blog.cyble.com Open in urlscan Pro
192.0.78.213 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=soci...
Submission: On February 03 via api (February 3rd 2023, 3:39:42 pm UTC) from US — Scanned from DE

Summary HTTP 103 Redirects Links 26 Behaviour Indicators

Summary

This website contacted 31 IPs in 4 countries across 24 domains to perform 103 HTTP transactions. The main IP is 192.0.78.213, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is blog.cyble.com.
TLS certificate: Issued by R3 on January 21st 2023. Valid for: 3 months.

This is the only time blog.cyble.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
28	192.0.78.213 192.0.78.213	2635 (AUTOMATTIC) (AUTOMATTIC)
5	192.0.77.32 192.0.77.32	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a00:1450:400... 2a00:1450:400d:803::2008	15169 (GOOGLE) (GOOGLE)
6	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
3	2606:4700::68... 2606:4700::6811:b949	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2606:4700:20:... 2606:4700:20::681a:d31	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:d4cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1 5	2600:9000:211... 2600:9000:211a:2600:6:9280:1080:93a1	16509 (AMAZON-02) (AMAZON-02)
4	2606:4700::68... 2606:4700::6810:5905	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:400d:806::200e	15169 (GOOGLE) (GOOGLE)
1	2a05:d018:cc3... 2a05:d018:cc3:fe04:7036:b4fb:4707:a1df	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:47b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:82ab	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:74b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:9a55	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:e8cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:edcc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:402... 2a00:1450:4025:401::9d	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:5805	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:c8cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:11a... 2a02:26f0:11a::217:9a4a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2600:9000:230... 2600:9000:2304:dc00:2:53b2:240:93a1	16509 (AMAZON-02) (AMAZON-02)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
5	2606:4700::68... 2606:4700::6811:7d2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:2c40::c7... 2606:2c40::c73c:67e2	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
1	2a00:1450:400... 2a00:1450:400d:808::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400d:803::2003	15169 (GOOGLE) (GOOGLE)
103	31

28 192.0.78.213 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

blog.cyble.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

fonts-api.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:803::2008 (Ireland)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i0.wp.com

i0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6811:b949 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700:20::681a:d31 (United States)

ASN13335 (CLOUDFLARENET, US)

injection.amibreached.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:d4cc (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:211a:2600:6:9280:1080:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:5905 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:806::200e (Ireland)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d018:cc3:fe04:7036:b4fb:4707:a1df (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:47b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:82ab (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:74b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9a55 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:e8cc (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:edcc (United States)

ASN13335 (CLOUDFLARENET, US)

js.usemessages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4025:401::9d (Den Helder, Netherlands)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5805 (United States)

ASN13335 (CLOUDFLARENET, US)

forms-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:c8cc (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:11a::217:9a4a (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2304:dc00:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6811:7d2 (United States)

ASN13335 (CLOUDFLARENET, US)

static.hsappstatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2c40::c73c:67e2 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

labs.cyble.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:808::2004 (Ireland)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:803::2003 (Ireland)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
29	cyble.com blog.cyble.com labs.cyble.com	727 KB
14	hubspot.com api.hubspot.com — Cisco Umbrella Rank: 4596 forms.hubspot.com — Cisco Umbrella Rank: 2937 app.hubspot.com — Cisco Umbrella Rank: 5253 track.hubspot.com — Cisco Umbrella Rank: 2152	31 KB
14	wp.com fonts-api.wp.com — Cisco Umbrella Rank: 14322 i0.wp.com — Cisco Umbrella Rank: 2986 s0.wp.com — Cisco Umbrella Rank: 6656 stats.wp.com — Cisco Umbrella Rank: 2634 fonts.wp.com — Cisco Umbrella Rank: 15194 pixel.wp.com — Cisco Umbrella Rank: 2462	473 KB
9	amibreached.com injection.amibreached.com	263 KB
6	adroll.com 1 redirects s.adroll.com — Cisco Umbrella Rank: 2416 d.adroll.com — Cisco Umbrella Rank: 1473	82 KB
5	hsappstatic.net static.hsappstatic.net — Cisco Umbrella Rank: 6555	293 KB
5	hsforms.com forms.hsforms.com — Cisco Umbrella Rank: 3843 forms-na1.hsforms.com — Cisco Umbrella Rank: 6017	12 KB
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 353 www.linkedin.com — Cisco Umbrella Rank: 575 px4.ads.linkedin.com — Cisco Umbrella Rank: 6074	4 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 21 region1.google-analytics.com — Cisco Umbrella Rank: 2456	20 KB
3	hsforms.net js.hsforms.net — Cisco Umbrella Rank: 5772	475 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	109 KB
1	gstatic.com www.gstatic.com	162 KB
1	google.com www.google.com — Cisco Umbrella Rank: 2	901 B
1	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 814	375 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 707	5 KB
1	hubapi.com api.hubapi.com — Cisco Umbrella Rank: 3237	877 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 78	345 B
1	usemessages.com js.usemessages.com — Cisco Umbrella Rank: 4498	21 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 4028	87 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2011	63 KB
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 2974	3 KB
1	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 4350	25 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2004	20 KB
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2109	998 B
103	24

	Domain	Requested by
28	blog.cyble.com	blog.cyble.com
9	injection.amibreached.com	blog.cyble.com injection.amibreached.com
7	track.hubspot.com
6	i0.wp.com	blog.cyble.com
5	static.hsappstatic.net	app.hubspot.com static.hsappstatic.net
5	s.adroll.com	1 redirects blog.cyble.com s.adroll.com
4	forms.hsforms.com	js.hsforms.net blog.cyble.com
3	app.hubspot.com	js.usemessages.com static.hsappstatic.net
3	js.hsforms.net	blog.cyble.com js.hsforms.net
2	px.ads.linkedin.com	2 redirects
2	forms.hubspot.com	js.hscollectedforms.net js.hsleadflows.net
2	api.hubspot.com	js.usemessages.com
2	pixel.wp.com	blog.cyble.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	fonts.wp.com	fonts-api.wp.com
2	www.googletagmanager.com	blog.cyble.com www.googletagmanager.com
2	fonts-api.wp.com	blog.cyble.com
1	www.gstatic.com	www.google.com
1	www.google.com	js.hsleadflows.net
1	labs.cyble.com	blog.cyble.com
1	px4.ads.linkedin.com	blog.cyble.com
1	www.linkedin.com	1 redirects
1	cdn.linkedin.oribi.io	snap.licdn.com
1	snap.licdn.com	js.hsadspixel.net
1	api.hubapi.com	js.hsadspixel.net
1	forms-na1.hsforms.com	blog.cyble.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	js.usemessages.com	js.hs-scripts.com
1	js.hsleadflows.net	js.hs-scripts.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hsadspixel.net	js.hs-scripts.com
1	js.hscollectedforms.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	region1.google-analytics.com	www.googletagmanager.com
1	d.adroll.com	s.adroll.com
1	stats.wp.com	blog.cyble.com
1	js.hs-scripts.com	blog.cyble.com
1	s0.wp.com	blog.cyble.com
103	38

This site contains links to these domains. Also see Links.

Domain
cyble.com
thecyberexpress.com
attack.mitre.org
www.cyble.com
twitter.com
www.linkedin.com

Subject Issuer	Validity	Valid
tls.automattic.com R3	`2023-01-21` - `2023-04-21`	3 months	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-14` - `2023-12-15`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-15` - `2023-06-15`	a year	crt.sh
s.adroll.com Amazon	`2022-07-03` - `2023-08-01`	a year	crt.sh
d.adroll.com Amazon RSA 2048 M01	`2022-11-08` - `2023-12-07`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2022-03-08` - `2023-03-07`	a year	crt.sh
hubapi.com Cloudflare Inc ECC CA-3	`2022-05-07` - `2023-05-07`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
linkedin.oribi.io Amazon	`2022-07-07` - `2023-08-06`	a year	crt.sh
hsappstatic.net Cloudflare Inc ECC CA-3	`2022-05-10` - `2023-05-10`	a year	crt.sh
labs.cyble.com Cloudflare Inc ECC CA-3	`2022-07-18` - `2023-07-17`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
Frame ID: 0D3C85755658AF1D391042417FEDC8DB
Requests: 84 HTTP requests in this frame

Frame: https://js.hsforms.net/forms/v2.js
Frame ID: 6595FDE9DD513B6B6F7E52163C0E116B
Requests: 1 HTTP requests in this frame

Frame: https://js.hsforms.net/forms/v2.js
Frame ID: D8760D2446875F073E2918DC1DFDF8AA
Requests: 1 HTTP requests in this frame

Frame: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/8c157e92638742c880b891af5f9f3db3?uuid=a9e1a092500146b599822eb5ea599eca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=8c157e92638742c880b891af5f9f3db3&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Frame ID: 05EC3229A79CF9A26D01EE99A3C6527F
Requests: 9 HTTP requests in this frame

Frame: https://injection.amibreached.com/stats.json
Frame ID: 53A51A5F40221C2E8938338246981F40
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Cyble — Vector Stealer: A Gateway for RDP Hijacking

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+s\d+\.wp\.com
/wp-(?:content|includes)/

AdRoll (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

(?:a|s)\.adroll\.com

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

103
Requests

98 %
HTTPS

84 %
IPv6

24
Domains

38
Subdomains

31
IPs

4
Countries

2876 kB
Transfer

9282 kB
Size

23
Cookies

26 Outgoing links

These are links going to different origins than the main page.

URL: https://cyble.com/
Title: Home

Search URL Search Domain Scan URL

URL: https://cyble.com/about-us.php
Title: About Us

Search URL Search Domain Scan URL

URL: https://cyble.com/capabilities.php
Title: Capabilities

Search URL Search Domain Scan URL

URL: https://cyble.com/cyble-vision.php
Title: Cyble Vision

Search URL Search Domain Scan URL

URL: https://cyble.com/amibreached.php
Title: AmiBreached

Search URL Search Domain Scan URL

URL: https://cyble.com/cyble-hawk.php
Title: Cyble Hawk

Search URL Search Domain Scan URL

URL: https://thecyberexpress.com/
Title: The Cyber Express

Search URL Search Domain Scan URL

URL: https://cyble.com/press.php
Title: Media & Press Releases

Search URL Search Domain Scan URL

URL: https://cyble.com/career.php
Title: Careers

Search URL Search Domain Scan URL

URL: https://cyble.com/contact-us.php
Title: Request Demo

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1566/
Title: T1566

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1204/
Title: T1204

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1555/
Title: T1555

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1539/
Title: T1539

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1552/
Title: T1552

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1087/
Title: T1087

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1518/
Title: T1518

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1057/
Title: T1057

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1124/
Title: T1124

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1007/
Title: T1007

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1614/
Title: T1614

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1071/
Title: T1071

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1041/
Title: T1041

Search URL Search Domain Scan URL

URL: https://www.cyble.com/
Title: www.cyble.com

Search URL Search Domain Scan URL

URL: https://twitter.com/aucyble
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/cyble-global/
Title: Linkedin

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 34

https://s.adroll.com/j/exp/ELNAF2EZDFHJRAP3ODLCUU/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 76

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1675438777182&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4053396%26time%3D1675438777182%26url%3Dhttps%253A%252F%252Fblog.cyble.com%252F2023%252F02%252F01%252Fvector-stealer-a-gateway-for-rdp-hijacking%252F%253Futm_content%253D236585065%2526amp%253Butm_medium%253Dsocial%2526amp%253Butm_source%253Dtwitter%2526amp%253Bhss_channel%253Dtw-1141929006603866117%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1675438777182&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1675438777182&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&liSync=true&e_ipv6=AQK33LWf3rq2ZwAAAYYX7uVIp4yuBrScA83ddo3SGc_n4AF38wyLx33AMs01k6Qap0tCHE7R

103 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/ 342 KB
69 KB 1781ms
1750ms Document
text/html 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

97aacc23e98a5c2edc61d17068c903d829cbe8144c8e86517164d4895d66b768

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cf-edge-cache: cache,platform=wordpress
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 03 Feb 2023 15:39:35 GMT
host-header: WordPress.com
link: <https://blog.cyble.com/wp-json/>; rel="https://api.w.org/" <https://blog.cyble.com/wp-json/wp/v2/posts/15501>; rel="alternate"; type="application/json" <https://wp.me/pbX1h1-421>; rel=shortlink
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding Cookie
x-ac: 2.hhn _atomic_ams BYPASS
x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
x-pingback: https://blog.cyble.com/xmlrpc.php

GET
H2 200 /
blog.cyble.com/_static/ 2 MB
204 KB 232ms
229ms Stylesheet
text/css 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/_static/??-eJylVO1SgzAQfCFjCkg/fjg+S0iueDbkmHwM07f3QKp0aqroH+CS3c1mc2HohSYXwUUZX6GDIFWIXvEzQAxShyA7dHhEMPLoJ6R55JFHnnkYvsi9TS26INvEZQO+lU1Ca2RjSZ+ExcYrf5Yhni3kqFadKUXRejTXQHTaJsPW3tgMGFRg2Skzl0XPdPDCQqv0eekwy+a5Zf33XWnLaaHOkQfypvcQgghRxSA65VTLVntPU753Q3kFZRh7JIr8mq2SX55PBpJTvNHgbUhAhn3Ifc6LaexeLN/audclqbekzJI4MnoKUdS7zf7HdabMfrnWhZxsxE5FuA2PSWJUSdwC4o+2D2VRrD077kg5oGnZg7jaRUbnDWKv9El2ZJKF8cBOkGmbi9PpEgtlDLnlt9hW+rDfadB12ZS1qMrdU1lVmxUb3leHeg38aVOtgW83N+q5GOYIZSCNyn5061WRE9JEJwThKKKGrz5a1enjpTkySKgBAnWzDA/M9f/F+N/izLrr961OIIt3L8gl1xE8f4/Ql+652O7qgg+82L8Dv8RVRQ==

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

58cc3b65706bfd08a91d79d29efd7deeb284716dd9dde2123c32bf20aac754f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date: Fri, 03 Feb 2023 15:39:35 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 31 Jan 2023 16:51:58 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
x-page-optimize: uncached
etag: W/"7a59d1797653b4cfa7a04fa75b6b2111"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
host-header: WordPress.com

GET
H2 200 css
fonts-api.wp.com/ 3 KB
1002 B 54ms
25ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts-api.wp.com/css?family=Open+Sans%3A400%2C&display=fallback&ver=4.0.2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

0f12c37bfbe94e5c37d4c4a0ab301f496683db922639b0e43f2b9977492fe57b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:35 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: gzip
cross-origin-resource-policy: cross-origin
x-xss-protection: 0
x-nc: BYPASS hhn 2
last-modified: Fri, 03 Feb 2023 15:16:21 GMT
server: nginx
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin

GET
H2 200 css
fonts-api.wp.com/ 72 KB
2 KB 66ms
36ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts-api.wp.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.1.1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

53c192dc46187ef72bb5623c417ad7e6a7cbf2c2ca98f58647704c78b0fb0579

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:35 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: gzip
cross-origin-resource-policy: cross-origin
x-xss-protection: 0
x-nc: BYPASS hhn 2
last-modified: Fri, 03 Feb 2023 15:39:35 GMT
server: nginx
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin

GET
H2 200 videopress-token-bridge.js Show response
blog.cyble.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-videopress/build/lib/ 878 B
545 B 172ms
170ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-videopress/build/lib/videopress-token-bridge.js?ver=0.10.8

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

2616becd1fa25433adee513644da53245e542892264edc46b611ebc3c9e2d9ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:35 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 14 Nov 2022 21:17:26 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"6372b066-36e"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.min.js Show response
blog.cyble.com/wp-includes/js/jquery/ 88 KB
31 KB 180ms
178ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:35 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 19 Sep 2022 14:16:24 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"632879b8-15e54"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 / Show response
blog.cyble.com/_static/ 20 KB
6 KB 178ms
176ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/_static/??-eJx1jcEKwkAMRH/ItCjF4kH8lLJs45K1m6xJluLf20qvwsBc5r1ZKxDHpc1ofd7ybqifo6BQ0uDYFeIu22mtEIUd2fu6tERs/So6V0UzMA9uUAKHhApVZdfFZi5leuqGTdn+SKLIixBYnCLu2G9/vD7K/Xwdh+E2DuPlCwxjQVU=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

