URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Submission: On February 07 via api from DE — Scanned from DE

Summary

This website contacted 31 IPs in 4 countries across 24 domains to perform 103 HTTP transactions. The main IP is 192.0.78.183, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is blog.cyble.com.
TLS certificate: Issued by R3 on January 21st 2023. Valid for: 3 months.
This is the only time blog.cyble.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
28 192.0.78.183 2635 (AUTOMATTIC)
5 192.0.77.32 2635 (AUTOMATTIC)
2 2a00:1450:400... 15169 (GOOGLE)
6 192.0.77.2 2635 (AUTOMATTIC)
3 2606:4700::68... 13335 (CLOUDFLAR...)
9 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 192.0.76.3 2635 (AUTOMATTIC)
1 5 2600:9000:211... 16509 (AMAZON-02)
4 2606:4700::68... 13335 (CLOUDFLAR...)
2 2001:4860:480... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 2a05:d018:cc3... 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
14 2606:4700::68... 13335 (CLOUDFLAR...)
1 2001:4860:480... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:402... 15169 (GOOGLE)
1 2a02:26f0:11a... 20940 (AKAMAI-ASN1)
1 2600:9000:230... 16509 (AMAZON-02)
3 3 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
5 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:2c40::c7... 209242 (CLOUDFLAR...)
103 31
Apex Domain
Subdomains
Transfer
29 cyble.com
blog.cyble.com
labs.cyble.com
724 KB
14 hubspot.com
api.hubspot.com — Cisco Umbrella Rank: 4596
forms.hubspot.com — Cisco Umbrella Rank: 2937
track.hubspot.com — Cisco Umbrella Rank: 2152
app.hubspot.com — Cisco Umbrella Rank: 5253
32 KB
14 wp.com
fonts-api.wp.com — Cisco Umbrella Rank: 14322
i0.wp.com — Cisco Umbrella Rank: 2986
s0.wp.com — Cisco Umbrella Rank: 6656
stats.wp.com — Cisco Umbrella Rank: 2634
fonts.wp.com — Cisco Umbrella Rank: 15194
pixel.wp.com — Cisco Umbrella Rank: 2462
778 KB
9 amibreached.com
injection.amibreached.com
264 KB
6 adroll.com
s.adroll.com — Cisco Umbrella Rank: 2416
d.adroll.com — Cisco Umbrella Rank: 1473
82 KB
5 hsappstatic.net
static.hsappstatic.net — Cisco Umbrella Rank: 6555
294 KB
5 hsforms.com
forms.hsforms.com — Cisco Umbrella Rank: 3843
forms-na1.hsforms.com — Cisco Umbrella Rank: 6017
13 KB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 353
www.linkedin.com — Cisco Umbrella Rank: 575
px4.ads.linkedin.com — Cisco Umbrella Rank: 6074
4 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 21
region1.google-analytics.com — Cisco Umbrella Rank: 2456
20 KB
3 hsforms.net
js.hsforms.net — Cisco Umbrella Rank: 5772
474 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 40
109 KB
1 gstatic.com
www.gstatic.com
162 KB
1 google.com
www.google.com — Cisco Umbrella Rank: 2
901 B
1 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 814
376 B
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 707
5 KB
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 78
345 B
1 hubapi.com
api.hubapi.com — Cisco Umbrella Rank: 3237
877 B
1 hs-banner.com
js.hs-banner.com — Cisco Umbrella Rank: 2011
63 KB
1 hsleadflows.net
js.hsleadflows.net — Cisco Umbrella Rank: 4028
87 KB
1 hs-analytics.net
js.hs-analytics.net — Cisco Umbrella Rank: 2004
20 KB
1 hscollectedforms.net
js.hscollectedforms.net — Cisco Umbrella Rank: 4350
25 KB
1 hsadspixel.net
js.hsadspixel.net — Cisco Umbrella Rank: 2974
3 KB
1 usemessages.com
js.usemessages.com — Cisco Umbrella Rank: 4498
21 KB
1 hs-scripts.com
js.hs-scripts.com — Cisco Umbrella Rank: 2109
993 B
103 24
Domain Requested by
28 blog.cyble.com blog.cyble.com
9 injection.amibreached.com blog.cyble.com
injection.amibreached.com
7 track.hubspot.com
6 i0.wp.com blog.cyble.com
5 static.hsappstatic.net app.hubspot.com
static.hsappstatic.net
5 s.adroll.com 1 redirects blog.cyble.com
s.adroll.com
4 forms.hsforms.com js.hsforms.net
blog.cyble.com
3 app.hubspot.com js.usemessages.com
static.hsappstatic.net
3 js.hsforms.net blog.cyble.com
js.hsforms.net
2 px.ads.linkedin.com 2 redirects
2 forms.hubspot.com js.hscollectedforms.net
js.hsleadflows.net
2 api.hubspot.com js.usemessages.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 pixel.wp.com blog.cyble.com
2 fonts.wp.com fonts-api.wp.com
2 www.googletagmanager.com blog.cyble.com
www.googletagmanager.com
2 fonts-api.wp.com blog.cyble.com
1 labs.cyble.com
1 www.gstatic.com www.google.com
1 www.google.com js.hsleadflows.net
1 px4.ads.linkedin.com
1 www.linkedin.com 1 redirects
1 cdn.linkedin.oribi.io snap.licdn.com
1 snap.licdn.com js.hsadspixel.net
1 stats.g.doubleclick.net www.google-analytics.com
1 api.hubapi.com js.hsadspixel.net
1 region1.google-analytics.com www.googletagmanager.com
1 forms-na1.hsforms.com blog.cyble.com
1 d.adroll.com s.adroll.com
1 js.hs-banner.com js.hs-scripts.com
1 js.hsleadflows.net js.hs-scripts.com
1 js.hs-analytics.net js.hs-scripts.com
1 js.hscollectedforms.net js.hs-scripts.com
1 js.hsadspixel.net js.hs-scripts.com
1 js.usemessages.com js.hs-scripts.com
1 stats.wp.com blog.cyble.com
1 js.hs-scripts.com blog.cyble.com
1 s0.wp.com blog.cyble.com
103 38
Subject Issuer Validity Valid
tls.automattic.com
R3
2023-01-21 -
2023-04-21
3 months crt.sh
*.wp.com
Sectigo ECC Domain Validation Secure Server CA
2022-11-14 -
2023-12-15
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-01-09 -
2023-04-03
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-06-15 -
2023-06-15
a year crt.sh
s.adroll.com
Amazon
2022-07-03 -
2023-08-01
a year crt.sh
d.adroll.com
Amazon RSA 2048 M01
2022-11-08 -
2023-12-07
a year crt.sh
hubspot.com
Cloudflare Inc ECC CA-3
2023-02-05 -
2024-02-05
a year crt.sh
hubapi.com
Cloudflare Inc ECC CA-3
2022-05-07 -
2023-05-07
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-01-09 -
2023-04-03
3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
linkedin.oribi.io
Amazon
2022-07-07 -
2023-08-06
a year crt.sh
www.google.com
GTS CA 1C3
2023-01-09 -
2023-04-03
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2023-01-09 -
2023-04-03
3 months crt.sh
hsappstatic.net
Cloudflare Inc ECC CA-3
2022-05-10 -
2023-05-10
a year crt.sh
labs.cyble.com
Cloudflare Inc ECC CA-3
2022-07-18 -
2023-07-17
a year crt.sh

