe0bb1b659d6ac5703b1
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b69bbf76924f3f2cb2b8a48ad8879f94c41350bcaaa1e2f5bad1ef26c1023313
b7c769c34783e3dfd90f07e035efafd8cc1b57a4b1db3e027c42c207802271e6
bc7971711b19921f19647d34c88511a16715c880a968a8a594a419143b178dc2
bc7dbcdf8032d1fa2b724cdd699a0f80e3d9fa4bfecca91eb802abde8b919e2d
bd09a9669ea08ff9d011c4dfedd3e61494748ed8a4742d5165b74558915d5d22
beca2ecd7bef7124951c885429edfc3b6da377364a1c9f953240b6eae4db8862
c2103f98dab7e47abd92c47030caa47d0dd0595ad21446d0f396a1c1df017da7
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
d3ef3695bb858983c86f962d408897ea6742380534b225ba3ecfb5d47820ad06
d89933395cd19a7fcf51defdc49031608af28bd675c9f3524e7bc8e1e261495d
dbfeb010a0c8acddc38dea97e228787f16ac5e30b4af96b764fa2252fe3827e4
dd042625a1a9c90986f6d33e25db075b5e6e6dff4e3cc19befa1128fb0d5d1a9
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e43b5d8e33e7e90b8a0ee4962984feb08e72d030794dbcf94b8b292dbe8ee6c5
eb2798553d86c6b1806d208320f645bd79eab0cebcf22176bddbc648e8f3ccd4
ed7c487f915432d9464e2af0a83002ee93596e86e076f3c917e439e5b844d08b
eed474a49bdbf745c19e463f070e67977c1ab27835603eb749d9e5c249cf81f8
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f40767552e5e94b2d5f9a65d7f640cfa7d225298023dbd682095e040809a3d1a
f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149
f8c098c6bed7611f3c2d1dc4c546ad3a3ee45ae270e3f1a68248e6481c2dd371
f95dafc4dfe117d050194c7812377df2e9c1b1b476b12bc0a38503e786fd04ac
fc6e25b5e46d2425859baf61b00e552a3fe4445c4ac77f0d2204f30eacdc84f6
fc7109dd6428c821842660a87bda6494e52c0f4ecad22105a1aed87e440ee0b1
fd2d3909ddff9145977ab7f4deef6257278aa7601dbcc5482ac59ec3af69ff42