82dbeea789c21359a9d808969f52d40a37ac85078a6cd1cbee0e702314c46997

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date: Fri, 03 Feb 2023 15:39:35 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 23 Jan 2023 18:11:12 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
x-page-optimize: uncached
etag: W/"9a121e33c9fcb9609f70d3536458e3a7"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
host-header: WordPress.com

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 110 KB
43 KB 196ms
75ms Script
application/javascript 2a00:1450:400d:803::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-201575643-1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:803::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

49fc1f989eb551498525c12acfec4533c2e0c484f8a80d49cf95d16092db836a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43887
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 15:39:36 GMT

GET
H2 200 Cyble-CIRIL-pyyv4ww1nowvginyhq7nrmlg0x8pxv1qcifo3udnvq.png
blog.cyble.com/wp-content/uploads/elementor/thumbs/ 4 KB
5 KB 178ms
170ms Image
image/png 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.cyble.com/wp-content/uploads/elementor/thumbs/Cyble-CIRIL-pyyv4ww1nowvginyhq7nrmlg0x8pxv1qcifo3udnvq.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ef896b86a77ae191af41c2714906decbab4bbb7fd32321c14f4f398eb7f264ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
x-ac: 2.hhn _atomic_ams BYPASS
last-modified: Sat, 10 Dec 2022 19:16:39 GMT
server: nginx
etag: "6394db17-11bc"
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
content-length: 4540
expires: Fri, 10 Feb 2023 15:39:36 GMT

GET
H2 200 subscribe-to-CRIL.jpg
i0.wp.com/blog.cyble.com/wp-content/uploads/2021/11/ 16 KB
16 KB 43ms
13ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/blog.cyble.com/wp-content/uploads/2021/11/subscribe-to-CRIL.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

382e9768b5578d5ad05e51e37670a3cf93d4593a49bcbee1f5e8b66d0d8c1c53

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc: HIT hhn 3
date: Fri, 03 Feb 2023 15:39:35 GMT
x-content-type-options: nosniff
last-modified: Sat, 10 Dec 2022 20:48:17 GMT
server: nginx
etag: "90f4a9863ca68d73"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://blog.cyble.com/wp-content/uploads/2021/11/subscribe-to-CRIL.jpg>; rel="canonical"
content-length: 16232
expires: Tue, 10 Dec 2024 08:48:17 GMT

GET
H2 200 v2.js Show response
js.hsforms.net/forms/ 505 KB
159 KB 151ms
38ms Script
application/javascript 2606:4700::6811:b949
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsforms.net/forms/v2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:b949 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5736f20e2a413433b3af338e6cccd1318197981ce66e68ac810e723ccbf9c10c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:35 GMT
x-amz-version-id: JAvvLYrbAadG1K4h0HWbN.C2V4PipDw0
via: 1.1 4715507645a6516d2df35cd342cb5be0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
age: 478
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=forms-embed/static-1.2642/bundles/project-v2.js&cfRay=793c36ed1f6d30c3-FRA
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
content-encoding: br
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 03 Feb 2023 10:10:35 UTC
server: cloudflare
etag: W/"bc37deecb11dd26ba785db0381926c28"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ekU%2Bx8y7WA14vsA61gaErqhaqq9J9NkIthxwPkeg%2Fnt75%2F5MWV9LlnhFadwNwW7%2B7lDwKKVMESJuX6pzrGizgAUidnvQ9aAaaxuXkxOWsDoVHm%2Frimdz1RKDA6aSzVavFfdbyxhjhC17p2PQ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
cf-ray: 793c429b9dff9220-FRA
x-amz-cf-id: HQIVvRQEFB6lLk1SJeCJIIHotKi-DDjdwpMu9N91ROGLVGGMfh5g4w==
x-hs-target-asset: forms-embed/static-1.2642/bundles/project-v2.js

GET
H2 200 aib-injectable.js Show response
injection.amibreached.com/ 2 KB
1 KB 175ms
102ms Script
application/javascript 2606:4700:20::681a:d31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://injection.amibreached.com/aib-injectable.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:d31 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

186cb05caa2a06748336b3123d7ac53986a650cffcab18f34e5c0ee3c057f591

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:35 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
via: 1.1 74c5b19a4695b76162adbf07ed9ef370.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
age: 387
x-amz-cf-pop: FRA60-P3
content-encoding: br
x-cache: Hit from cloudfront
last-modified: Mon, 23 May 2022 20:31:50 GMT
server: cloudflare
etag: W/"662ed2e07a2c9b151332e0a8da3b9922"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZSdYSe47o%2FLV%2Bpdfrs402HD6Nhf30dcimJuPdwz9Be7doFm%2Bnw7n3g08C%2FTHzVr0KJoh3oaAyXP7pSR3UIB2KrCnuaOtZy7EYuEWU95NLmH%2FrfdFcGgibdpKL0g%2BYYdMWYjoMxh7IQkT0T0Vx4rJ%2FnhJIdMMIo8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=120
cf-ray: 793c429c8c978ffe-FRA
x-amz-cf-id: 7UqP6rxa3SwUtmNPuzlhJK8caWyPe5k3GZlixhC-_DRpCrzlSQSCMg==

GET
H2 200 Cyble-Black-Logo-pgc6refcqrafz6dvgr4i3sq3uvztw8xaslgdchelt6.png
blog.cyble.com/wp-content/uploads/elementor/thumbs/ 3 KB
3 KB 181ms
174ms Image
image/png 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.cyble.com/wp-content/uploads/elementor/thumbs/Cyble-Black-Logo-pgc6refcqrafz6dvgr4i3sq3uvztw8xaslgdchelt6.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

05096f7a0e9de1566ba03be810da6d252f233a7c999021d5f2f3aa975e92ab0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
x-ac: 2.hhn _atomic_ams BYPASS
last-modified: Sat, 10 Dec 2022 19:08:28 GMT
server: nginx
etag: "6394d92c-c9d"
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
content-length: 3229
expires: Fri, 10 Feb 2023 15:39:36 GMT

GET
H2 200 bilmur.min.js Show response
s0.wp.com/wp-content/js/ 7 KB
3 KB 21ms
6ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/js/bilmur.min.js?m=202305
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 51dc1ea3b9642d966bbdf2c63346e4d2d3f668a693fa8e7f1e31bf6acbe48860

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Fri, 03 Feb 2023 15:39:35 GMT
content-encoding: br
x-ac: 2.hhn _dfw MISS
server: nginx
etag: W/"63bbf1d2-1a69"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Tue, 30 Jan 2024 00:00:01 GMT

GET
H2 200 /
blog.cyble.com/_static/ 38 KB
8 KB 176ms
176ms Stylesheet
text/css 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/_static/??-eJyVjMsOwiAQRX9IOqmJlY3xWyi9NugwEAbC7xcTXblyee7j9Gx8kgqplLntQZTAiINTIaeKqsRhpccYGdehKYK8KhXsjV2ZYpBp8Kn/ip6o2fkXxbQ1hpJ3JTUFk/aQUczaZGP8/f4U5hu8Bfd4m5freb5Yu9gDLeFQRA==

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1e6ebf687f918671709224ad3047910b592542de487e4a38209f42d58b0062a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 27 Dec 2022 16:34:28 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
x-page-optimize: uncached
etag: W/"35b150a0a020bb35697e5bd7022fc4d7"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
host-header: WordPress.com

GET
H2 200 / Show response
blog.cyble.com/_static/ 22 KB
6 KB 174ms
174ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/_static/??-eJxdjV0KwjAQhC9kugSq9kU8isRkYxPzR3ZD8fYmUhD6MgMz++1sReicGBNDCe3lEoFHLkq/IWbTAhKMXmkWNtcInmC4IP70bvJ02v4feMXYAUVcVVdCpgFEl5x1aMDW36GZenJAj+MPlzQ8mwsGypo5p9129B5v8nKd5Vkuy/wFCrJJTg==

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

4acadd6be157476c80a0d0ce659b0a8033c2253f689cc84aa11a3597cea382ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Thu, 19 Jan 2023 18:11:24 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
x-page-optimize: uncached
etag: W/"361dba76d983ecc5cb3262baee441f6e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
host-header: WordPress.com

GET
H2 200 21289959.js Show response
js.hs-scripts.com/ 3 KB
998 B 413ms
380ms Script
application/javascript 2606:4700::6811:d4cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.19
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:d4cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f07f7cbfb75dd384727772e9d8cde9f24e4de5d07bdcc54c3f3457600b4b2924

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Fri, 03 Feb 2023 15:29:26 GMT
server: cloudflare
x-hubspot-correlation-id: 015cdf68-699c-4fc1-b83e-46b4d9ac1441
x-trace: 2BC11ACABAB92C593BCC1ECCE0A1739B4AF18D5AAE000000000000000000
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://blog.cyble.com
cache-control: public, max-age=60
access-control-allow-credentials: true
cf-ray: 793c429dfa442bc9-FRA
expires: Fri, 03 Feb 2023 15:40:36 GMT

GET
H2 200 / Show response
blog.cyble.com/_static/ 293 KB
78 KB 192ms
184ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/_static/??-eJytU1lywjAMvVCNgaQsH50ehXFiEQyOlVo2FE5fZYPMFEKH6U8cS/JbLPlUiRxdABdkrCwqTVJR8EoordEN/8UiyderZQ6QpqtkLtLpep7Mk/VkT2+nG0plY2EcyT2ESuWHft0cwWn0UsWApQrB5H1GWHU5C1OqAkhqQ0EaRvIEeTDMihmBP4L/f5pB4AH4DpQGL7aILEiAhZKzjG4cw5Lc+qZePzh9rReVR75JgkDSmkxSqXzgVGT5XxH8eXKLTErjnljd1PRZNFbLXHmMBPZqsg8MYLjaRs2mWXHrtm4z6BGmaANXBhhYHsq3hlU035cxDGHACvr1JRw+I9hTVGBFhRTG7m5cTduFPic8kLlAF920uxHsu31mYSfImp5wdOKjYwF/QvmN8OLpfjxFiTpaoAcz0byF7tl4KMCBV7WZ56RF5G0GvuimsQXhKWOIwC2x562xj0ZxSMupO9XP6HaIh5pMw3d36rP8mC2W79P5Kp0tfgBi4toQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

39e5a17105d5cd2a65e6d1a7b6a65afec887c339c3626016ed33265db4206be0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Sun, 29 Jan 2023 21:40:16 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
x-page-optimize: uncached
etag: W/"d69411eab168a415e2cb3a651eed08b8"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
host-header: WordPress.com

GET
H2 200 index.min.js Show response
blog.cyble.com/wp-content/plugins/gutenberg/build/i18n/ 10 KB
4 KB 180ms
171ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/gutenberg/build/i18n/index.min.js?ver=3d2aeabd3f84698c0e2c

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

81ca0d70f50ab00f0c1e0933c11bf7bb6aada2366994784564f4d324dfd7a60c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 07 Dec 2022 20:54:04 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"6390fd6c-26bc"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 frontend.min.js Show response
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/ 21 KB
6 KB 181ms
173ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.10.3

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1f1cb60892b45c8e44a0f4222e01af33655dfb7c0e81dd8d937c6d44c38bb632

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Sun, 29 Jan 2023 21:40:15 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"63d6e7bf-543c"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 / Show response
blog.cyble.com/_static/ 33 KB
10 KB 185ms
176ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/_static/??wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js,wp-includes/js/jquery/ui/core.min.js?m=1671645681

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

984d8a00a23b717ad2d084139b7a0880fb888e7c9030a11f5e3bfde3670ffa68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 21 Dec 2022 18:01:21 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
x-page-optimize: uncached
etag: W/"9cb3e1480a9e0fd65c0c8636bb9812ac"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
host-header: WordPress.com

GET
H2 200 frontend.min.js Show response
blog.cyble.com/wp-content/plugins/elementor/assets/js/ 40 KB
12 KB 181ms
173ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.9.2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

a9c399a3695f864f52665163ff94626e3b77b44747e1519b03e5f82597b004d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 21 Dec 2022 18:01:21 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"63a349f1-9ef8"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 elements-handlers.min.js Show response
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/ 27 KB
7 KB 336ms
328ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.10.3

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f8392cf8d00ac45d817b2b02ee0bd33f1bcb59fd135568e3fb5df5ca3042101e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Sun, 29 Jan 2023 21:40:15 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"63d6e7bf-6b45"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.sticky.min.js Show response
blog.cyble.com/wp-content/plugins/elementor-pro/assets/lib/sticky/ 4 KB
2 KB 180ms
172ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?m=1675028416

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

34bbd1c367ffc7d80fcff86c7e5f8777e70f4911bb324e8ecfc7dd3604a96e68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Sun, 29 Jan 2023 21:40:16 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"63d6e7c0-e89"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 e-202305.js Show response
stats.wp.com/ 9 KB
3 KB 48ms
7ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202305.js
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc: HIT hhn
date: Fri, 03 Feb 2023 15:39:36 GMT
content-encoding: br
server: nginx
etag: W/"6197c5cf-3508"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Wed, 24 Jan 2024 16:35:32 GMT

GET
H2 200 wp-emoji-release.min.js Show response
blog.cyble.com/wp-includes/js/ 18 KB
5 KB 178ms
171ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-includes/js/wp-emoji-release.min.js?ver=6.1.1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 12 Apr 2022 05:56:23 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"62551487-48b9"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wsm_new.js Show response
blog.cyble.com/wp-content/plugins/wordpress-stats-manager-pro/js/ 23 KB
9 KB 180ms
174ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/wordpress-stats-manager-pro/js/wsm_new.js?v=1.1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

7883c3cfb3f71df2ec3c0574dd83d0b6849a12248b6b9142ea99752636310a47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 21 Nov 2022 18:11:49 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"637bbf65-5d2e"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/ 75 KB
23 KB 96ms
29ms Script
text/javascript 2600:9000:211a:2600:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/roundtrip.js
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211a:2600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ee3d3fafc874740d773a711482d0ace893f213475c290a38c3c1054e120c0020

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

X-Amz-Version-Id: 1XgXK9TfyVWjo6In5YKsJu_QkT9kfJxC
Content-Encoding: gzip
Via: 1.1 61bfa9dc3dc260c1f6ca617cfc7e065a.cloudfront.net (CloudFront)
Date: Fri, 03 Feb 2023 14:46:51 GMT
Age: 3166
X-Amz-Cf-Pop: VIE50-C2
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Fri, 03 Feb 2023 02:14:27 GMT
Server: AmazonS3
Etag: W/"b44dbc9dd18e7c3043034619736ace22"
Vary: Accept-Encoding
Access-Control-Max-Age: 600
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: -_AaS_zOQSOCZjD77EULi2whERD9hPSKtajiLvsyL_4bDyVn1qgmcQ==

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.wp.com/s/opensans/v34/ 44 KB
44 KB 36ms
6ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.1.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://blog.cyble.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Fri, 03 Feb 2023 15:39:36 GMT
x-content-type-options: nosniff
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: nginx
age: 193712
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 44856
x-xss-protection: 0

GET
H2 200 fa-solid-900.woff2
blog.cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/ 76 KB
77 KB 182ms
180ms Font
application/font-woff2 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-solid-900.woff2