This page contains 5 frames:

Primary Page: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Frame ID: B5A4EB78092F78C0F407A8060566A53C
Requests: 84 HTTP requests in this frame

Frame: https://js.hsforms.net/forms/v2.js
Frame ID: 52F5A1AE9C90D8BC1EB40059296AC4CD
Requests: 1 HTTP requests in this frame

Frame: https://js.hsforms.net/forms/v2.js
Frame ID: 2BAC36CE3EB0C0D79ED6495A936235AF
Requests: 1 HTTP requests in this frame

Frame: https://injection.amibreached.com/stats.json
Frame ID: 6CD41A5E4545F131BD376786D1CE3E15
Requests: 8 HTTP requests in this frame

Frame: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/f8ba518128bb44b68924c2ca387494be?uuid=db4a7d690e5343bbada18ee5b79462c1&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=f8ba518128bb44b68924c2ca387494be&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Frame ID: 20FB9B323F87A893C5B1BAF2D2B23135
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Cyble — Massive Ransomware Attack Targets VMware ESXi Servers

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]+s\d+\.wp\.com
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • (?:a|s)\.adroll\.com

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • js\.hs-analytics\.net/analytics

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

103
Requests

98 %
HTTPS

84 %
IPv6

24
Domains

38
Subdomains

31
IPs

4
Countries

3179 kB
Transfer

9564 kB
Size

23
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 43
  • https://s.adroll.com/j/exp/ELNAF2EZDFHJRAP3ODLCUU/index.js HTTP 302
  • https://s.adroll.com/j/exp/index.js
Request Chain 84
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1675767913239&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4053396%26time%3D1675767913239%26url%3Dhttps%253A%252F%252Fblog.cyble.com%252F2023%252F02%252F06%252Fmassive-ransomware-attack-targets-vmware-esxi-servers%252F%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1675767913239&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1675767913239&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&liSync=true&e_ipv6=AQIjM3ct7OpEFQAAAYYrjR3X9kDD2wAgJ9BUxsSRPuSNkN6qMj_mrCtacKF8T5ZXVAW3AX89eO1GjwXjcCV5ODAA0WsDWg

103 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
319 KB
66 KB
Document
General
Full URL
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
a3bfa651e02b66cada04727b09bc94fbeb60e7e28d141d24c5315181ca052dff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=72, must-revalidate
cf-edge-cache
cache,platform=wordpress
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 07 Feb 2023 11:05:10 GMT
host-header
WordPress.com
last-modified
Tue, 07 Feb 2023 11:01:22 GMT
link
<https://blog.cyble.com/wp-json/>; rel="https://api.w.org/" <https://blog.cyble.com/wp-json/wp/v2/posts/15619>; rel="alternate"; type="application/json" <https://wp.me/pbX1h1-43V>; rel=shortlink
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding Cookie
x-ac
2.hhn _atomic_ams BYPASS
x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
x-nananana
Batcache-Hit
x-pingback
https://blog.cyble.com/xmlrpc.php
/
blog.cyble.com/_static/
2 MB
204 KB
Stylesheet
General
Full URL
https://blog.cyble.com/_static/??-eJylVO12qyAQfKFSEo0x+dFznwVhY7dB1sPH8eTt72pNa05KWts/6sLMMAyLQy80uQguyvgKHQSpQvSKnwFikDoE2aHDE4KRJz8hzTOPPPPM0/BJ7m1q0QXZJi4b8K1sElojG0v6LCw2XvmLDPFiIUe16kIpitajuQWi0zYZtvbGZsCgAstOmbkseqaDFxZapS9Lh1k2zy3r3+9KW04LdY48kDe9hxBEiCoG0SmnWrbae5ryfRjKKyjD2BNR5NdslfzyfDKQnOKdBm9DAjLsXe5jXkxjj2L50s6jLkm9JWWWxJHRU4iiqjeHb9eZMvvhWldyshE7FeE+PCaJUSVxC4hf2j4W2+3as+OOlAOalj2Im11kdN4g9kqfZUcmWRgP7AyZtrk6nS6xUMaQW36LfamPh1qDroqmqERZ1LuiLDcrNnwoj9Ua+G5TroHvN3fquRjmCGUgjcq+d+tNkRPSRGcE4Siihs8+WtXp46U5MUioAQJ1swwPzPXfxfjf4sy66/elTiCLDy/INdcRPH+P0H/dy3ZfV1W5K/b1f7+7VUI=
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
58cc3b65706bfd08a91d79d29efd7deeb284716dd9dde2123c32bf20aac754f5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Tue, 07 Feb 2023 11:05:11 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Sat, 04 Feb 2023 18:11:07 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"7a59d1797653b4cfa7a04fa75b6b2111"
vary
Accept-Encoding
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
host-header
WordPress.com
css
fonts-api.wp.com/
3 KB
669 B
Stylesheet
General
Full URL
https://fonts-api.wp.com/css?family=Open+Sans%3A400%2C&display=fallback&ver=4.0.2
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
0f12c37bfbe94e5c37d4c4a0ab301f496683db922639b0e43f2b9977492fe57b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:10 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
gzip
cross-origin-resource-policy
cross-origin
x-xss-protection
0
x-nc
BYPASS hhn 2
last-modified
Tue, 07 Feb 2023 10:28:59 GMT
server
nginx
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
css
fonts-api.wp.com/
72 KB
3 KB
Stylesheet
General
Full URL
https://fonts-api.wp.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.1.1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
53c192dc46187ef72bb5623c417ad7e6a7cbf2c2ca98f58647704c78b0fb0579
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:10 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
gzip
cross-origin-resource-policy
cross-origin
x-xss-protection
0
x-nc
BYPASS hhn 2
last-modified
Tue, 07 Feb 2023 10:36:09 GMT
server
nginx
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
videopress-token-bridge.js
blog.cyble.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-videopress/build/lib/
878 B
545 B
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-videopress/build/lib/videopress-token-bridge.js?ver=0.10.8
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
2616becd1fa25433adee513644da53245e542892264edc46b611ebc3c9e2d9ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:10 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 14 Nov 2022 21:17:26 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"6372b066-36e"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.min.js
blog.cyble.com/wp-includes/js/jquery/
88 KB
31 KB
Script
General
Full URL
https://blog.cyble.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:10 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Mon, 19 Sep 2022 14:16:24 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"632879b8-15e54"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
/
blog.cyble.com/_static/
20 KB
6 KB
Script
General
Full URL
https://blog.cyble.com/_static/??-eJx1jUsKwzAMRC9UJfSTZFV6lGAc1diNJVeSMb19k5JtYWA28960ApH8WhfUPm15V5TPUZBjEGfY5Uhd0lMr4JkMyfqy1hBJ+8ayFEFVUHOmkB25gAJFeNf5qsZ5fsqGzUn/SDzzKyIQW/S4Y7/98frI9/M4DcP1dhmnLwxDQVA=
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
82dbeea789c21359a9d808969f52d40a37ac85078a6cd1cbee0e702314c46997
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Tue, 07 Feb 2023 11:05:10 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Sat, 04 Feb 2023 18:11:07 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"9a121e33c9fcb9609f70d3536458e3a7"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000
host-header
WordPress.com
js
www.googletagmanager.com/gtag/
110 KB
43 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-201575643-1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:808::2008 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
9a9f486dbced5fc30452e0967ddcc344a2efde5d0b5e4b2e7e32302e14a58235
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43941
x-xss-protection
0
last-modified