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJylVO1SgzAQfCFjCkg/fjg+S0iueDbkmHwM07f3QKp0aqroH+CS3c1mc2HohSYXwUUZX6GDIFWIXvEzQAxShyA7dHhEMPLoJ6R55JFHnnkYvsi9TS26INvEZQO+lU1Ca2RjSZ+ExcYrf5Yhni3kqFadKUXRejTXQHTaJsPW3tgMGFRg2Skzl0XPdPDCQqv0eekwy+a5Zf33XWnLaaHOkQfypvcQgghRxSA65VTLVntPU753Q3kFZRh7JIr8mq2SX55PBpJTvNHgbUhAhn3Ifc6LaexeLN/audclqbekzJI4MnoKUdS7zf7HdabMfrnWhZxsxE5FuA2PSWJUSdwC4o+2D2VRrD077kg5oGnZg7jaRUbnDWKv9El2ZJKF8cBOkGmbi9PpEgtlDLnlt9hW+rDfadB12ZS1qMrdU1lVmxUb3leHeg38aVOtgW83N+q5GOYIZSCNyn5061WRE9JEJwThKKKGrz5a1enjpTkySKgBAnWzDA/M9f/F+N/izLrr961OIIt3L8gl1xE8f4/Ql+652O7qgg+82L8Dv8RVRQ==

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://blog.cyble.com/_static/??-eJylVO1SgzAQfCFjCkg/fjg+S0iueDbkmHwM07f3QKp0aqroH+CS3c1mc2HohSYXwUUZX6GDIFWIXvEzQAxShyA7dHhEMPLoJ6R55JFHnnkYvsi9TS26INvEZQO+lU1Ca2RjSZ+ExcYrf5Yhni3kqFadKUXRejTXQHTaJsPW3tgMGFRg2Skzl0XPdPDCQqv0eekwy+a5Zf33XWnLaaHOkQfypvcQgghRxSA65VTLVntPU753Q3kFZRh7JIr8mq2SX55PBpJTvNHgbUhAhn3Ifc6LaexeLN/audclqbekzJI4MnoKUdS7zf7HdabMfrnWhZxsxE5FuA2PSWJUSdwC4o+2D2VRrD077kg5oGnZg7jaRUbnDWKv9El2ZJKF8cBOkGmbi9PpEgtlDLnlt9hW+rDfadB12ZS1qMrdU1lVmxUb3leHeg38aVOtgW83N+q5GOYIZSCNyn5061WRE9JEJwThKKKGrz5a1enjpTkySKgBAnWzDA/M9f/F+N/izLrr961OIIt3L8gl1xE8f4/Ql+652O7qgg+82L8Dv8RVRQ==
Origin: https://blog.cyble.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
x-ac: 2.hhn _atomic_ams BYPASS
last-modified: Wed, 21 Dec 2022 18:01:21 GMT
server: nginx
etag: "63a349f1-13174"
access-control-allow-methods: GET, HEAD
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
content-length: 78196
expires: Fri, 10 Feb 2023 15:39:36 GMT

GET
H2 200 fa-brands-400.woff2
blog.cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/ 75 KB
75 KB 240ms
239ms Font
application/font-woff2 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-brands-400.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://blog.cyble.com/_static/??-eJylVO1SgzAQfCFjCkg/fjg+S0iueDbkmHwM07f3QKp0aqroH+CS3c1mc2HohSYXwUUZX6GDIFWIXvEzQAxShyA7dHhEMPLoJ6R55JFHnnkYvsi9TS26INvEZQO+lU1Ca2RjSZ+ExcYrf5Yhni3kqFadKUXRejTXQHTaJsPW3tgMGFRg2Skzl0XPdPDCQqv0eekwy+a5Zf33XWnLaaHOkQfypvcQgghRxSA65VTLVntPU753Q3kFZRh7JIr8mq2SX55PBpJTvNHgbUhAhn3Ifc6LaexeLN/audclqbekzJI4MnoKUdS7zf7HdabMfrnWhZxsxE5FuA2PSWJUSdwC4o+2D2VRrD077kg5oGnZg7jaRUbnDWKv9El2ZJKF8cBOkGmbi9PpEgtlDLnlt9hW+rDfadB12ZS1qMrdU1lVmxUb3leHeg38aVOtgW83N+q5GOYIZSCNyn5061WRE9JEJwThKKKGrz5a1enjpTkySKgBAnWzDA/M9f/F+N/izLrr961OIIt3L8gl1xE8f4/Ql+652O7qgg+82L8Dv8RVRQ==
Origin: https://blog.cyble.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
x-ac: 2.hhn _atomic_ams BYPASS
last-modified: Wed, 21 Dec 2022 18:01:21 GMT
server: nginx
etag: "63a349f1-12bdc"
access-control-allow-methods: GET, HEAD
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
content-length: 76764
expires: Fri, 10 Feb 2023 15:39:36 GMT

GET
H2 200 json Show response
forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/ 37 KB
6 KB 178ms
146ms XHR
application/json 2606:4700::6810:5905
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/json?hs_static_app=forms-embed&hs_static_app_version=1.2642&X-HubSpot-Static-App-Info=forms-embed-1.2642

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5905 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0c28929bac6b6d68ff853ec4982611efbb6281133ff3af6098c223704912f79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/json, text/plain, */*
Referer: https://blog.cyble.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-origin-hublet: na1
date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
x-hubspot-correlation-id: e16a436b-bf09-4261-a024-2dfa7c37021c
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
x-trace: 2B872FA26F4EA604EDC5BD6BE42D4A0F0C46E6A14D000000000000000000
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://blog.cyble.com
access-control-expose-headers: X-Origin-Hublet
access-control-max-age: 180
access-control-allow-credentials: false
cache-control: max-age=0, no-cache, no-store
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 793c429e9df79268-FRA

GET
H2 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.wp.com/s/opensans/v34/ 47 KB
47 KB 6ms
6ms Font
font/woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.wp.com/s/opensans/v34/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts-api.wp.com/
Origin: https://blog.cyble.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Fri, 03 Feb 2023 15:39:36 GMT
x-content-type-options: nosniff
last-modified: Mon, 15 Aug 2022 18:22:41 GMT
server: nginx
age: 10225
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 47952
x-xss-protection: 0

GET
H2 200 json Show response
forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/ 37 KB
6 KB 150ms
150ms XHR
application/json 2606:4700::6810:5905
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/json?hs_static_app=forms-embed&hs_static_app_version=1.2642&X-HubSpot-Static-App-Info=forms-embed-1.2642

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5905 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

28f2395d87ba8c5346a6eab7e24a9a0fc211cf4fd12f7cd2436a5d39bac4ae24

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/json, text/plain, */*
Referer: https://blog.cyble.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-origin-hublet: na1
date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
x-hubspot-correlation-id: 2d4446bd-31eb-416b-a3a2-03822f7f0a1f
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
x-trace: 2B8CAD4D296C5E10B82D1E0CB38785C19E7F5B10E2000000000000000000
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://blog.cyble.com
access-control-expose-headers: X-Origin-Hublet
access-control-max-age: 180
access-control-allow-credentials: false
cache-control: max-age=0, no-cache, no-store
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 793c429ebe149268-FRA

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/ELNAF2EZDFHJRAP3ODLCUU/index.js
https://s.adroll.com/j/exp/index.js

28 B
785 B

21ms
21ms

Script
application/javascript

2600:9000:211a:2600:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
Protocol: HTTP/1.1
Server: 2600:9000:211a:2600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

X-Amz-Version-Id: CiD7z5Qr2ECIL.Zbw84rFXTGVfvZ9kAA
Date: Fri, 03 Feb 2023 02:35:03 GMT
Via: 1.1 61bfa9dc3dc260c1f6ca617cfc7e065a.cloudfront.net (CloudFront)
Age: 47234
X-Amz-Cf-Pop: VIE50-C2
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 28
Last-Modified: Thu, 01 Dec 2022 00:29:34 GMT
Server: AmazonS3
Etag: "5816cced8568d223aa09d889f300692b"
Vary: Accept-Encoding
Access-Control-Max-Age: 600
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: FVxdIERFRZSqCwqwOTe-1NaQxnv8q8w_W1uk9cWyp5e52ZAF9t8i1w==

Redirect headers

Date: Fri, 03 Feb 2023 04:00:40 GMT
Via: 1.1 61bfa9dc3dc260c1f6ca617cfc7e065a.cloudfront.net (CloudFront)
Age: 41935
X-Amz-Cf-Pop: VIE50-C2
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Server: AmazonS3
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: wnye2uBKWdOLuekBPaER3m2_l1LkN9DtkXgC_S8-aspuNy09czcvHA==

GET
H2 200 /
blog.cyble.com/ 0
80 B 862ms
862ms Image
text/html 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.cyble.com/?wmcAction=wmcTrack&action_name=Cyble%20%E2%80%94%20Vector%20Stealer%3A%20A%20Gateway%20for%20RDP%20Hijacking&siteId=1&rec=1&rand=962077&h=15&m=39&s=36&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&uid=0&pid=15501&visitorId=0bff7bac0033b1d6&fvts=1675438776&vc=1&idn=0&refts=0&lvts=1675438776&fullRef=&send_image=1&pdf=1&qt=0&rp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gtms=1765&pvId=tGxUYt&browser=Chrome_109&os=Windows_10&device=Desktop

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

cf-edge-cache: cache,platform=wordpress
x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date: Fri, 03 Feb 2023 15:39:37 GMT
strict-transport-security: max-age=31536000
content-encoding: br
x-ac: 2.hhn _atomic_ams BYPASS
server: nginx
vary: Accept-Encoding, Cookie
content-type: text/html; charset=utf-8
host-header: WordPress.com

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 162ms
46ms Script
text/javascript 2a00:1450:400d:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-201575643-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 03 Feb 2023 15:12:10 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 1646
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Fri, 03 Feb 2023 17:12:10 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
66 KB 80ms
80ms Script
application/javascript 2a00:1450:400d:803::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-4FJGSRPM4S&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-201575643-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:803::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

70a02077b52f46333bcb6c385a653e78da10ae69814c1df35bf4ee343efcc928

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 67194
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 03 Feb 2023 15:39:36 GMT

GET
H2 200 ELNAF2EZDFHJRAP3ODLCUU Show response
d.adroll.com/consent/check/ 453 B
546 B 121ms
30ms Script
application/javascript 2a05:d018:cc3:fe04:7036:b4fb:4707:a1df
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/ELNAF2EZDFHJRAP3ODLCUU?pv=90782410026.66212&arrfrr=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&_s=4a7a00e612d5d63bbe30fc669bd1333d&_b=2
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/roundtrip.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d018:cc3:fe04:7036:b4fb:4707:a1df Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: cc3d9b48ade62658f38947ea0f07656bfb10ffa92277d9f1cd23666c2e669f1b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
server: nginx/1.22.1
content-length: 453
content-type: application/javascript

GET
H2 200 g.gif
pixel.wp.com/ 50 B
93 B 26ms
6ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=176605947&post=15501&tz=-5&srv=blog.cyble.com&hp=atomic&ac=2&amp=0&j=1%3A11.8-beta&host=blog.cyble.com&ref=&fcp=2545&rand=0.8882360264523264
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 03 Feb 2023 15:39:36 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 v2.js Show response
js.hsforms.net/forms/ Frame 6595 505 KB
158 KB 36ms
35ms Script
application/javascript 2606:4700::6811:b949
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsforms.net/forms/v2.js

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:b949 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5736f20e2a413433b3af338e6cccd1318197981ce66e68ac810e723ccbf9c10c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
x-amz-version-id: JAvvLYrbAadG1K4h0HWbN.C2V4PipDw0
via: 1.1 4715507645a6516d2df35cd342cb5be0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
age: 479
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=forms-embed/static-1.2642/bundles/project-v2.js&cfRay=793c36ed1f6d30c3-FRA
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
content-encoding: br
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 03 Feb 2023 10:10:35 UTC
server: cloudflare
etag: W/"bc37deecb11dd26ba785db0381926c28"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mhXYxypwO0AFfDx%2BI3%2F%2FlCN%2FZ1v7Gcijl0uW7nfbWy%2FoTv%2Fi2Z1mk7HfVXMLKuOGsuIJgwzgfPOixv3SpK34N%2FUST6TAfH1byYW1g9IZ4PIyAzQ1nwHN%2B52rqayhmKZkGVdskim%2BD2AeQrpc"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
cf-ray: 793c42a06a879220-FRA
x-amz-cf-id: HQIVvRQEFB6lLk1SJeCJIIHotKi-DDjdwpMu9N91ROGLVGGMfh5g4w==
x-hs-target-asset: forms-embed/static-1.2642/bundles/project-v2.js

GET
H3 200 v2.js Show response
js.hsforms.net/forms/ Frame D876 505 KB
159 KB 16ms
16ms Script
application/javascript 2606:4700::6811:b949
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsforms.net/forms/v2.js

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:b949 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5736f20e2a413433b3af338e6cccd1318197981ce66e68ac810e723ccbf9c10c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
x-amz-version-id: JAvvLYrbAadG1K4h0HWbN.C2V4PipDw0
via: 1.1 76e55a2361219fb19722e949475d1844.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
age: 30
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=forms-embed/static-1.2642/bundles/project-v2.js&cfRay=793c41e48da99bf5-IAD
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
content-encoding: br
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 03 Feb 2023 10:10:35 UTC
server: cloudflare
etag: W/"bc37deecb11dd26ba785db0381926c28"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eWhhwj5M0fXQSZar8B9jKgn24aC9nb1TYILANlvaUxLTB8uWErBS7UPHIdJOLJkb6JMNM3T2kiOZNC%2FIspBtUiCzNRRP1AWes%2FuZjM%2FZTgAZw1ytECjya%2Bc1Jj3G01OLzFaOhy9jWtsXpbLN"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
cf-ray: 793c42a07c1a9b61-FRA
x-amz-cf-id: lVV5n1l2NNTTBfyFYGtztePmOmwnoc8RXPoySwbSVQtJqOALLV3hQQ==
x-hs-target-asset: forms-embed/static-1.2642/bundles/project-v2.js

GET
H2 200 nav-menu.c8d112707fd7172d2a9d.bundle.min.js Show response
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/ 4 KB
2 KB 172ms
171ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/nav-menu.c8d112707fd7172d2a9d.bundle.min.js

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU1lywjAMvVCNgaQsH50ehXFiEQyOlVo2FE5fZYPMFEKH6U8cS/JbLPlUiRxdABdkrCwqTVJR8EoordEN/8UiyderZQ6QpqtkLtLpep7Mk/VkT2+nG0plY2EcyT2ESuWHft0cwWn0UsWApQrB5H1GWHU5C1OqAkhqQ0EaRvIEeTDMihmBP4L/f5pB4AH4DpQGL7aILEiAhZKzjG4cw5Lc+qZePzh9rReVR75JgkDSmkxSqXzgVGT5XxH8eXKLTErjnljd1PRZNFbLXHmMBPZqsg8MYLjaRs2mWXHrtm4z6BGmaANXBhhYHsq3hlU035cxDGHACvr1JRw+I9hTVGBFhRTG7m5cTduFPic8kLlAF920uxHsu31mYSfImp5wdOKjYwF/QvmN8OLpfjxFiTpaoAcz0byF7tl4KMCBV7WZ56RF5G0GvuimsQXhKWOIwC2x562xj0ZxSMupO9XP6HaIh5pMw3d36rP8mC2W79P5Kp0tfgBi4toQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

e1b2299955d137982d8e6eefb796b9bb4435ac23cf156ef9054b1c91fabcb1ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Sun, 29 Jan 2023 21:40:15 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"63d6e7bf-104f"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
expires: Fri, 10 Feb 2023 15:39:36 GMT

GET
H2 200 share-buttons.0bdd88c45462dfb2b073.bundle.min.js Show response
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/ 1 KB
632 B 170ms
170ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/share-buttons.0bdd88c45462dfb2b073.bundle.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

534fd5b9e499e6f74045f4bb61b214e928b4b57e4b4e1767554350626046a7c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Sun, 29 Jan 2023 21:40:15 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"63d6e7bf-4bd"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
expires: Fri, 10 Feb 2023 15:39:36 GMT

GET
H2 200 load-more.066fb9c5015fff73b73c.bundle.min.js Show response
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/ 5 KB
2 KB 172ms
171ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/load-more.066fb9c5015fff73b73c.bundle.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