Tue, 07 Feb 2023 09:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 07 Feb 2023 11:05:12 GMT
Cyble-CIRIL-pyyv4ww1nowvginyhq7nrmlg0x8pxv1qcifo3udnvq.png
blog.cyble.com/wp-content/uploads/elementor/thumbs/
4 KB
5 KB
Image
General
Full URL
https://blog.cyble.com/wp-content/uploads/elementor/thumbs/Cyble-CIRIL-pyyv4ww1nowvginyhq7nrmlg0x8pxv1qcifo3udnvq.png
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef896b86a77ae191af41c2714906decbab4bbb7fd32321c14f4f398eb7f264ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:11 GMT
strict-transport-security
max-age=31536000
x-ac
2.hhn _atomic_ams BYPASS
last-modified
Sat, 10 Dec 2022 19:16:39 GMT
server
nginx
etag
"6394db17-11bc"
access-control-allow-methods
GET, HEAD
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
4540
expires
Tue, 14 Feb 2023 11:05:11 GMT
subscribe-to-CRIL.jpg
i0.wp.com/blog.cyble.com/wp-content/uploads/2021/11/
16 KB
16 KB
Image
General
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2021/11/subscribe-to-CRIL.jpg
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
382e9768b5578d5ad05e51e37670a3cf93d4593a49bcbee1f5e8b66d0d8c1c53
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc
HIT hhn 3
date
Tue, 07 Feb 2023 11:05:12 GMT
x-content-type-options
nosniff
last-modified
Sat, 10 Dec 2022 20:48:17 GMT
server
nginx
etag
"90f4a9863ca68d73"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<http://blog.cyble.com/wp-content/uploads/2021/11/subscribe-to-CRIL.jpg>; rel="canonical"
content-length
16232
expires
Tue, 10 Dec 2024 08:48:17 GMT
v2.js
js.hsforms.net/forms/
505 KB
159 KB
Script
General
Full URL
https://js.hsforms.net/forms/v2.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:b749 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5736f20e2a413433b3af338e6cccd1318197981ce66e68ac810e723ccbf9c10c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:11 GMT
x-amz-version-id
JAvvLYrbAadG1K4h0HWbN.C2V4PipDw0
via
1.1 46e2fa2a811f54853547788992d9aca0.cloudfront.net (CloudFront)
cf-cache-status
EXPIRED
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
IAD55-P3
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=forms-embed/static-1.2642/bundles/project-v2.js&cfRay=795ba62418f33a8e-IAD
x-cache
Hit from cloudfront
cache-tag
staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
content-encoding
br
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Fri, 03 Feb 2023 10:10:35 UTC
server
cloudflare
etag
W/"bc37deecb11dd26ba785db0381926c28"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M3GZfVBXzXGeITHVxZIVwUO1iBDPTJdJSjgXYufjwC7QQ7LLCHT7nnwQbZHdBsRsEuWRINw4L3nKgcV2Egi8WPCudE4Nwpzw54s5fxDVPzFwMgNEwnwqWmvO8Z2phIsPn7qLRSeh8Z3w3W1i"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-hs-cache-status
HIT
cache-control
s-maxage=600, max-age=300
cf-ray
795ba62418f33a8e-FRA
x-amz-cf-id
fJ-zx-Z71kP3gwXBKKfi9mmhdktLJC_ko4JP8rOqNjP6ZD8qGPzzuA==
x-hs-target-asset
forms-embed/static-1.2642/bundles/project-v2.js
aib-injectable.js
injection.amibreached.com/
2 KB
1 KB
Script
General
Full URL
https://injection.amibreached.com/aib-injectable.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
186cb05caa2a06748336b3123d7ac53986a650cffcab18f34e5c0ee3c057f591
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:11 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
6602
x-amz-cf-pop
FRA56-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:50 GMT
server
cloudflare
etag
W/"662ed2e07a2c9b151332e0a8da3b9922"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XB%2BfcQ5dzWGzlFQ6tB8tuSffiamMuAQw6dxLEfUJD9D%2FkB4846zNrh06S0T6ablspxvWL6LyQJVDZJpMowGZG8fC8So%2BTtd7siOv5n3nPdBiFU%2F%2FAYysKSiyZszDL6gJOC%2BabNqCHYbXJ3DTIBjotYX%2FNO%2Bg7Gk%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=120
cf-ray
795ba625ca05377b-FRA
x-amz-cf-id
xmKKhCuoEMq5YL975ZuxHb_TGMhsbTkaAz4qqblSrqJUFBqFGZ27xA==
Cyble-Black-Logo-pgc6refcqrafz6dvgr4i3sq3uvztw8xaslgdchelt6.png
blog.cyble.com/wp-content/uploads/elementor/thumbs/
3 KB
3 KB
Image
General
Full URL
https://blog.cyble.com/wp-content/uploads/elementor/thumbs/Cyble-Black-Logo-pgc6refcqrafz6dvgr4i3sq3uvztw8xaslgdchelt6.png
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
05096f7a0e9de1566ba03be810da6d252f233a7c999021d5f2f3aa975e92ab0f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
strict-transport-security
max-age=31536000
x-ac
2.hhn _atomic_ams BYPASS
last-modified
Sat, 10 Dec 2022 19:08:28 GMT
server
nginx
etag
"6394d92c-c9d"
access-control-allow-methods
GET, HEAD
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
3229
expires
Tue, 14 Feb 2023 11:05:12 GMT
wp-emoji-release.min.js
blog.cyble.com/wp-includes/js/
18 KB
5 KB
Script
General
Full URL
https://blog.cyble.com/wp-includes/js/wp-emoji-release.min.js?ver=6.1.1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:11 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Tue, 12 Apr 2022 05:56:23 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"62551487-48b9"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
bilmur.min.js
s0.wp.com/wp-content/js/
7 KB
3 KB
Script
General
Full URL
https://s0.wp.com/wp-content/js/bilmur.min.js?m=202306
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
51dc1ea3b9642d966bbdf2c63346e4d2d3f668a693fa8e7f1e31bf6acbe48860