2dfbd972f157603affc32572b9feb512ef6ac1a5da01cee30febd05e4742d926

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Sun, 29 Jan 2023 21:40:15 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"63d6e7bf-1595"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
expires: Fri, 10 Feb 2023 15:39:36 GMT

GET
H2 200 posts.397aa4bedda9268558a6.bundle.min.js Show response
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/ 3 KB
1 KB 171ms
170ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/posts.397aa4bedda9268558a6.bundle.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ccd69c27d47887045e48ebbcd389d285a08d6cddf4b0c3d0e86070c35cceb1bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Sun, 29 Jan 2023 21:40:15 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"63d6e7bf-d21"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
expires: Fri, 10 Feb 2023 15:39:36 GMT

GET
H2 200 text-editor.2c35aafbe5bf0e127950.bundle.min.js Show response
blog.cyble.com/wp-content/plugins/elementor/assets/js/ 1 KB
704 B 171ms
171ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/elementor/assets/js/text-editor.2c35aafbe5bf0e127950.bundle.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

359c32724ded3d649d66332ac70da65306ff8c45ff08f9d0e253ae1fd175e109

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 21 Dec 2022 18:01:21 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"63a349f1-54f"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
expires: Fri, 10 Feb 2023 15:39:36 GMT

GET
H2 200 Vector-Stealer-RDP-Malware-KGB-Crypter.png
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/ 253 KB
253 KB 6ms
6ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/Vector-Stealer-RDP-Malware-KGB-Crypter.png?w=1200&ssl=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

335ce4e6754eba0c0e787ecc04106b607684cc8c6785fc5eb5f02461d0708fc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc: HIT hhn 4
date: Fri, 03 Feb 2023 15:39:36 GMT
x-content-type-options: nosniff
last-modified: Wed, 01 Feb 2023 07:23:49 GMT
server: nginx
etag: "aafed4ab57f49016"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://blog.cyble.com/wp-content/uploads/2023/02/Vector-Stealer-RDP-Malware-KGB-Crypter.png>; rel="canonical"
content-length: 258830
expires: Fri, 31 Jan 2025 19:23:49 GMT

GET
H/1.1 200
OK consent_tcfv2.js Show response
s.adroll.com/j/ 410 KB
55 KB 20ms
20ms Script
application/javascript 2600:9000:211a:2600:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/consent_tcfv2.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211a:2600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 91144fbcc0e3f609b021e362ec29d2a9b58f15e840f229eb99ea2c04d927882b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

X-Amz-Version-Id: 44sIT20LqRj70wQHqyIoOw7etYYdjkbK
Content-Encoding: gzip
Via: 1.1 61bfa9dc3dc260c1f6ca617cfc7e065a.cloudfront.net (CloudFront)
Date: Fri, 03 Feb 2023 15:37:32 GMT
Age: 284
X-Amz-Cf-Pop: VIE50-C2
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Wed, 04 May 2022 19:41:48 GMT
Server: AmazonS3
Etag: W/"0a7d0ea8d7d31b07e925fe340acf431b"
Vary: Accept-Encoding
Access-Control-Max-Age: 600
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Cache-Control: max-age=300, must-revalidate
Access-Control-Allow-Credentials: false
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: Z_F-tGlzfYe24Imwbr8mSugDu7wDVzPBu4fb9Dk4rJwvfnPXq3DhGQ==

POST
H2 204 collect
region1.google-analytics.com/g/ 0
253 B 50ms
17ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-4FJGSRPM4S&gtm=45je3210&_p=751038937&gdid=dZTNiMT&cid=1022549137.1675438776&ul=en-us&sr=1600x1200&uaW=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1675438776&sct=1&seg=0&dl=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&dt=Cyble%20%E2%80%94%20Vector%20Stealer%3A%20A%20Gateway%20for%20RDP%20Hijacking&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4FJGSRPM4S&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 15:39:36 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.cyble.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 21289959.js Show response
js.hs-analytics.net/analytics/1675438500000/ 65 KB
20 KB 168ms
135ms Script
text/javascript 2606:4700::6811:47b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1675438500000/21289959.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.19
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:47b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 014b2b1c41f3a79609ab3dc05b4de33205240052b0f2bc7715415eacaad638f3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: 8R3K31NNJWK13V16
x-amz-server-side-encryption: AES256
x-amz-id-2: Qn3pS6JCcXtG+AaDushQHJoUTgI7otWVlGm1pcwbr5NHyaAFQ244bwVR2Oqbttu/I1l1l9IcU+w=
last-modified: Wed, 18 Jan 2023 21:07:15 GMT
server: cloudflare
etag: W/"d1e3abab0720d93eaa00510214f6df4a"
vary: origin, Accept-Encoding
content-type: text/javascript
cache-control: max-age=300, public
access-control-allow-credentials: false
cf-ray: 793c42a1194935e7-FRA
expires: Fri, 03 Feb 2023 15:44:36 GMT

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 68 KB
25 KB 159ms
127ms Script
application/javascript 2606:4700::6811:82ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hscollectedforms.net/collectedforms.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.19
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:82ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3999cf864b43937c278afeae5b60b6db69bb234d5641202c9e7a2385029aa3b7

Request headers

Referer: https://blog.cyble.com/
Origin: https://blog.cyble.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
x-amz-version-id: SN4HXBautbT5xHa4DdPckLpyluwLE8QR
via: 1.1 c5f8f8068a88ebb73e505f5e51b5262e.cloudfront.net (CloudFront)
cf-cache-status: EXPIRED
content-encoding: br
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=collected-forms-embed-js/static-1.312/bundles/project.js&cfRay=793c42a11a2e3674-FRA
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-amz-replication-status: COMPLETED
last-modified: Wed, 07 Dec 2022 02:49:13 UTC
server: cloudflare
etag: W/"349cabd549e2249f8fb6ac3ac6f08e00"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
cf-ray: 793c42a11a2e3674-FRA
x-amz-cf-id: m4_BgOTKxoiLtvOmijMrzj98VOjP9Ob29OYRN94UtrNCrjOXDpCsTg==
x-hs-target-asset: collected-forms-embed-js/static-1.312/bundles/project.js

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
3 KB 46ms
15ms Script
application/javascript 2606:4700::6811:74b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsadspixel.net/fb.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.19
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:74b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7455fff3d4e08245186e113636f69cbc44679bdf8870de5e4fd9a835e3d2e93

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
x-amz-version-id: voeLZ8jD1qAOp4h9t0pVQ2YHSdN3ebgQ
via: 1.1 bcfffcf7e0fc8cd9cfe4125369a9f036.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: IAD12-P3
age: 90
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=adsscriptloaderstatic/static-1.317/bundles/pixels-release.js&cfRay=793c406c0c6a37ef-IAD
x-cache: Hit from cloudfront
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
x-amz-replication-status: COMPLETED
last-modified: Tue, 31 Jan 2023 04:09:31 UTC
server: cloudflare
etag: W/"bde7af4ffd2c05ea8423271f767ebc69"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
cache-control: max-age=600
cf-ray: 793c42a11b9d380f-FRA
x-amz-cf-id: zNJsSUhM4lDlHcSd_v99Vx7-HVmU7CXnCWV6dTveLQ9YAW7qum2ckw==
x-hs-target-asset: adsscriptloaderstatic/static-1.317/bundles/pixels-release.js

GET
H2 200 banner.js Show response
js.hs-banner.com/v2/21289959/ 202 KB
63 KB 443ms
425ms Script
text/javascript 2606:4700:4400::ac40:9a55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/21289959/banner.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.19
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9a55 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03e71e9c054be9e6f810f0ec721bc2ca83fcd89552f853f1a55324125debe474

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
x-amz-version-id: XKbPCX8x0Xf2.SmYMsCe0Iy07ulPDqMu
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: HV2E5RBTDEM8WQMY
x-amz-server-side-encryption: AES256
x-amz-id-2: UHq0yabsmOBVTy7Emj1oUpbgEgeTI9S1NED5VEIvHflEErkK5sHzBR079Oowyk0Mp2PVEiBqkJA=
last-modified: Thu, 26 Jan 2023 20:08:26 GMT
server: cloudflare
etag: W/"fde1fb2c16b74a3d47fb446eca017399"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://blog.cyble.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300, public
access-control-allow-credentials: true
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 793c42a0fee22bd2-FRA
expires: Fri, 03 Feb 2023 15:44:36 GMT

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 544 KB
87 KB 80ms
36ms Script
application/javascript 2606:4700::6811:e8cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsleadflows.net/leadflows.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.19
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:e8cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd43cd92e272c2e3872abd9559900116d85f2899e76c00015c59360060bcf062

Request headers

Referer: https://blog.cyble.com/
Origin: https://blog.cyble.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
x-amz-version-id: 9g41IgVIr3w9wyiFOHn4rgapkQc72OJD
via: 1.1 e8eec15d9551dd475d4c478f9fbb5f04.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: IAD12-P3
age: 4108
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=lead-flows-js/static-1.1134/bundle/main/lead-flows-release.js&cfRay=793bde54bce73aa3-IAD
x-cache: Hit from cloudfront
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-amz-replication-status: COMPLETED
last-modified: Thu, 02 Feb 2023 01:26:06 UTC
server: cloudflare
etag: W/"998dfd36d3c4078a3a05a1a77e61963c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-hs-cache-status: MISS
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
cache-control: s-maxage=86400, max-age=0
cf-ray: 793c42a12c533a60-FRA
x-amz-cf-id: nYOTO_mSNKY6swtDY1I_vXgl9QigeRFQ8Oc--PyevxnrcjHFUj39mA==
x-hs-target-asset: lead-flows-js/static-1.1134/bundle/main/lead-flows-release.js

GET
H2 200 conversations-embed.js Show response
js.usemessages.com/ 73 KB
21 KB 48ms
17ms Script
application/javascript 2606:4700::6811:edcc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.usemessages.com/conversations-embed.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.19
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:edcc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2937f3299d73f3d0c53f0b73b582b3ff16495bf9efc133f3195dcc5c2341ed2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
x-amz-version-id: taqgEgnsrT5tsXCQJYBxI5iw6YGfjof_
via: 1.1 4715507645a6516d2df35cd342cb5be0.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: IAD12-P3
age: 75
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=conversations-embed/static-1.12020/bundles/project.js&cfRay=793c40c9d87f3834-IAD
x-cache: Hit from cloudfront
cache-tag: staticjsapp-conversations-embed-web-prod,staticjsapp-prod
x-amz-replication-status: COMPLETED
last-modified: Wed, 01 Feb 2023 11:33:55 UTC
server: cloudflare
etag: W/"34276ce78542d549ceeb934446d38e5a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
cache-control: max-age=600
cf-ray: 793c42a11a7039d9-FRA
x-amz-cf-id: oVPVw9TrXMB83-3plIrQl6B2C_mfcz6enYUfvityZVO2nOeC2P5xZQ==
x-hs-target-asset: conversations-embed/static-1.12020/bundles/project.js

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
208 B 69ms
68ms XHR
text/plain 2a00:1450:400d:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&aip=1&a=751038937&t=pageview&_s=1&dl=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&ul=en-us&de=UTF-8&dt=Cyble%20%E2%80%94%20Vector%20Stealer%3A%20A%20Gateway%20for%20RDP%20Hijacking&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACUABBAAAACAAI~&jid=676765429&gjid=98059176&cid=1022549137.1675438776&tid=UA-201575643-1&_gid=1883732833.1675438776&_r=1&_slc=1&gtm=457e3210&did=dZTNiMT&gdid=dZTNiMT&z=1666281908

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.cyble.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 15:39:36 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.cyble.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
394 B 135ms
125ms Image
image/gif 2606:4700::6810:5905
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5905 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
server: cloudflare
x-hubspot-correlation-id: 07c6688b-8182-4af0-95bc-56de340a4be9
x-trace: 2B1E5D91D6BBAD6DDE7FDB29F25AEC5D993751A439000000000000000000
vary: origin
content-type: image/gif
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 793c42a148393a92-FRA
content-length: 35
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 Figure-1-VectorStealer-Web-Panel.png
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/ 14 KB
14 KB 7ms
6ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/Figure-1-VectorStealer-Web-Panel.png?w=702&ssl=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

7456da3103391af6bdfc24a3e8f51747d767c7970860290fb91c619cc18eaded

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc: HIT hhn 3
date: Fri, 03 Feb 2023 15:39:36 GMT
x-content-type-options: nosniff
last-modified: Wed, 01 Feb 2023 07:05:22 GMT
server: nginx
etag: "cd87001f162c28b9"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://blog.cyble.com/wp-content/uploads/2023/02/Figure-1-VectorStealer-Web-Panel.png>; rel="canonical"
content-length: 14436
expires: Fri, 31 Jan 2025 19:05:22 GMT

GET
H/1.1 200
OK nextroll-32x32.png
s.adroll.com/i/favicon/ 2 KB
2 KB 23ms
23ms Image
image/png 2600:9000:211a:2600:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.adroll.com/i/favicon/nextroll-32x32.png
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211a:2600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

X-Amz-Version-Id: eTpwxbAIDHDUN.4tfrROIgU_pzKN9Xh0
Date: Fri, 03 Feb 2023 04:59:48 GMT
Via: 1.1 61bfa9dc3dc260c1f6ca617cfc7e065a.cloudfront.net (CloudFront)
Age: 38394
X-Amz-Cf-Pop: VIE50-C2
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 1615
Last-Modified: Mon, 28 Jun 2021 18:19:21 GMT
Server: AmazonS3
Etag: "403a0a7dcf2d617e7ea852bfb9d11945"
Vary: Accept-Encoding
Access-Control-Max-Age: 600
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: MmbTv_uoyT9InLmp85TooQKBhLARyKAl2TnKL5BusBntVQFVTo9dlw==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
345 B 49ms
18ms XHR
text/plain 2a00:1450:4025:401::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-201575643-1&cid=1022549137.1675438776&jid=676765429&gjid=98059176&_gid=1883732833.1675438776&_u=YCDACUAABAAAACAAI~&z=1237546696

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4025:401::9d Den Helder, Netherlands, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.cyble.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Fri, 03 Feb 2023 15:39:36 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.cyble.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 counters.gif
forms-na1.hsforms.com/embed/v3/ 35 B
438 B 143ms
127ms Image
image/gif 2606:4700::6810:5805
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5805 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
server: cloudflare
x-hubspot-correlation-id: 1e2d431b-b66f-4c8d-a824-e59ddbeb907b
x-trace: 2BDF50DC6EA135EB034CB67420459EB9F4B479561A000000000000000000
vary: origin
content-type: image/gif
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 793c42a1dd2e30f9-FRA
content-length: 35
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

OPTIONS
H2 200 public
api.hubspot.com/livechat-public/v1/message/ Frame 0
0 152ms
133ms Preflight
text/plain 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubspot.com/livechat-public/v1/message/public?portalId=21289959&conversations-embed=static-1.12020&mobile=false&messagesUtk=8c157e92638742c880b891af5f9f3db3&traceId=8c157e92638742c880b891af5f9f3db3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Headers: x-hubspot-messages-uri
Access-Control-Request-Method: GET
Origin: https://blog.cyble.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-credentials: false
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://blog.cyble.com
allow: HEAD,GET,OPTIONS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 793c42a20d002c41-FRA
content-length: 18
content-type: text/plain; charset=utf-8
date: Fri, 03 Feb 2023 15:39:36 GMT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b0%2BA5ipdbaieCuKxUYG2e5iG%2FFlODrcu5IM2dCjlYQyLBVMM7Sk5GdxZONk7ekGxlISkDhoe09xWTW7xNMKxjT36XU7M5OITsN8zj7NFrhnxWCUuBuPT6Euq7u0ws9uBN%2FMnfEr%2BzYYcXGvsmg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: origin, Accept-Encoding
x-hubspot-correlation-id: e1f532a5-4a5c-4ec6-823f-aa6c2b9ad857
x-trace: 2B3E36D493C8CAB952F56055F14B3448305E6971AA000000000000000000

GET
H2 200 public Show response
api.hubspot.com/livechat-public/v1/message/ 3 KB
2 KB 208ms
207ms XHR
application/json 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf0f269822bcabfc036e1feff8b5e54ab270b568484d254abf7493cb266be05d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://blog.cyble.com/
accept-language: de-DE,de;q=0.9
X-HubSpot-Messages-Uri: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: b7c30426-06a6-4f1d-94e7-bf6fc782bc66
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1475
server: cloudflare
x-trace: 2BAA90D8F53BDE563DE01D4E8F283DE3093B676FE4000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://blog.cyble.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GI%2FveJkNEdJLKU3DvHNqPKhg4qwPofkWv0F%2Frssil387YZ%2Fhr7V4iLtDjXJ%2FKwpyJ7EMnogbpZMHglGWXPrOgpmKjaBrGNcWsd%2BWv9kd1xhyehBAFqRJH2QM9%2F8H2XXYJk16fTFKNkllosuHDA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials: false
cf-ray: 793c42a2ddf12c41-FRA
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri

GET
H2 200 eicons.woff2
blog.cyble.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/ 91 KB
91 KB 200ms
200ms Font
application/font-woff2 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff2?5.16.0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

691fa7d17effc7d303eda0ad7e4a1d91b2f375506cfc8a774480cc2b55f156ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://blog.cyble.com/_static/??-eJylVO1SgzAQfCFjCkg/fjg+S0iueDbkmHwM07f3QKp0aqroH+CS3c1mc2HohSYXwUUZX6GDIFWIXvEzQAxShyA7dHhEMPLoJ6R55JFHnnkYvsi9TS26INvEZQO+lU1Ca2RjSZ+ExcYrf5Yhni3kqFadKUXRejTXQHTaJsPW3tgMGFRg2Skzl0XPdPDCQqv0eekwy+a5Zf33XWnLaaHOkQfypvcQgghRxSA65VTLVntPU753Q3kFZRh7JIr8mq2SX55PBpJTvNHgbUhAhn3Ifc6LaexeLN/audclqbekzJI4MnoKUdS7zf7HdabMfrnWhZxsxE5FuA2PSWJUSdwC4o+2D2VRrD077kg5oGnZg7jaRUbnDWKv9El2ZJKF8cBOkGmbi9PpEgtlDLnlt9hW+rDfadB12ZS1qMrdU1lVmxUb3leHeg38aVOtgW83N+q5GOYIZSCNyn5061WRE9JEJwThKKKGrz5a1enjpTkySKgBAnWzDA/M9f/F+N/izLrr961OIIt3L8gl1xE8f4/Ql+652O7qgg+82L8Dv8RVRQ==
Origin: https://blog.cyble.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
x-ac: 2.hhn _atomic_ams BYPASS
last-modified: Wed, 21 Dec 2022 18:01:21 GMT
server: nginx
etag: "63a349f1-16cbc"
access-control-allow-methods: GET, HEAD
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 93372
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 share-link.min.js Show response
blog.cyble.com/wp-content/plugins/elementor/assets/lib/share-link/ 3 KB
1 KB 172ms
171ms Script
application/javascript 192.0.78.213
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cyble.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.9.2

Requested by

Host: blog.cyble.com
URL: https://blog.cyble.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.9.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.213 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

138154c0deed3326477b9b4909175101070a5a3a95342291b53d8cc9879a5f47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 21 Dec 2022 18:01:21 GMT
server: nginx
x-ac: 2.hhn _atomic_ams BYPASS
etag: W/"63a349f1-a3c"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 BATLoader-RATs-Stealers-OneNote.jpg
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/ 24 KB
25 KB 7ms
6ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/BATLoader-RATs-Stealers-OneNote.jpg?fit=300%2C150&ssl=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

5dd1d4901a2aa0c9c999e4666f76cfaad441a0e75affd1b4be6bbc754e73e6ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc: HIT hhn 4
date: Fri, 03 Feb 2023 15:39:36 GMT
x-content-type-options: nosniff
last-modified: Thu, 02 Feb 2023 09:41:16 GMT
server: nginx
etag: "7650c6f6e76eef59"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://blog.cyble.com/wp-content/uploads/2023/02/BATLoader-RATs-Stealers-OneNote.jpg>; rel="canonical"
content-length: 24894
expires: Sat, 01 Feb 2025 21:41:16 GMT

GET
H2 200 Qakbot-Microsoft-OneNote.jpg
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/ 41 KB
42 KB 8ms
7ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/Qakbot-Microsoft-OneNote.jpg?fit=300%2C150&ssl=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

87f9919b79803a6cf52adbe417a25543fa3967566cb08320ea54cfdb2b02e98d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc: HIT hhn 4
date: Fri, 03 Feb 2023 15:39:36 GMT
x-content-type-options: nosniff
last-modified: Wed, 01 Feb 2023 15:42:11 GMT
server: nginx
etag: "79d786ef2f3fd5cb"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://blog.cyble.com/wp-content/uploads/2023/02/Qakbot-Microsoft-OneNote.jpg>; rel="canonical"
content-length: 42460
expires: Sat, 01 Feb 2025 03:42:11 GMT

GET
H2 200 Vector-Stealer-RDP-Malware-KGB-Crypter.png
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/ 23 KB
23 KB 7ms
7ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/Vector-Stealer-RDP-Malware-KGB-Crypter.png?fit=300%2C150&ssl=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

362430985ee3a7b1b5ee7d50d505b033e7e476a1b1424fe0df0a83ecf426e447

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc: HIT hhn 4
date: Fri, 03 Feb 2023 15:39:36 GMT
x-content-type-options: nosniff
last-modified: Wed, 01 Feb 2023 07:07:08 GMT
server: nginx
etag: "04870a5643414ce8"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://blog.cyble.com/wp-content/uploads/2023/02/Vector-Stealer-RDP-Malware-KGB-Crypter.png>; rel="canonical"
content-length: 23372
expires: Fri, 31 Jan 2025 19:07:08 GMT

GET
H2 200 json Show response
forms.hubspot.com/collected-forms/v1/config/ 116 B
680 B 126ms
125ms XHR
application/json 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/collected-forms/v1/config/json?portalId=21289959&utk=

Requested by

Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c27a8d0abc42f5fcd3a4ad9480ca7bd1bbe1fcb23d5438b4420f1cbcab3ecc9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/json, text/plain, */*
Referer: https://blog.cyble.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 7499285c-14cf-4bca-82a2-9f90632d3e67
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://blog.cyble.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0%2FBSJwAgWuu2mNXNhxYZOCAiapRx93lQ%2Ftwnr4hKBbUnuh3Zhn%2BHQ14PtE3viKczG18a1Jljk2TSQSpRJgUQWz3zIurIDO%2FEn2jkrR6LWWC6aiQT8ll4E9WAaF8NzTGti5rdNgBAMRS%2FnOn0t5E0"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 180
access-control-allow-credentials: false
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 793c42a2bdc52c41-FRA

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
357 B 119ms
119ms Image
image/gif 2606:4700::6810:5905
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5905 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
server: cloudflare
x-hubspot-correlation-id: a5a88a17-f877-44be-9de4-c301b4447279
x-trace: 2BAA2598E5C5BBE95040E3B0E1B9FB4D1AAD5935C3000000000000000000
vary: origin
content-type: image/gif
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 793c42a39b7f3a92-FRA
content-length: 35
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/ 114 B
877 B 184ms
139ms XHR
application/json 2606:4700::6811:c8cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=21289959

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:c8cc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

90b705145ef82e9d8493aae55c9bfb3200ec0620c8946b20b0b28366557d6a4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 9c35c075-ad43-4f7a-adb8-8069ff923644
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
x-trace: 2BF46A17DE392702DB5D05FA44B5E1FCA59CF65567000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://blog.cyble.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l%2FY17ga0ARUOmVn3yMZKdbqVOayTWY8NCy6AViIbkK6gEzA521fUReito2tuYn%2BOMkxHmNKTgLaUYxe%2FrjlI2OCzI4X0%2FGFVez7RVBRwy%2BAh6L3DU%2Bo5zvzLikKk23p7a1jwqJExn0CB6W%2BB"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 180
access-control-allow-credentials: false
cf-ray: 793c42a40ffd9b6a-FRA
access-control-allow-headers: *

GET
H2 200 8c157e92638742c880b891af5f9f3db3 Show response
app.hubspot.com/conversations-visitor/21289959/threads/utk/ Frame 05EC 51 KB
19 KB 199ms
182ms Document
text/html 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/conversations-visitor/21289959/threads/utk/8c157e92638742c880b891af5f9f3db3?uuid=a9e1a092500146b599822eb5ea599eca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=8c157e92638742c880b891af5f9f3db3&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false

Requested by

Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f8a97378fe9cafa10d7ef0ef06a79cba5044b1664d2276b8f65fdd74435bb03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://blog.cyble.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: false
age: 2913
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=600
cache-tag: staticjsapp-conversations-visitor-ui-web-prod,staticjsapp-prod
cf-cache-status: DYNAMIC
cf-ray: 793c42a44f3d9c10-FRA
content-encoding: br
content-security-policy-report-only: script-src 'self' www.hubspot.com *.hsappstatic.net *.hs-analytics.net *.hs-banner.com *.hsforms.net *.hsleadflows.net *.hs-scripts.com *.hubspotfeedback.com *.usemessages.com js.hubspot.com *.hsadspixel.net *.hscollectedforms.net js-agent.newrelic.com bam.nr-data.net bam-cell.nr-data.net *.google-analytics.com www.googletagmanager.com data: 'unsafe-inline' 'unsafe-eval' blob: connect.facebook.net www.gstatic.cn www.gstatic.com www.google.com *.fullstory.com fullstory.com apis.google.com snap.licdn.com; report-uri https://exceptions.hubspot.com/csp/report?resource=conversations-visitor-ui/static-1.14472/html/index.html&cfRay=793c42a44f3d9c10&reqUrl=https%3A%2F%2Fapp.hubspot.com%2Fconversations-visitor%2F21289959%2Fthreads%2Futk%2F8c157e92638742c880b891af5f9f3db3%3Fuuid%3Da9e1a092500146b599822eb5ea599eca%26mobile%3Dfalse%26mobileSafari%3Dfalse%26hideWelcomeMessage%3Dfalse%26hstc%3Dnull%26domain%3Dblog.cyble.com%26inApp53%3Dfalse%26messagesUtk%3D8c157e92638742c880b891af5f9f3db3%26url%3Dhttps%253A%252F%252Fblog.cyble.com%252F2023%252F02%252F01%252Fvector-stealer-a-gateway-for-rdp-hijacking%252F%253Futm_content%253D236585065%2526amp%253Butm_medium%253Dsocial%2526amp%253Butm_source%253Dtwitter%2526amp%253Bhss_channel%253Dtw-1141929006603866117%26inline%3Dfalse%26isFullscreen%3Dfalse%26globalCookieOptOut%3Dnull%26isFirstVisitorSession%3Dtrue%26isAttachmentDisabled%3Dfalse%26enableWidgetCookieBanner%3Dfalse%26isInCMS%3Dfalse&referrer=https%3A%2F%2Fblog.cyble.com%2F&cfenv=prod&pdt=2023-02-03&csp=ro
content-type: text/html; charset=utf-8
date: Fri, 03 Feb 2023 15:39:37 GMT
etag: W/"7656263e30b6d560cfdcf34f850ec716"
last-modified: Wed, 01 Feb 2023 11:33:55 UTC
report-to: {"group":"default","max_age":86400,"endpoints":[{"url":"https://exceptions.hubspot.com/csp/reports"}]}
reporting-endpoints: default="https://exceptions.hubspot.com/csp/reports?cfRay=793c42a44f3d9c10&resource=conversations-visitor-ui/static-1.14472/html/index.html"
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: origin, Accept-Encoding
via: 1.1 05133180bbd1649d4b8f97441bf305e8.cloudfront.net (CloudFront)
x-amz-cf-id: tZTVvuv2u-p3KvBDU4KJiPVcxF8gzulwfmloIGLzVzGosH6Hn_xjlQ==
x-amz-cf-pop: IAD12-P3
x-amz-replication-status: COMPLETED
x-amz-server-side-encryption: AES256
x-amz-version-id: x_YK.q_WU.yyMa9bjnSht5TOD3TEWlA6
x-cache: Hit from cloudfront
x-hs-cache-status: MISS
x-hs-target-asset: conversations-visitor-ui/static-1.14472/html/index.html
x-hs-worker-debug-mode: false

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 67ms
18ms Script
application/x-javascript 2a02:26f0:11a::217:9a4a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:11a::217:9a4a Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 10 Jan 2023 17:22:56 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=81666
accept-ranges: bytes
content-length: 4777

GET
H2 200 stats.json Show response
injection.amibreached.com/ Frame 53A5 124 B
978 B 79ms
62ms Fetch
application/json 2606:4700:20::681a:d31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://injection.amibreached.com/stats.json

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:d31 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bbdb1d21246d1c1a65aca8b41818f593b2d4704a459983866c0d331151b91887

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
via: 1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
age: 31498
x-amz-cf-pop: FRA2-C1
content-encoding: br
x-cache: Hit from cloudfront
last-modified: Mon, 23 May 2022 20:31:52 GMT
server: cloudflare
etag: W/"b660d52d56d1db01c2e37397c007a1e4"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: https://blog.cyble.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mByHGaYzhOCdI33smAJWF7DYBLRwenjqe%2BGZ1CK4vPeJkv4WEjCipX1cBXiosUr8uC0qbj6oUUtymUwtzkbw2MVbm5No5oCGI%2FVXTU1Ma8Dv%2Bq%2FpsEOVzNqgikBIJHNrinGB3rLNOT6jQOeU4gN%2Bye0VzqfNPn0%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: x-amz-server-side-encryption, x-amz-request-id, x-amz-id-2, x-origin
vary: Accept-Encoding
access-control-allow-credentials: true
cf-ray: 793c42a51b9d916e-FRA
x-amz-cf-id: Gcl_N2oKxHB72yiFUezs1tL37HUvjTyGZyNDq3HxERdGLeEEFL7J-A==

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/4053396/domain/blog.cyble.com/ 36 B
375 B 62ms
19ms XHR
application/json 2600:9000:2304:dc00:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/4053396/domain/blog.cyble.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2304:dc00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://blog.cyble.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:35:48 GMT
content-encoding: gzip
via: 1.1 ac02b9a9a93754a9f85004c4c9792fee.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-P1
age: 229
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=3600
x-amz-cf-id: LB2_LaaQ66KNyXqdcmrDCkdbx_gmOYdkin1jJIRiU5svPqtu_rLyIw==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1675438777182&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D23658...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4053396%26time%3D1675438777182%26url%3Dhttps%253A%252F%252Fblog.cyble.com%252F202...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1675438777182&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D23658...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1675438777182&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D2365...