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Tue, 07 Feb 2023 11:05:11 GMT
content-encoding
br
x-ac
2.hhn _dfw MISS
server
nginx
etag
W/"63bbf1d2-1a69"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Tue, 06 Feb 2024 00:00:00 GMT
/
blog.cyble.com/_static/
38 KB
8 KB
Stylesheet
General
Full URL
https://blog.cyble.com/_static/??-eJyVjMsOwiAQRX9IOqmJlY3xWyi9NugwEAbC7xcTXblyee7j9Gx8kgqplLntQZTAiINTIaeKqsRhpccYGdehKYK8KhXsjV2ZYpBp8Kn/ip6o2fkXxbQ1hpJ3JTUFk/aQUczaZGP8/f4U5hu8Bfd4m5freb5Yu9gDLeFQRA==
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1e6ebf687f918671709224ad3047910b592542de487e4a38209f42d58b0062a5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Tue, 07 Feb 2023 11:05:11 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Tue, 27 Dec 2022 16:34:28 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"35b150a0a020bb35697e5bd7022fc4d7"
vary
Accept-Encoding
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
host-header
WordPress.com
/
blog.cyble.com/_static/
22 KB
6 KB
Script
General
Full URL
https://blog.cyble.com/_static/??-eJxdjV0KwjAQhC9kugSq9kU8isRkYxPzR3ZD8fYmUhD6MgMz++1sReicGBNDCe3lEoFHLkq/IWbTAhKMXmkWNtcInmC4IP70bvJ02v4feMXYAUVcVVdCpgFEl5x1aMDW36GZenJAj+MPlzQ8mwsGypo5p9129B5v8nKd5Vkuy/wFCrJJTg==
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
4acadd6be157476c80a0d0ce659b0a8033c2253f689cc84aa11a3597cea382ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Tue, 07 Feb 2023 11:05:11 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 19 Jan 2023 18:11:24 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"361dba76d983ecc5cb3262baee441f6e"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000
host-header
WordPress.com
21289959.js
js.hs-scripts.com/
3 KB
993 B
Script
General
Full URL
https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.19
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:d4cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d5d79b34f9adaf4c8c43ec93b7c80d8e401310d378d3fa48bdd0fee1e3c56f9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
content-encoding
br
cf-cache-status
EXPIRED
last-modified
Tue, 07 Feb 2023 11:02:45 GMT
server
cloudflare
x-hubspot-correlation-id
12a42aa5-ec88-4467-a02b-0d3af9bf5384
x-trace
2B4C4B53CDCD26D2BDA6CBF3A3536F41B5B771B3E3000000000000000000
vary
origin, Accept-Encoding
access-control-max-age
3600
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
cache-control
public, max-age=60
access-control-allow-credentials
true
cf-ray
795ba62a5b943602-FRA
expires
Tue, 07 Feb 2023 11:06:12 GMT
/
blog.cyble.com/_static/
293 KB
78 KB
Script
General
Full URL
https://blog.cyble.com/_static/??-eJytU1lywjAMvVCNgaQsH50ehXFiEQyOlVo2FE5fZYPMFEKH6U8cS/JbLPlUiRxdABdkrCwqTVJR8EoordEN/8UiyderZQ6QpqtkLtLpep7Mk/VkT2+nG0plY2EcyT2ESuWHft0cwWn0UsWApQrB5H1GWHU5C1OqAkhqQ0EaRvIEeTDMihmBP4L/f5pB4AH4DpQGL7aILEiAhZKzjG4cw5Lc+qZePzh9rReVR75JgkDSmkxSqXzgVGT5XxH8eXKLTErjnljd1PRZNFbLXHmMBPZqsg8MYLjaRs2mWXHrtm4z6BGmaANXBhhYHsq3hlU035cxDGHACvr1JRw+I9hTVGBFhRTG7m5cTduFPic8kLlAF920uxHsu31mYSfImp5wdOKjYwF/QvmN8OLpfjxFiTpaoAcz0byF7tl4KMCBV7WZ56RF5G0GvuimsQXhKWOIwC2x562xj0ZxSMupO9XP6HaIh5pMw3d36rP8mC2W79P5Kp0tfgBi4toQ
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
39e5a17105d5cd2a65e6d1a7b6a65afec887c339c3626016ed33265db4206be0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Tue, 07 Feb 2023 11:05:11 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Sun, 29 Jan 2023 21:40:16 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"d69411eab168a415e2cb3a651eed08b8"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000
host-header
WordPress.com
index.min.js
blog.cyble.com/wp-content/plugins/gutenberg/build/i18n/
10 KB
4 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/gutenberg/build/i18n/index.min.js?ver=3d2aeabd3f84698c0e2c
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
81ca0d70f50ab00f0c1e0933c11bf7bb6aada2366994784564f4d324dfd7a60c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:11 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 07 Dec 2022 20:54:04 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"6390fd6c-26bc"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
frontend.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/
21 KB
6 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.10.3
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1f1cb60892b45c8e44a0f4222e01af33655dfb7c0e81dd8d937c6d44c38bb632
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:11 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Sun, 29 Jan 2023 21:40:15 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63d6e7bf-543c"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
/
blog.cyble.com/_static/
33 KB
10 KB
Script
General
Full URL
https://blog.cyble.com/_static/??wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js,wp-includes/js/jquery/ui/core.min.js?m=1671645681
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
984d8a00a23b717ad2d084139b7a0880fb888e7c9030a11f5e3bfde3670ffa68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Tue, 07 Feb 2023 11:05:11 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 21 Dec 2022 18:01:21 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
x-page-optimize
uncached
etag
W/"9cb3e1480a9e0fd65c0c8636bb9812ac"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=31536000
host-header
WordPress.com
frontend.min.js
blog.cyble.com/wp-content/plugins/elementor/assets/js/
40 KB
12 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.9.2
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
a9c399a3695f864f52665163ff94626e3b77b44747e1519b03e5f82597b004d7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:11 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 21 Dec 2022 18:01:21 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63a349f1-9ef8"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
elements-handlers.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/
27 KB
7 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.10.3
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f8392cf8d00ac45d817b2b02ee0bd33f1bcb59fd135568e3fb5df5ca3042101e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:11 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Sun, 29 Jan 2023 21:40:15 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63d6e7bf-6b45"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.sticky.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/lib/sticky/
4 KB
2 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?m=1675028416
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
34bbd1c367ffc7d80fcff86c7e5f8777e70f4911bb324e8ecfc7dd3604a96e68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:11 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Sun, 29 Jan 2023 21:40:16 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63d6e7c0-e89"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
e-202306.js
stats.wp.com/
9 KB
3 KB
Script
General
Full URL
https://stats.wp.com/e-202306.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc
HIT hhn
date
Tue, 07 Feb 2023 11:05:12 GMT
content-encoding
br
server
nginx
etag
W/"6197c5cf-3508"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
expires
Sun, 04 Feb 2024 04:03:26 GMT
wsm_new.js
blog.cyble.com/wp-content/plugins/wordpress-stats-manager-pro/js/
23 KB
9 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/wordpress-stats-manager-pro/js/wsm_new.js?v=1.1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
7883c3cfb3f71df2ec3c0574dd83d0b6849a12248b6b9142ea99752636310a47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Sat, 04 Feb 2023 18:11:07 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63de9fbb-5d2e"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
roundtrip.js
s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/
75 KB
23 KB
Script
General
Full URL
https://s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/roundtrip.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:211e:c800:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ee3d3fafc874740d773a711482d0ace893f213475c290a38c3c1054e120c0020