0
266 B

198ms
182ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1675438777182&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&liSync=true&e_ipv6=AQK33LWf3rq2ZwAAAYYX7uVIp4yuBrScA83ddo3SGc_n4AF38wyLx33AMs01k6Qap0tCHE7R
Requested by: Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/01/vector-stealer-a-gateway-for-rdp-hijacking/?utm_content=236585065&utm_medium=social&utm_source=twitter&hss_channel=tw-1141929006603866117
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: D62380DA4EAD4CBAAB14441FD848C9ED Ref B: FRAEDGE1717 Ref C: 2023-02-03T15:39:37Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXzzX0yka6nlgbnUqFMWQ==

Redirect headers

date: Fri, 03 Feb 2023 15:39:37 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 89F8B358DB1D4F88B5F67D7055FC4D34 Ref B: FRAEDGE1717 Ref C: 2023-02-03T15:39:37Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1675438777182&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&liSync=true&e_ipv6=AQK33LWf3rq2ZwAAAYYX7uVIp4yuBrScA83ddo3SGc_n4AF38wyLx33AMs01k6Qap0tCHE7R
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXzzX0viLnwteJ2g1fx8g==

GET
H2 200 bundle.production.js Show response
static.hsappstatic.net/head-dlb/static-1.255/ Frame 05EC 44 KB
16 KB 53ms
18ms Script
application/javascript 2606:4700::6811:7d2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/head-dlb/static-1.255/bundle.production.js

Requested by

Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/8c157e92638742c880b891af5f9f3db3?uuid=a9e1a092500146b599822eb5ea599eca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=8c157e92638742c880b891af5f9f3db3&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

92986d66f075209e933031c072211f82c4dffdfd374a3ef870a648505c789789

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://app.hubspot.com/
Origin: https://app.hubspot.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
x-amz-version-id: BU1gUK9lO46wXw.GxLMLib8Ax.frs5Yp
via: 1.1 eec12a22159207af63748eccf10799b2.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: AMS54-C1
age: 208290
x-amz-server-side-encryption: AES256
content-encoding: br
x-cache: Miss from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 30 Jan 2023 15:51:53 GMT
server: cloudflare
etag: W/"ab8919e33a4c517337e452aa75144717"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: https://app.hubspot.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DSd2QyehQWF6l8C0uEWj%2FbhtadBQV1eR%2BypwO5Dtt%2FZr%2B5AnXgPfaCh2bKnP1AOXgLsWTBovSE009kPJPJ2e9n6VrPs07GbNmaotjeYht9jo2%2Bjp7GF3Fkb4zGRwWFrPvvBwB63b%2Fg25Sy0Qs%2FWFlpkgGdU%3D"}],"group":"cf-nel","max_age":604800}
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials: true
cache-control: public, max-age=31536000
cf-ray: 793c42a5bdf4373a-FRA
x-amz-cf-id: EJqMTKvIjsiN3rrRHv4Nz8Dfjvwq3ocM_U3-Ok4cQ5lBqTbp7nmIAg==
expires: Sat, 03 Feb 2024 15:39:37 GMT

GET
H2 200 visitor.css
static.hsappstatic.net/conversations-visitor-ui/static-1.14289/sass/ Frame 05EC 20 KB
4 KB 68ms
23ms Stylesheet
text/css 2606:4700::6811:7d2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/conversations-visitor-ui/static-1.14289/sass/visitor.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

963563d75d17a3c2b444ad4d73e3e9c24a43f6f9e121cce484aa6c7d197af73c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.hubspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
x-amz-version-id: 8cTUQYaMqbf6Yv8IIYst6y8hd.mcxuTh
via: 1.1 59d5785a1d012a54118141e7e216a492.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA56-P2
age: 215859
x-amz-server-side-encryption: AES256
content-encoding: br
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 19 Jan 2023 19:32:55 GMT
server: cloudflare
etag: W/"3192955eca3e03437d10c02e718e1960"
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wq5XmjKzfJV%2BXS4t90VbdQ719FpPgXvNhJfcyfbqUEb5zfMu4tzhmpEl2kE1lMheBBABb3A%2BYoDT7fEgYJ4IzM%2BYsNZwhO2Y2rxpdOp6L0Bkd7CIBT%2Bn4CwXnNvKIGvzXlN4wbyHOzC5kLoh45LsZX1yuJg%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=31536000
cf-ray: 793c42a5c9413a97-FRA
x-amz-cf-id: 1Z3ukzyEAAnGKtkNoQD5GD2rP1SUWcsHDa9kkwG71zr0dSuLlyzVtw==
expires: Sat, 03 Feb 2024 15:39:37 GMT

GET
H2 200 bundle.production.js Show response
static.hsappstatic.net/hubspot-dlb/static-1.352/ Frame 05EC 295 KB
95 KB 49ms
15ms Script
application/javascript 2606:4700::6811:7d2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/hubspot-dlb/static-1.352/bundle.production.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af4d8295ed405b08a948022d81e7fe9048305144f193c11aba9dc53229758199

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://app.hubspot.com/
Origin: https://app.hubspot.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
x-amz-version-id: lUmRJ.EMHGuGoOzmCmMes42qja_ehMGL
via: 1.1 0434556f8ccac61e8735f7c75767727c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA56-C2
age: 208290
x-amz-server-side-encryption: AES256
content-encoding: br
x-cache: RefreshHit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 26 Jan 2023 17:07:33 GMT
server: cloudflare
etag: W/"ad05b7da4f5b501dafa9768c8e784ff8"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: https://app.hubspot.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RQYvZ1Unqvwr3jvbGkqge8sPZIGbc7JsaqLwkKgT5IzhIhPrc7W4IEvtsjOPND6FaW1O%2FMx97y0XHGYd73q5YWpr8JY1HfqefpFQkClGKZ89cY19kLxSbaJJ7LRiJlyS8JRa8M%2FWGZyTM%2FdONpkslIvrZ3Q%3D"}],"group":"cf-nel","max_age":604800}
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials: true
cache-control: public, max-age=31536000
cf-ray: 793c42a5bdf5373a-FRA
x-amz-cf-id: OvXJhtyeDmvdYLUpJyslYj56x50pTBStAyhCuYrSbIihHeqmoxwamg==
expires: Sat, 03 Feb 2024 15:39:37 GMT

GET
H2 200 visitor.js Show response
static.hsappstatic.net/conversations-visitor-ui/static-1.14472/bundles/ Frame 05EC 605 KB
177 KB 51ms
18ms Script
application/javascript 2606:4700::6811:7d2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/conversations-visitor-ui/static-1.14472/bundles/visitor.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

126e49202a802145638386936ee612ef9b0519387c0e7788267c877200668c3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://app.hubspot.com/
Origin: https://app.hubspot.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
x-amz-version-id: 7igTdYCI0m9S7UATKjmMzTGxbStcKACU
via: 1.1 fdc45b521af7652438141328494a79d2.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA56-C2
age: 144329
x-amz-server-side-encryption: AES256
content-encoding: br
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 01 Feb 2023 22:03:03 GMT
server: cloudflare
etag: W/"985726728cbfb45a06e393ecfc34b71e"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: https://app.hubspot.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cS9vvl6J2T1qiylUhH%2BPKLfzvPgZZ8D%2BnOFFNV2SZ7Qi%2Bso%2BZoYYNrND0jaF15uar%2B0%2Bj0b8ZCqJOhwjVF%2Bct8dL3aKRVPW0%2BmUE8XQYqZrcQjeT1NcYQ17MYLWB2wTSgmO7dvuM1QXxvxOWLmDYPt%2BrPeY%3D"}],"group":"cf-nel","max_age":604800}
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials: true
cache-control: public, max-age=31536000
cf-ray: 793c42a5bdf6373a-FRA
x-amz-cf-id: DUwbtvW2LJgXIpwC-zi1FVOKv327qxT1FVHk2NGgrKP6HIcBIAB_EA==
expires: Sat, 03 Feb 2024 15:39:37 GMT

GET
H2 200 inject.8d8a39d8fa64efbb0671.bundle.js Show response
injection.amibreached.com/ Frame 53A5 130 KB
44 KB 40ms
40ms Script
application/javascript 2606:4700:20::681a:d31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:d31 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9af44543fbf7b09c3d68e46dcb21d2cb9ec5f18bbd537cea92360a85c5db793e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
via: 1.1 39e6266db143f6443f194d8c60e22480.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
age: 385
x-amz-cf-pop: FRA60-P3
content-encoding: br
x-cache: Hit from cloudfront
last-modified: Mon, 23 May 2022 20:31:51 GMT
server: cloudflare
etag: W/"046f84a87526210ff005ab33291675c9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KtJONFfjaLWpnM1QHywv8YCtREN4OmmsPBtCSqTyvNqmEotHRkEhUWgQCpvYTljU5%2FUwF66m0neAtYP45jeZcTSpZuOwZBlxLjN93hYbqf5a9u0DKOXKH%2FAtKkgOk2kxk5TCRR%2FNgykxd1ixSAC7z40aAq67%2FxY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=120
cf-ray: 793c42a59df68ffe-FRA
x-amz-cf-id: FjZRG_n3TA0Asfa0tCB3rwgdzB81PaKZJqjMzyGgSGbQBKOrg6vavA==

GET
H2 200 main.8d8a39d8fa64efbb0671.css
injection.amibreached.com/css/ Frame 53A5 703 B
776 B 39ms
39ms Stylesheet
text/css 2606:4700:20::681a:d31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://injection.amibreached.com/css/main.8d8a39d8fa64efbb0671.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:d31 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c7d0240fd43289ab1411c5fa1277574ee436d3a3bbb82d34c4d82f32d04517b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
via: 1.1 89f400f550feb1d74a18ecb2070103ac.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
age: 385
x-amz-cf-pop: FRA60-P3
content-encoding: br
x-cache: Hit from cloudfront
last-modified: Mon, 23 May 2022 20:31:51 GMT
server: cloudflare
etag: W/"ff4f518052149a21c5b6397b3f717f6a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5rDp7L6tf6QM2hmWb4ykjFWxp77fuWfpOyPsKqk5PzCX3AuN5X6Z1zgF9C2vudzfUf1omvvPUFyEdmqPvyT%2FnkXNXDrmBGXm%2F3zxuAuRjgHblK5f91Md0sS5UHhpuMfKUc1LJsHuxJ4JpNWp252RzCPOSiEX0%2BE%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=120
cf-ray: 793c42a59df48ffe-FRA
x-amz-cf-id: vgc-g8RtvvW-mQB3Apw5bz7RzScbbT6LM6UT9LskV19BR0aR6DD4-w==

GET
H2 200 272.8d8a39d8fa64efbb0671.css
injection.amibreached.com/css/ Frame 53A5 348 KB
52 KB 36ms
35ms Stylesheet
text/css 2606:4700:20::681a:d31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://injection.amibreached.com/css/272.8d8a39d8fa64efbb0671.css

Requested by

Host: injection.amibreached.com
URL: https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:d31 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c77d2ba289d0e2827ad7f79b00972a63c7f4426d89b8ce6b5da90a368760cfe4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
via: 1.1 8e4700eb43d0f5579f360cfc02e71fac.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
age: 385
x-amz-cf-pop: AMS1-C1
content-encoding: br
x-cache: Hit from cloudfront
last-modified: Mon, 23 May 2022 20:31:51 GMT
server: cloudflare
etag: W/"a858af055119af47585aeffbfd69ceac"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kViKZtHjBrOZSU38PNCOqjBEtHqBVv5SLLhzvmZkGDWSyFshs5d5QIVcprjNO%2BFCoZBzm4aFaZtIMQcXdqHDINacQpc7YAPYdZXt9LkG1p7jN4jk6qS4rPsTRH0h3Kb5k2VKq35AiA%2Bt%2BKqmFXZL64vVxlOLfeA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=120
cf-ray: 793c42a5fe978ffe-FRA
x-amz-cf-id: mdN1wAfjVPz_5VPGgB1Bhck5YbZe5Cgdfxr_wJN7W2kjyb6MxUeH3w==

GET
H2 200 272.8d8a39d8fa64efbb0671.chunk.js Show response
injection.amibreached.com/chunks/ Frame 53A5 381 KB
100 KB 39ms
38ms Script
application/javascript 2606:4700:20::681a:d31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://injection.amibreached.com/chunks/272.8d8a39d8fa64efbb0671.chunk.js

Requested by

Host: injection.amibreached.com
URL: https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:d31 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29d409fee0f34ebc05fa36076c101b77e28dccbcfdbfbf4cf248371820ca9ddb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
via: 1.1 47a7b8b932d91b0edbfc42f1ba94ebc0.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
age: 385
x-amz-cf-pop: FRA56-C1
content-encoding: br
x-cache: Hit from cloudfront
last-modified: Mon, 23 May 2022 20:31:50 GMT
server: cloudflare
etag: W/"a161e1a55882deeacea4aadc5ab6a660"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yTIyXWkSGZIC%2FeIcG3aNjkQsOHDe1hvg0xJ352%2BXlHP41SGesHLhBQ8UmqeBCJ1F31z2wYB59MeEeKMsDOxunSxZoi77h97fF7QycslF5PgncI0LqORt6%2Fle%2FjVkqOEPTBuHtOQ7Gaeu2xsQdjReJO0yyhaIoow%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=120
cf-ray: 793c42a5fe988ffe-FRA
x-amz-cf-id: chHlo3af84rpDT1Q_BSWAeu8GMeqc1XUV416I7VwHDs-ZWdrDP4n6Q==

GET
H2 200 349.8d8a39d8fa64efbb0671.css
injection.amibreached.com/css/ Frame 53A5 3 KB
1 KB 40ms
39ms Stylesheet
text/css 2606:4700:20::681a:d31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://injection.amibreached.com/css/349.8d8a39d8fa64efbb0671.css

Requested by

Host: injection.amibreached.com
URL: https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:d31 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9d904f71a4d973dac278821490969eb0a63dd97635584930bbbbec0a3e608d75

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
via: 1.1 89f400f550feb1d74a18ecb2070103ac.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
age: 385
x-amz-cf-pop: FRA60-P3
content-encoding: br
x-cache: Hit from cloudfront
last-modified: Mon, 23 May 2022 20:31:51 GMT
server: cloudflare
etag: W/"d5e9ad0edf5f90c0d209a111611b1fba"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YgQrPZEKQI3AamfptCTa2BM6Zo8e5AJkmsRtCo2JBQnmkbRwL521I%2B7XT2JGpbEINb1pIHt4huRPqo2yuiYucCPq2zJp7SpWkKkym99tHGRFZXifnxO1LI6asb%2Fuh5PJJuRf4DmeWpuaquTgQvUO8Foa2swc%2FM4%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=120
cf-ray: 793c42a60e9b8ffe-FRA
x-amz-cf-id: k1mnguAxvkD6UOVYaywEkwYF2zn55pLbvqn2UT6qAfigloulfFSYUQ==

GET
H2 200 349.8d8a39d8fa64efbb0671.chunk.js Show response
injection.amibreached.com/chunks/ Frame 53A5 16 KB
5 KB 47ms
47ms Script
application/javascript 2606:4700:20::681a:d31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://injection.amibreached.com/chunks/349.8d8a39d8fa64efbb0671.chunk.js

Requested by

Host: injection.amibreached.com
URL: https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:d31 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2c197367cb631f88fca96c13ec0c06d0a99bc5398d0349716bc06ce7a91e8ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
via: 1.1 cdcb559c2f25d8ad2ccf0419bee33b02.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
age: 385
x-amz-cf-pop: FRA2-C1
content-encoding: br
x-cache: Hit from cloudfront
last-modified: Mon, 23 May 2022 20:31:51 GMT
server: cloudflare
etag: W/"0e05edf25a54d46e1a8ef01ec442978b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NOjMTsIfBj3HN6QQ9kT1v8SQ07mQBRXwa0NFTK6RslNgQj%2BnThdnW%2F%2BfRI6Fkm8pe0alGBZZug%2FZawOINHKLst8Gol1sck%2FzREnwoL1jkRUva5W4lgCrAbuBov0LOKQR%2B4eynoELQg6GT0XXu%2FjiyPlLfXURMV8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=120
cf-ray: 793c42a60e9c8ffe-FRA
x-amz-cf-id: 735D9eXBHiQ-VOhHLqZrk6xhzQN0dGQr2cV1DZtxko-Uic20lSHPxA==

GET
H2 200 i18n-data-data-locales-en-us.js Show response
static.hsappstatic.net/conversations-visitor-ui/static-1.14383/ Frame 05EC 778 B
863 B 46ms
45ms Script
application/javascript 2606:4700::6811:7d2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hsappstatic.net/conversations-visitor-ui/static-1.14383/i18n-data-data-locales-en-us.js