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

X-Amz-Version-Id
1lFtG.60qWzjv3PYnUHFltjNN3sFxrWA
Content-Encoding
gzip
Via
1.1 34435958fa6d40b77fd22fa1c1f56176.cloudfront.net (CloudFront)
Date
Tue, 07 Feb 2023 10:22:19 GMT
Age
3090
X-Amz-Cf-Pop
FRA56-C2
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Mon, 06 Feb 2023 07:00:18 GMT
Server
AmazonS3
Etag
W/"b44dbc9dd18e7c3043034619736ace22"
Vary
Accept-Encoding
Access-Control-Max-Age
600
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
v3pl0RENF-Fivm--1Bkd1sQwnjdR9DKQybhP6ShwQVWEhNTm0YI3wg==
truncated
/
42 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type
image/gif
json
forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/
37 KB
6 KB
XHR
General
Full URL
https://forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/json?hs_static_app=forms-embed&hs_static_app_version=1.2642&X-HubSpot-Static-App-Info=forms-embed-1.2642
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5905 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff976a50da8b58f687acb98ea426edf769b690d57433e1640b6e514b3f832352
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/plain, */*
Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-origin-hublet
na1
date
Tue, 07 Feb 2023 11:05:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
x-hubspot-correlation-id
cde248a1-c7bc-48ce-baf9-30544678902f
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
x-trace
2B7F92D685E1123F77D83D4776C6F0CF8931080661000000000000000000
vary
origin
access-control-allow-methods
OPTIONS, GET
content-type
application/json;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
access-control-expose-headers
X-Origin-Hublet
access-control-max-age
180
access-control-allow-credentials
false
cache-control
max-age=0, no-cache, no-store
x-robots-tag
none
access-control-allow-headers
*
cf-ray
795ba62a5ec8371f-FRA
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.wp.com/s/opensans/v34/
44 KB
44 KB
Font
General
Full URL
https://fonts.wp.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.1.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts-api.wp.com/
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Tue, 07 Feb 2023 11:05:12 GMT
x-content-type-options
nosniff
last-modified
Mon, 15 Aug 2022 18:20:18 GMT
server
nginx
age
193712
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
44856
x-xss-protection
0
fa-solid-900.woff2
blog.cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/
76 KB
77 KB
Font
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-solid-900.woff2
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJylVO12qyAQfKFSEo0x+dFznwVhY7dB1sPH8eTt72pNa05KWts/6sLMMAyLQy80uQguyvgKHQSpQvSKnwFikDoE2aHDE4KRJz8hzTOPPPPM0/BJ7m1q0QXZJi4b8K1sElojG0v6LCw2XvmLDPFiIUe16kIpitajuQWi0zYZtvbGZsCgAstOmbkseqaDFxZapS9Lh1k2zy3r3+9KW04LdY48kDe9hxBEiCoG0SmnWrbae5ryfRjKKyjD2BNR5NdslfzyfDKQnOKdBm9DAjLsXe5jXkxjj2L50s6jLkm9JWWWxJHRU4iiqjeHb9eZMvvhWldyshE7FeE+PCaJUSVxC4hf2j4W2+3as+OOlAOalj2Im11kdN4g9kqfZUcmWRgP7AyZtrk6nS6xUMaQW36LfamPh1qDroqmqERZ1LuiLDcrNnwoj9Ua+G5TroHvN3fquRjmCGUgjcq+d+tNkRPSRGcE4Siihs8+WtXp46U5MUioAQJ1swwPzPXfxfjf4sy66/elTiCLDy/INdcRPH+P0H/dy3ZfV1W5K/b1f7+7VUI=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://blog.cyble.com/_static/??-eJylVO12qyAQfKFSEo0x+dFznwVhY7dB1sPH8eTt72pNa05KWts/6sLMMAyLQy80uQguyvgKHQSpQvSKnwFikDoE2aHDE4KRJz8hzTOPPPPM0/BJ7m1q0QXZJi4b8K1sElojG0v6LCw2XvmLDPFiIUe16kIpitajuQWi0zYZtvbGZsCgAstOmbkseqaDFxZapS9Lh1k2zy3r3+9KW04LdY48kDe9hxBEiCoG0SmnWrbae5ryfRjKKyjD2BNR5NdslfzyfDKQnOKdBm9DAjLsXe5jXkxjj2L50s6jLkm9JWWWxJHRU4iiqjeHb9eZMvvhWldyshE7FeE+PCaJUSVxC4hf2j4W2+3as+OOlAOalj2Im11kdN4g9kqfZUcmWRgP7AyZtrk6nS6xUMaQW36LfamPh1qDroqmqERZ1LuiLDcrNnwoj9Ua+G5TroHvN3fquRjmCGUgjcq+d+tNkRPSRGcE4Siihs8+WtXp46U5MUioAQJ1swwPzPXfxfjf4sy66/elTiCLDy/INdcRPH+P0H/dy3ZfV1W5K/b1f7+7VUI=
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
strict-transport-security
max-age=31536000
x-ac
2.hhn _atomic_ams BYPASS
last-modified
Wed, 21 Dec 2022 18:01:21 GMT
server
nginx
etag
"63a349f1-13174"
access-control-allow-methods
GET, HEAD
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
78196
expires
Tue, 14 Feb 2023 11:05:11 GMT
fa-brands-400.woff2
blog.cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/
75 KB
75 KB
Font
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-brands-400.woff2