Requested by

Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/conversations-visitor-ui/static-1.14472/bundles/visitor.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e77cbf4626dd2563752e49f945292d89532160815b80125ba37f31b3bfcdb20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://app.hubspot.com/
Origin: https://app.hubspot.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
x-amz-version-id: iKymcBZKV7wBbnwy0iz9SB_vwwt9ekV9
via: 1.1 6c22fb0e883db3123ae98d8d72cdaf76.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: AMS54-C1
age: 208289
x-amz-server-side-encryption: AES256
content-encoding: br
x-cache: RefreshHit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 27 Jan 2023 14:58:23 GMT
server: cloudflare
etag: W/"78a29048c85f5d506eaf8d909683dd3c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: https://app.hubspot.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LguK70lu%2FHM6tRNbOGgjJFD48wqI5wFw9YtGTqjSkEDWc3l0B2upe40wu0O8J35sI10lboifUWG6p3nzMlKVLWp9O2bSv6JhPl%2BzTNm%2FrhCYKx3b0nfAjuBnaPloE8u%2FUB1CmVk1n46SR1fvQvsZzzrrrzU%3D"}],"group":"cf-nel","max_age":604800}
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials: true
cache-control: public, max-age=31536000
cf-ray: 793c42a69efd373a-FRA
x-amz-cf-id: shi-DjA93fz9ZbgHpd4PzRlVKGb_PoiMjnohz510WA40_VFHVHJusQ==
expires: Sat, 03 Feb 2024 15:39:37 GMT

GET
H2 200 primeicons.ttf
injection.amibreached.com/assets/fonts/ Frame 53A5 56 KB
57 KB 37ms
36ms Font
binary/octet-stream 2606:4700:20::681a:d31
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://injection.amibreached.com/assets/fonts/primeicons.ttf

Requested by

Host: injection.amibreached.com
URL: https://injection.amibreached.com/css/272.8d8a39d8fa64efbb0671.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:d31 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1e93246e1f3ea9a11fa1a6d7c14e48a1da911f92043e2e6ef59da5ffd38f070

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://injection.amibreached.com/css/272.8d8a39d8fa64efbb0671.css
Origin: https://blog.cyble.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
age: 42
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
content-length: 57384
last-modified: Mon, 23 May 2022 20:31:50 GMT
server: cloudflare
etag: "121254f73060bcbb53ca13258dbd134f"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: binary/octet-stream
access-control-allow-origin: https://blog.cyble.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P9kOmBztmU6Mrgqcn74pXCL1jM%2Be0%2FHVK%2BVIDf9JqRZdHqaM7trxlaPg%2FnZW55gfffDc0WPa2vvMVjEq%2BTzyjd08TCKxwpijmZR6Jghl0ChJeedcVOn%2BhqIDMd9GvX5ztL2NlMZzmDF4%2B%2FNWtPTpkNTdqYLNWyE%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers: x-amz-server-side-encryption, x-amz-request-id, x-amz-id-2, x-origin
cache-control: max-age=120
access-control-allow-credentials: true
access-control-max-age: 3000
accept-ranges: bytes
cf-ray: 793c42a6fe06916e-FRA
x-amz-cf-id: RruG7D71OeRTDhTS3EJP-Kp6IvLoP9ctm3biLW7L-gfZlDCBvjBcow==

GET
H2 200 hawk.png
labs.cyble.com/hs-fs/hubfs/ Frame 05EC 10 KB
11 KB 91ms
37ms Image
image/png 2606:2c40::c73c:67e2
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://labs.cyble.com/hs-fs/hubfs/hawk.png?width=108&height=108

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:67e2 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

979338f4aa8d1de1b994be15531b85f1d9deef4d8da685bf18286d9928488520

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.hubspot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
strict-transport-security: max-age=31536000
via: 1.1 0fd782cbc1c3c43778f2ac89b2bfb444.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 168320
x-amz-cf-pop: IAD12-P2
cf-polished: origSize=13721, status=vary_header_present
x-amz-server-side-encryption: AES256
edge-cache-tag: F-83412232556,P-21289959,FLS-ALL
cache-tag: F-83412232556,P-21289959,FLS-ALL
x-amz-storage-class: INTELLIGENT_TIERING
x-cache: RefreshHit from cloudfront
x-hs-https-only: worker
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 15
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10237
last-modified: Tue, 31 Jan 2023 17:55:34 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "71a4b4d7a329d9270ca923d26543acd7"
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UaNtJVhuzlUXoMWrSWmu%2FGyk8Z9%2FlskooycaANQqkXYQpcAROZs%2ByQDGJOk46AtzD2w1%2FLIHQEmH2jrqkcR7EU2rQqIdNyT3W4VxlQdpzXjthYww4rZzJJ73LzOyJHa2H4hfd494ymhQzhht"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 793c42a79fa9361b-FRA
x-amz-cf-id: dl09iIAeBLVtcXdTrUO1QRlPLPZS33oW0T5_WZZYr3wUAyyByalTjA==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 15

POST
H2 204 rhumb
app.hubspot.com/api/cartographer/v1/ Frame 05EC 0
1 KB 131ms
131ms Ping
text/plain 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/api/cartographer/v1/rhumb?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.14472

Requested by

Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/conversations-visitor-ui/static-1.14472/bundles/visitor.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/8c157e92638742c880b891af5f9f3db3?uuid=a9e1a092500146b599822eb5ea599eca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=8c157e92638742c880b891af5f9f3db3&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 913d6411-5b25-411d-9ee3-bf4741f11208
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m8bRmEdJlumIDA%2BmQeZTi67VrtuP6wRMzZ07zPI%2B7HsJOA5i5kXsT3BdCiD8JHSjUyAh2hIXu4SwPdiHgPUwnLvAGkokKvdqmFPFRQyRMnmDxcesHezmCpp0ILs0t0UyE%2FJlEmYoFfZMUvkJVg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://app.hubspot.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet, X-HubSpot-Auth-Failure
access-control-max-age: 604800
access-control-allow-credentials: true
cf-ray: 793c42a74ba99c10-FRA
access-control-allow-headers: Authorization, Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer
timing-allow-origin: *

GET
H2 200 welcomeMessages Show response
app.hubspot.com/api/livechat-public/v1/bots/public/bot/2122156/ Frame 05EC 941 B
1 KB 151ms
150ms XHR
application/json 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/api/livechat-public/v1/bots/public/bot/2122156/welcomeMessages?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.14472&conversations-visitor-ui=static-1.14472&traceId=8c157e92638742c880b891af5f9f3db3&sessionId=AMOaWbL2p1Acton1B6oLeq-jlNRQO5VtUq5bNOcWXCLM_FsOgI3A2_ETlKcgdw2Ib7l7PaV9edLj5cgR8sCx6lai0mG2qIYtR2EKzewOsb9LG37qUSrIEuWvcmJP2axMRg4kIV0T4_3nzGtlp5JnL-YNBkx7_koryoJcWVT8-hDK_pUA6ff2W1s

Requested by

Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/head-dlb/static-1.255/bundle.production.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4669ed9aa250bc00f1f95697aa0bec3c1db89472c200b80cebc2fc173155b14a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/8c157e92638742c880b891af5f9f3db3?uuid=a9e1a092500146b599822eb5ea599eca&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=8c157e92638742c880b891af5f9f3db3&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 25405913-ac1d-4c9c-b3c7-c70d40e0332c
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
x-trace: 2BD60D828C4FD6ADBC56A442407BDF96484BF59E5A000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LHzjwd7wX6lAHqIyLFf3Bu20zvfBMs8ny4KOvHzgex9vIW9QYwbHBhtoluL5yhGe%2Fqbx2vwaU%2BnF6niJEoVrFEUL1wEhxxFGRNs%2Fuhx8fCRBtD%2B58Pi%2F9ANrFl2SfRCT3CQ0MD12010J4HuPoA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: false
cf-ray: 793c42a75bb69c10-FRA
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
351 B 144ms
130ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1858685340&v=1.1&a=21289959&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&t=Cyble+%E2%80%94+Vector+Stealer%3A+A+Gateway+for+RDP+Hijacking&cts=1675438777964&vi=3b1d5d9c688991054537ef2dccebb9b8&nc=true&u=27441379.3b1d5d9c688991054537ef2dccebb9b8.1675438777961.1675438777961.1675438777961.1&b=27441379.1.1675438777962&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: d3b14c31-ba76-4e2b-90a1-d8cb5521e33b
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nzibyN8NR58I5GTBpdzXi1eKj8k9nYdx9ogUvo5O2ELAYVPOFzXiVR98SaSLrZoVR4ll56zC0cgn9GyF5S3qrUYlP7GqivDNRd2LAzM3KuLyhbirAcEPvxCK2C2OGtS0ZI97sNsY30XuPS87fcqv"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 793c42aa68239c10-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
410 B 138ms
130ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=0ec222ff-8e22-4872-bc87-9257d0315afa&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1858685340&v=1.1&a=21289959&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&t=Cyble+%E2%80%94+Vector+Stealer%3A+A+Gateway+for+RDP+Hijacking&cts=1675438777965&vi=3b1d5d9c688991054537ef2dccebb9b8&nc=true&u=27441379.3b1d5d9c688991054537ef2dccebb9b8.1675438777961.1675438777961.1675438777961.1&b=27441379.1.1675438777962&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 49113e4b-b130-4eed-b3eb-f6080bb22534
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6zR0Fka%2B537I5YucRqoiHTynlkOoaPOP%2FdsD0mM%2FmcPKNdzcMOuxlLlFH685vU7dwsWwDpK0LOugKaSVRm%2FTDFZIp5k0wrZM1YlQUI%2FL6rQYxzAHtE2kUKWEFMc7hEP1%2B3CWyeUy0OfYD01FsnJ3"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 793c42aa681e9c10-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
363 B 140ms
132ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=17&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=0ec222ff-8e22-4872-bc87-9257d0315afa&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1858685340&v=1.1&a=21289959&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&t=Cyble+%E2%80%94+Vector+Stealer%3A+A+Gateway+for+RDP+Hijacking&cts=1675438777966&vi=3b1d5d9c688991054537ef2dccebb9b8&nc=true&u=27441379.3b1d5d9c688991054537ef2dccebb9b8.1675438777961.1675438777961.1675438777961.1&b=27441379.1.1675438777962&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 33bdd795-510a-4f2e-83b0-be86010ce3f4
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gduy8oVIGICXhNqXMVAYW0lxv%2BthUQ8Y7IHnLgH80VaKOtWV2tHCEGdq4MkUvINcGRbEjb40cJBWaeXiVrQGR9cdlOXmM%2F6%2FGGNGauKWMRGd%2FC%2BuG3QyRFbWUMNZg%2BMH%2B2tu1PGg8hgs1wTt7IHF"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 793c42aa68229c10-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
461 B 137ms
129ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=87c12750-e9ec-47f2-a107-0f72d3e38dae&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1858685340&v=1.1&a=21289959&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&t=Cyble+%E2%80%94+Vector+Stealer%3A+A+Gateway+for+RDP+Hijacking&cts=1675438777967&vi=3b1d5d9c688991054537ef2dccebb9b8&nc=true&u=27441379.3b1d5d9c688991054537ef2dccebb9b8.1675438777961.1675438777961.1675438777961.1&b=27441379.1.1675438777962&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 423ed9eb-bace-42c1-9c86-d6aac3fc55bf
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zSeac2w1%2B%2FstFIOnn8nh9OWTl2vj%2B2GNItQtrmfqgio04hiAPVRkAd87aCskIVCMwMsC5cHv2ZFWIUnuK8e16mFEDzqiFo8YfTafIwX60ko062%2FjFYhtnbVWEYfYFziHNjb00bv%2Br45SECaNFJQI"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 793c42aa68269c10-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
358 B 138ms
131ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=17&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=87c12750-e9ec-47f2-a107-0f72d3e38dae&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1858685340&v=1.1&a=21289959&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&t=Cyble+%E2%80%94+Vector+Stealer%3A+A+Gateway+for+RDP+Hijacking&cts=1675438777967&vi=3b1d5d9c688991054537ef2dccebb9b8&nc=true&u=27441379.3b1d5d9c688991054537ef2dccebb9b8.1675438777961.1675438777961.1675438777961.1&b=27441379.1.1675438777962&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 2c25b0d7-d671-42c1-b7b8-ef8e98e48409
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TjnSkiI8Y15T3n4W67hGUOOhSokOBXJr2qV%2Bgzw70bXqrNhIo1GycZuvw6z%2BoHwkeLF7TefgykC1cfr9CnRl5lCi7VcTVFMOzvo621d6RKW6%2FLejOYPIpieLDON%2BXvl6TdLf1aCTJAu2dgzOlox%2B"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 793c42aa68219c10-FRA
x-robots-tag: none

GET
H3 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 22 KB
5 KB 164ms
164ms XHR
application/json 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=21289959&utk=3b1d5d9c688991054537ef2dccebb9b8&__hstc=27441379.3b1d5d9c688991054537ef2dccebb9b8.1675438777961.1675438777961.1675438777961.1&__hssc=27441379.1.1675438777962&currentUrl=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe6589b7fa6bb8d64bf88da50c168dffb984252cfcd3421aef137de73d97bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 1bd72056-714e-4479-b501-951ddd88c6ec
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://blog.cyble.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3V5nyQILRxNiDZVttkdq8ijgoDchxk2SPH7%2BCFgw5isbevcRSyBU%2Fhn0sZ5zQtvtIXrPCUIOKSWBqeGHKyrVfBiRqa2EeKtoUNkj0%2B6GK35%2FbCXX%2FNMUzVsLQ%2BtfFvJBubVvdTW%2FCKMm0AhFaW1u"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 180
access-control-allow-credentials: false
cache-control: max-age=0, no-cache, no-store
x-robots-tag: none
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 793c42aa8a089a15-FRA

GET
H2 200 enterprise.js Show response
www.google.com/recaptcha/ 942 B
901 B 186ms
71ms Script
text/javascript 2a00:1450:400d:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise.js?render=explicit

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:808::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

133525dcf0069ee49fdfd1761ae7cc86679febf3e8c81fc3a357e2e5359933c1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 581
x-xss-protection: 1; mode=block
expires: Fri, 03 Feb 2023 15:39:38 GMT

GET
H3 200 __ptq.gif
track.hubspot.com/ 45 B
682 B 143ms
143ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=16&fi=790ac0ff-0b05-4061-9a47-31d43798706a&lfi=3647704&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1858685340&v=1.1&a=21289959&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&t=Cyble+%E2%80%94+Vector+Stealer%3A+A+Gateway+for+RDP+Hijacking&cts=1675438778175&vi=3b1d5d9c688991054537ef2dccebb9b8&nc=true&u=27441379.3b1d5d9c688991054537ef2dccebb9b8.1675438777961.1675438777961.1675438777961.1&b=27441379.1.1675438777962&cc=15

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: f8c985e2-b13e-4566-830c-2b8f2affa995
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u6dD5SBZ2jHLzHtFuj%2FXMqd%2FlJqrES0gTIzPCPbM6XRno4yHu%2BQclC2cu1XHcWc%2FG9ulPLkT8RcqDxsuVBoGRwCl4PhOxeuPTQ3pIK7KrRKwUyM3oQcoYKHBI85wwgM%2BrhID76Mga6MPDdIapcS%2F"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 793c42ab9dae9079-FRA
x-robots-tag: none

GET
H3 200 __ptq.gif
track.hubspot.com/ 45 B
643 B 144ms
144ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=16&fi=8af5df7f-7224-4e24-859c-130a9ca0ccda&lfi=3720108&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1858685340&v=1.1&a=21289959&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F%3Futm_content%3D236585065%26amp%3Butm_medium%3Dsocial%26amp%3Butm_source%3Dtwitter%26amp%3Bhss_channel%3Dtw-1141929006603866117&t=Cyble+%E2%80%94+Vector+Stealer%3A+A+Gateway+for+RDP+Hijacking&cts=1675438778175&vi=3b1d5d9c688991054537ef2dccebb9b8&nc=true&u=27441379.3b1d5d9c688991054537ef2dccebb9b8.1675438777961.1675438777961.1675438777961.1&b=27441379.1.1675438777962&cc=15