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJylVO12qyAQfKFSEo0x+dFznwVhY7dB1sPH8eTt72pNa05KWts/6sLMMAyLQy80uQguyvgKHQSpQvSKnwFikDoE2aHDE4KRJz8hzTOPPPPM0/BJ7m1q0QXZJi4b8K1sElojG0v6LCw2XvmLDPFiIUe16kIpitajuQWi0zYZtvbGZsCgAstOmbkseqaDFxZapS9Lh1k2zy3r3+9KW04LdY48kDe9hxBEiCoG0SmnWrbae5ryfRjKKyjD2BNR5NdslfzyfDKQnOKdBm9DAjLsXe5jXkxjj2L50s6jLkm9JWWWxJHRU4iiqjeHb9eZMvvhWldyshE7FeE+PCaJUSVxC4hf2j4W2+3as+OOlAOalj2Im11kdN4g9kqfZUcmWRgP7AyZtrk6nS6xUMaQW36LfamPh1qDroqmqERZ1LuiLDcrNnwoj9Ua+G5TroHvN3fquRjmCGUgjcq+d+tNkRPSRGcE4Siihs8+WtXp46U5MUioAQJ1swwPzPXfxfjf4sy66/elTiCLDy/INdcRPH+P0H/dy3ZfV1W5K/b1f7+7VUI=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://blog.cyble.com/_static/??-eJylVO12qyAQfKFSEo0x+dFznwVhY7dB1sPH8eTt72pNa05KWts/6sLMMAyLQy80uQguyvgKHQSpQvSKnwFikDoE2aHDE4KRJz8hzTOPPPPM0/BJ7m1q0QXZJi4b8K1sElojG0v6LCw2XvmLDPFiIUe16kIpitajuQWi0zYZtvbGZsCgAstOmbkseqaDFxZapS9Lh1k2zy3r3+9KW04LdY48kDe9hxBEiCoG0SmnWrbae5ryfRjKKyjD2BNR5NdslfzyfDKQnOKdBm9DAjLsXe5jXkxjj2L50s6jLkm9JWWWxJHRU4iiqjeHb9eZMvvhWldyshE7FeE+PCaJUSVxC4hf2j4W2+3as+OOlAOalj2Im11kdN4g9kqfZUcmWRgP7AyZtrk6nS6xUMaQW36LfamPh1qDroqmqERZ1LuiLDcrNnwoj9Ua+G5TroHvN3fquRjmCGUgjcq+d+tNkRPSRGcE4Siihs8+WtXp46U5MUioAQJ1swwPzPXfxfjf4sy66/elTiCLDy/INdcRPH+P0H/dy3ZfV1W5K/b1f7+7VUI=
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
strict-transport-security
max-age=31536000
x-ac
2.hhn _atomic_ams BYPASS
last-modified
Wed, 21 Dec 2022 18:01:21 GMT
server
nginx
etag
"63a349f1-12bdc"
access-control-allow-methods
GET, HEAD
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=604800
accept-ranges
bytes
content-length
76764
expires
Tue, 14 Feb 2023 11:05:11 GMT
memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.wp.com/s/opensans/v34/
47 KB
47 KB
Font
General
Full URL
https://fonts.wp.com/s/opensans/v34/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
Requested by
Host: fonts-api.wp.com
URL: https://fonts-api.wp.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.1.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts-api.wp.com/
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Tue, 07 Feb 2023 11:05:12 GMT
x-content-type-options
nosniff
last-modified
Mon, 15 Aug 2022 18:22:41 GMT
server
nginx
age
10225
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
47952
x-xss-protection
0
json
forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/
37 KB
6 KB
XHR
General
Full URL
https://forms.hsforms.com/embed/v3/form/21289959/f7da69d1-3801-430f-b109-5f44b65a9326/json?hs_static_app=forms-embed&hs_static_app_version=1.2642&X-HubSpot-Static-App-Info=forms-embed-1.2642
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5905 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7d8282f2291011cd48b16089e8975695db10ed895d76793b8721fb1cd32ae05
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/plain, */*
Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-origin-hublet
na1
date
Tue, 07 Feb 2023 11:05:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
x-hubspot-correlation-id
75b1d945-a29d-4eb0-bdac-f3c80e2621d2
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
x-trace
2B430A4E8F6D55794AF009065EE662526E40FBDA45000000000000000000
vary
origin
access-control-allow-methods
OPTIONS, GET
content-type
application/json;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
access-control-expose-headers
X-Origin-Hublet
access-control-max-age
180
access-control-allow-credentials
false
cache-control
max-age=0, no-cache, no-store
x-robots-tag
none
access-control-allow-headers
*
cf-ray
795ba62a5ecb371f-FRA
g.gif
pixel.wp.com/
50 B
93 B
Image
General
Full URL
https://pixel.wp.com/g.gif?v=ext&blog=176605947&post=15619&tz=-5&srv=blog.cyble.com&hp=atomic&ac=2&amp=0&j=1%3A11.8-beta&host=blog.cyble.com&ref=&fcp=1483&rand=0.5531441568916626
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 07 Feb 2023 11:05:12 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
Widespread-Ransomware-Attack-Targeting-VMware-ESXi-Servers.png
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/
547 KB
548 KB
Image
General
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/Widespread-Ransomware-Attack-Targeting-VMware-ESXi-Servers.png?w=1200&ssl=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
81a3d1ed00e556a1243c67a8e55cc553e78e78649c1c7b03c890d52091cab599
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Tue, 07 Feb 2023 11:05:12 GMT
x-content-type-options
nosniff
last-modified
Mon, 06 Feb 2023 15:20:39 GMT
server
nginx
etag
"ef59f0ee009dd987"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://blog.cyble.com/wp-content/uploads/2023/02/Widespread-Ransomware-Attack-Targeting-VMware-ESXi-Servers.png>; rel="canonical"
content-length
560000
expires
Thu, 06 Feb 2025 03:20:39 GMT
nav-menu.c8d112707fd7172d2a9d.bundle.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/