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:39:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: d31d3662-be3f-4ed2-89d9-caecb0401c07
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KjqyvnUHISkUpLE4BvrNW3EJRZbhrW9AtYnHlYn3Vp%2Bu%2BWX5H3GRFdYgiBe6S1JZqAZvcWvtgn0xvNnRTLIe3TFTYXCZnUn4Hso7gqmv9DvtXc87vlHCO0sE%2FAAbb4waD%2FTtljOmpyDrytnA9lWY"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 793c42ab9db09079-FRA
x-robots-tag: none

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/gEr-ODersURoIfof1hiDm7R5/ 406 KB
162 KB 163ms
48ms Script
text/javascript 2a00:1450:400d:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/gEr-ODersURoIfof1hiDm7R5/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise.js?render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:803::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7100633cff808ec01559c4579130f2d6cef8d43e7f02c56d727ed33787d30fb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.cyble.com/
Origin: https://blog.cyble.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 15:32:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 444
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 165540
x-xss-protection: 0
last-modified: Tue, 31 Jan 2023 02:51:47 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 03 Feb 2024 15:32:14 GMT

GET
H2 204 boom.gif
pixel.wp.com/ 0
37 B 6ms
6ms Image
text/plain 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/boom.gif?bilmur=1&cumulative_layout_shift=0.085&largest_contentful_paint=3035&batcache_hit=0&provider=wordpress.com&service=atomic&effective_connection_type=4g&rtt=0&downlink=9100&host_name=blog.cyble.com&url_path=%2F2023%2F02%2F01%2Fvector-stealer-a-gateway-for-rdp-hijacking%2F&nt_fetchStart=0&nt_domainLookupStart=1&nt_domainLookupEnd=17&nt_connectStart=17&nt_connectEnd=31&nt_secureConnectionStart=23&nt_requestStart=31&nt_responseStart=1782&nt_responseEnd=1796&nt_domLoading=1784&nt_domInteractive=2862&nt_domContentLoadedEventStart=2863&nt_domContentLoadedEventEnd=2897&nt_domComplete=4467&nt_loadEventStart=4467&nt_loadEventEnd=4487&nt_redirectCount=0&nt_nextHopProtocol=h2&nt_api_level=2&start_render=2545&first_contentful_paint=2545&resource_size=2652091&resource_transferred=587268&js_size=619674&js_transferred=185652&resource_cache_percent=0&js_cache_percent=0&last_resource_end=5178
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://blog.cyble.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 03 Feb 2023 15:39:40 GMT
cache-control: no-cache
server: nginx

Verdicts & Comments Add Verdict or Comment

165 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

23 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
blog.cyble.com/	1970-01-20 18:49:53	Name: _wsm_id_1_abdf Value: 0bff7bac0033b1d6.1675438776.1.1675438776.1675438776
blog.cyble.com/	1970-01-20 09:24:00	Name: _wsm_ses_1_abdf Value: *
.cyble.com/	1970-01-20 18:59:58	Name: _ga_4FJGSRPM4S Value: GS1.1.1675438776.1.0.1675438776.0.0.0
.cyble.com/	1970-01-20 18:59:58	Name: _ga Value: GA1.2.1022549137.1675438776
.cyble.com/	1970-01-20 09:25:25	Name: _gid Value: GA1.2.1883732833.1675438776
.cyble.com/	1970-01-20 09:23:58	Name: _gat_gtag_UA_201575643_1 Value: 1
.hubspot.com/	1970-01-20 09:24:00	Name: __cf_bm Value: .WFP7LRMYARHlDyLiLumcYp3zgL7A6amYxyIm6Uc80k-1675438777-0-AT5V7i/kgUtD421wM4PC64DvNi8G2FWJFLhaMizE3CTJ09fm4R1tavEfgNx+tTE+lu97WPWMUhO6fiKDbH0PW5I=
blog.cyble.com/	1970-01-20 09:25:25	Name: ln_or Value: eyI0MDUzMzk2IjoiZCJ9
.linkedin.com/	1970-01-20 10:07:10	Name: UserMatchHistory Value: AQIvzngeiMco1AAAAYYX7uPUbMkTy49o0gpkPzYbZ4ZOUpIEy1kzPTqL-kmEj7jOX1Zktpc7ZuAeVQ
.linkedin.com/	1970-01-20 10:07:10	Name: AnalyticsSyncHistory Value: AQLm97jE0nOmQgAAAYYX7uPUJZsaudC9LEC9n8PuVqV9_NynXbQHG1DPWnXS_d01ceqvQ3nX87N-R6Ddto9XAg
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 18:09:34	Name: bcookie Value: "v=2&ea8a733b-8656-44d0-8e3f-3a05fb2b3dd1"
.linkedin.com/	1970-01-20 09:25:25	Name: lidc Value: "b=OGST08:s=O:r=O:a=O:p=O:g=2478:u=1:x=1:i=1675438777:t=1675525177:v=2:sig=AQEewEvEyFo1O5GcbOArbNy5Yz4ylPEb"
.blog.cyble.com/	1970-01-20 13:43:10	Name: messagesUtk Value: 8c157e92638742c880b891af5f9f3db3
.labs.cyble.com/	1970-01-20 09:24:00	Name: __cf_bm Value: za39vFhUEg5bJRtaw6yPbuZjM5dQ1MQCFygX2hP7i70-1675438777-0-AQBqcWUUmNVNw/6Q9ECXwBnzZNHXEAnKGrGClrfnOkRYjnRHsL+yikwfQ005ODnSnIxOd/TglCaLp1ybutZgYgU=
.labs.cyble.com/	1969-12-31 23:59:59	Name: __cfruid Value: 506327e48c9bacda68369a66aa78df280590fd92-1675438777
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 18:09:34	Name: bscookie Value: "v=1&202302031539374b439c8d-38d1-4899-88da-86d184136146AQFzx3gm9dmhhOK1Oi2A5gN1OkZYxzyQ"
.linkedin.com/	1970-01-20 13:43:10	Name: li_gc Value: MTswOzE2NzU0Mzg3Nzc7MjswMjE5OK66R2IvGOZGtN+uLuYS2LXdyscteGcUfEYoqMveDg==
.cyble.com/	1970-01-20 13:43:10	Name: __hstc Value: 27441379.3b1d5d9c688991054537ef2dccebb9b8.1675438777961.1675438777961.1675438777961.1
.cyble.com/	1970-01-20 13:43:10	Name: hubspotutk Value: 3b1d5d9c688991054537ef2dccebb9b8
.cyble.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.cyble.com/	1970-01-20 09:24:00	Name: __hssc Value: 27441379.1.1675438777962

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.hubapi.com
api.hubspot.com
app.hubspot.com
blog.cyble.com
cdn.linkedin.oribi.io
d.adroll.com
fonts-api.wp.com
fonts.wp.com
forms-na1.hsforms.com
forms.hsforms.com
forms.hubspot.com
i0.wp.com
injection.amibreached.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsforms.net
js.hsleadflows.net
js.usemessages.com
labs.cyble.com
pixel.wp.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
s.adroll.com
s0.wp.com
snap.licdn.com
static.hsappstatic.net
stats.g.doubleclick.net
stats.wp.com
track.hubspot.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
13.107.42.14
192.0.76.3
192.0.77.2
192.0.77.32
192.0.78.213
2001:4860:4802:34::36
2600:9000:211a:2600:6:9280:1080:93a1
2600:9000:2304:dc00:2:53b2:240:93a1
2606:2c40::c73c:67e2
2606:4700:20::681a:d31
2606:4700:4400::ac40:9a55
2606:4700::6810:5805
2606:4700::6810:5905
2606:4700::6811:47b0
2606:4700::6811:74b0
2606:4700::6811:7d2
2606:4700::6811:82ab
2606:4700::6811:b949
2606:4700::6811:c8cc
2606:4700::6811:d4cc
2606:4700::6811:e8cc
2606:4700::6811:edcc
2606:4700::6813:9b53
2620:1ec:21::14
2a00:1450:400d:803::2003
2a00:1450:400d:803::2008
2a00:1450:400d:806::200e
2a00:1450:400d:808::2004
2a00:1450:4025:401::9d
2a02:26f0:11a::217:9a4a
2a05:d018:cc3:fe04:7036:b4fb:4707:a1df
014b2b1c41f3a79609ab3dc05b4de33205240052b0f2bc7715415eacaad638f3
03e71e9c054be9e6f810f0ec721bc2ca83fcd89552f853f1a55324125debe474
05096f7a0e9de1566ba03be810da6d252f233a7c999021d5f2f3aa975e92ab0f
0f12c37bfbe94e5c37d4c4a0ab301f496683db922639b0e43f2b9977492fe57b
126e49202a802145638386936ee612ef9b0519387c0e7788267c877200668c3f
133525dcf0069ee49fdfd1761ae7cc86679febf3e8c81fc3a357e2e5359933c1
138154c0deed3326477b9b4909175101070a5a3a95342291b53d8cc9879a5f47
186cb05caa2a06748336b3123d7ac53986a650cffcab18f34e5c0ee3c057f591
1e6ebf687f918671709224ad3047910b592542de487e4a38209f42d58b0062a5
1f1cb60892b45c8e44a0f4222e01af33655dfb7c0e81dd8d937c6d44c38bb632
2616becd1fa25433adee513644da53245e542892264edc46b611ebc3c9e2d9ed
28f2395d87ba8c5346a6eab7e24a9a0fc211cf4fd12f7cd2436a5d39bac4ae24
29d409fee0f34ebc05fa36076c101b77e28dccbcfdbfbf4cf248371820ca9ddb
2dfbd972f157603affc32572b9feb512ef6ac1a5da01cee30febd05e4742d926
2e77cbf4626dd2563752e49f945292d89532160815b80125ba37f31b3bfcdb20
335ce4e6754eba0c0e787ecc04106b607684cc8c6785fc5eb5f02461d0708fc7
34bbd1c367ffc7d80fcff86c7e5f8777e70f4911bb324e8ecfc7dd3604a96e68
359c32724ded3d649d66332ac70da65306ff8c45ff08f9d0e253ae1fd175e109
362430985ee3a7b1b5ee7d50d505b033e7e476a1b1424fe0df0a83ecf426e447
382e9768b5578d5ad05e51e37670a3cf93d4593a49bcbee1f5e8b66d0d8c1c53
3999cf864b43937c278afeae5b60b6db69bb234d5641202c9e7a2385029aa3b7
39e5a17105d5cd2a65e6d1a7b6a65afec887c339c3626016ed33265db4206be0
3f8a97378fe9cafa10d7ef0ef06a79cba5044b1664d2276b8f65fdd74435bb03
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
4669ed9aa250bc00f1f95697aa0bec3c1db89472c200b80cebc2fc173155b14a
49fc1f989eb551498525c12acfec4533c2e0c484f8a80d49cf95d16092db836a
4acadd6be157476c80a0d0ce659b0a8033c2253f689cc84aa11a3597cea382ab
51dc1ea3b9642d966bbdf2c63346e4d2d3f668a693fa8e7f1e31bf6acbe48860
534fd5b9e499e6f74045f4bb61b214e928b4b57e4b4e1767554350626046a7c4
53c192dc46187ef72bb5623c417ad7e6a7cbf2c2ca98f58647704c78b0fb0579
5736f20e2a413433b3af338e6cccd1318197981ce66e68ac810e723ccbf9c10c
58cc3b65706bfd08a91d79d29efd7deeb284716dd9dde2123c32bf20aac754f5
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
5dd1d4901a2aa0c9c999e4666f76cfaad441a0e75affd1b4be6bbc754e73e6ba
691fa7d17effc7d303eda0ad7e4a1d91b2f375506cfc8a774480cc2b55f156ea
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
70a02077b52f46333bcb6c385a653e78da10ae69814c1df35bf4ee343efcc928
7100633cff808ec01559c4579130f2d6cef8d43e7f02c56d727ed33787d30fb9
7456da3103391af6bdfc24a3e8f51747d767c7970860290fb91c619cc18eaded
7883c3cfb3f71df2ec3c0574dd83d0b6849a12248b6b9142ea99752636310a47
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
81ca0d70f50ab00f0c1e0933c11bf7bb6aada2366994784564f4d324dfd7a60c
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
82dbeea789c21359a9d808969f52d40a37ac85078a6cd1cbee0e702314c46997
84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
87f9919b79803a6cf52adbe417a25543fa3967566cb08320ea54cfdb2b02e98d
90b705145ef82e9d8493aae55c9bfb3200ec0620c8946b20b0b28366557d6a4a
91144fbcc0e3f609b021e362ec29d2a9b58f15e840f229eb99ea2c04d927882b
92986d66f075209e933031c072211f82c4dffdfd374a3ef870a648505c789789
963563d75d17a3c2b444ad4d73e3e9c24a43f6f9e121cce484aa6c7d197af73c
979338f4aa8d1de1b994be15531b85f1d9deef4d8da685bf18286d9928488520
97aacc23e98a5c2edc61d17068c903d829cbe8144c8e86517164d4895d66b768
984d8a00a23b717ad2d084139b7a0880fb888e7c9030a11f5e3bfde3670ffa68
9af44543fbf7b09c3d68e46dcb21d2cb9ec5f18bbd537cea92360a85c5db793e
9d904f71a4d973dac278821490969eb0a63dd97635584930bbbbec0a3e608d75
a2937f3299d73f3d0c53f0b73b582b3ff16495bf9efc133f3195dcc5c2341ed2
a2c197367cb631f88fca96c13ec0c06d0a99bc5398d0349716bc06ce7a91e8ce
a9c399a3695f864f52665163ff94626e3b77b44747e1519b03e5f82597b004d7
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af4d8295ed405b08a948022d81e7fe9048305144f193c11aba9dc53229758199
bbdb1d21246d1c1a65aca8b41818f593b2d4704a459983866c0d331151b91887
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355
c1e93246e1f3ea9a11fa1a6d7c14e48a1da911f92043e2e6ef59da5ffd38f070
c27a8d0abc42f5fcd3a4ad9480ca7bd1bbe1fcb23d5438b4420f1cbcab3ecc9f
c77d2ba289d0e2827ad7f79b00972a63c7f4426d89b8ce6b5da90a368760cfe4
c7d0240fd43289ab1411c5fa1277574ee436d3a3bbb82d34c4d82f32d04517b8
cc3d9b48ade62658f38947ea0f07656bfb10ffa92277d9f1cd23666c2e669f1b
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
ccd69c27d47887045e48ebbcd389d285a08d6cddf4b0c3d0e86070c35cceb1bd
cf0f269822bcabfc036e1feff8b5e54ab270b568484d254abf7493cb266be05d
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
e1b2299955d137982d8e6eefb796b9bb4435ac23cf156ef9054b1c91fabcb1ae
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee3d3fafc874740d773a711482d0ace893f213475c290a38c3c1054e120c0020
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef896b86a77ae191af41c2714906decbab4bbb7fd32321c14f4f398eb7f264ba
f07f7cbfb75dd384727772e9d8cde9f24e4de5d07bdcc54c3f3457600b4b2924
f0c28929bac6b6d68ff853ec4982611efbb6281133ff3af6098c223704912f79
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f7455fff3d4e08245186e113636f69cbc44679bdf8870de5e4fd9a835e3d2e93
f8392cf8d00ac45d817b2b02ee0bd33f1bcb59fd135568e3fb5df5ca3042101e
fd43cd92e272c2e3872abd9559900116d85f2899e76c00015c59360060bcf062
fe6589b7fa6bb8d64bf88da50c168dffb984252cfcd3421aef137de73d97bd6b

blog.cyble.com Open in urlscan Pro 192.0.78.213 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

103 Requests

98 %HTTPS

84 %IPv6

24 Domains

38 Subdomains

31 IPs

4 Countries

2876 kBTransfer

9282 kBSize

23 Cookies

26 Outgoing links

Redirected requests

103 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

blog.cyble.com Open in urlscan Pro
192.0.78.213 Public Scan

Screenshot
Live screenshot

Full Image

103
Requests

98 %
HTTPS

84 %
IPv6

24
Domains

38
Subdomains

31
IPs

4
Countries

2876 kB
Transfer

9282 kB
Size

23
Cookies

103 HTTP transactions
1 data transactions