4 KB
2 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/nav-menu.c8d112707fd7172d2a9d.bundle.min.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU1lywjAMvVCNgaQsH50ehXFiEQyOlVo2FE5fZYPMFEKH6U8cS/JbLPlUiRxdABdkrCwqTVJR8EoordEN/8UiyderZQ6QpqtkLtLpep7Mk/VkT2+nG0plY2EcyT2ESuWHft0cwWn0UsWApQrB5H1GWHU5C1OqAkhqQ0EaRvIEeTDMihmBP4L/f5pB4AH4DpQGL7aILEiAhZKzjG4cw5Lc+qZePzh9rReVR75JgkDSmkxSqXzgVGT5XxH8eXKLTErjnljd1PRZNFbLXHmMBPZqsg8MYLjaRs2mWXHrtm4z6BGmaANXBhhYHsq3hlU035cxDGHACvr1JRw+I9hTVGBFhRTG7m5cTduFPic8kLlAF920uxHsu31mYSfImp5wdOKjYwF/QvmN8OLpfjxFiTpaoAcz0byF7tl4KMCBV7WZ56RF5G0GvuimsQXhKWOIwC2x562xj0ZxSMupO9XP6HaIh5pMw3d36rP8mC2W79P5Kp0tfgBi4toQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e1b2299955d137982d8e6eefb796b9bb4435ac23cf156ef9054b1c91fabcb1ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Sun, 29 Jan 2023 21:40:15 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63d6e7bf-104f"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
expires
Tue, 14 Feb 2023 11:05:12 GMT
share-buttons.0bdd88c45462dfb2b073.bundle.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/
1 KB
634 B
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/share-buttons.0bdd88c45462dfb2b073.bundle.min.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU1lywjAMvVCNgaQsH50ehXFiEQyOlVo2FE5fZYPMFEKH6U8cS/JbLPlUiRxdABdkrCwqTVJR8EoordEN/8UiyderZQ6QpqtkLtLpep7Mk/VkT2+nG0plY2EcyT2ESuWHft0cwWn0UsWApQrB5H1GWHU5C1OqAkhqQ0EaRvIEeTDMihmBP4L/f5pB4AH4DpQGL7aILEiAhZKzjG4cw5Lc+qZePzh9rReVR75JgkDSmkxSqXzgVGT5XxH8eXKLTErjnljd1PRZNFbLXHmMBPZqsg8MYLjaRs2mWXHrtm4z6BGmaANXBhhYHsq3hlU035cxDGHACvr1JRw+I9hTVGBFhRTG7m5cTduFPic8kLlAF920uxHsu31mYSfImp5wdOKjYwF/QvmN8OLpfjxFiTpaoAcz0byF7tl4KMCBV7WZ56RF5G0GvuimsQXhKWOIwC2x562xj0ZxSMupO9XP6HaIh5pMw3d36rP8mC2W79P5Kp0tfgBi4toQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
534fd5b9e499e6f74045f4bb61b214e928b4b57e4b4e1767554350626046a7c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Sun, 29 Jan 2023 21:40:15 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63d6e7bf-4bd"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
expires
Tue, 14 Feb 2023 11:05:12 GMT
load-more.066fb9c5015fff73b73c.bundle.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/
5 KB
2 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/load-more.066fb9c5015fff73b73c.bundle.min.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU1lywjAMvVCNgaQsH50ehXFiEQyOlVo2FE5fZYPMFEKH6U8cS/JbLPlUiRxdABdkrCwqTVJR8EoordEN/8UiyderZQ6QpqtkLtLpep7Mk/VkT2+nG0plY2EcyT2ESuWHft0cwWn0UsWApQrB5H1GWHU5C1OqAkhqQ0EaRvIEeTDMihmBP4L/f5pB4AH4DpQGL7aILEiAhZKzjG4cw5Lc+qZePzh9rReVR75JgkDSmkxSqXzgVGT5XxH8eXKLTErjnljd1PRZNFbLXHmMBPZqsg8MYLjaRs2mWXHrtm4z6BGmaANXBhhYHsq3hlU035cxDGHACvr1JRw+I9hTVGBFhRTG7m5cTduFPic8kLlAF920uxHsu31mYSfImp5wdOKjYwF/QvmN8OLpfjxFiTpaoAcz0byF7tl4KMCBV7WZ56RF5G0GvuimsQXhKWOIwC2x562xj0ZxSMupO9XP6HaIh5pMw3d36rP8mC2W79P5Kp0tfgBi4toQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
2dfbd972f157603affc32572b9feb512ef6ac1a5da01cee30febd05e4742d926
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Sun, 29 Jan 2023 21:40:15 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63d6e7bf-1595"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
expires
Tue, 14 Feb 2023 11:05:12 GMT
posts.397aa4bedda9268558a6.bundle.min.js
blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/
3 KB
1 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor-pro/assets/js/posts.397aa4bedda9268558a6.bundle.min.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU1lywjAMvVCNgaQsH50ehXFiEQyOlVo2FE5fZYPMFEKH6U8cS/JbLPlUiRxdABdkrCwqTVJR8EoordEN/8UiyderZQ6QpqtkLtLpep7Mk/VkT2+nG0plY2EcyT2ESuWHft0cwWn0UsWApQrB5H1GWHU5C1OqAkhqQ0EaRvIEeTDMihmBP4L/f5pB4AH4DpQGL7aILEiAhZKzjG4cw5Lc+qZePzh9rReVR75JgkDSmkxSqXzgVGT5XxH8eXKLTErjnljd1PRZNFbLXHmMBPZqsg8MYLjaRs2mWXHrtm4z6BGmaANXBhhYHsq3hlU035cxDGHACvr1JRw+I9hTVGBFhRTG7m5cTduFPic8kLlAF920uxHsu31mYSfImp5wdOKjYwF/QvmN8OLpfjxFiTpaoAcz0byF7tl4KMCBV7WZ56RF5G0GvuimsQXhKWOIwC2x562xj0ZxSMupO9XP6HaIh5pMw3d36rP8mC2W79P5Kp0tfgBi4toQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ccd69c27d47887045e48ebbcd389d285a08d6cddf4b0c3d0e86070c35cceb1bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Sun, 29 Jan 2023 21:40:15 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63d6e7bf-d21"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
expires
Tue, 14 Feb 2023 11:05:12 GMT
text-editor.2c35aafbe5bf0e127950.bundle.min.js
blog.cyble.com/wp-content/plugins/elementor/assets/js/
1 KB
704 B
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/js/text-editor.2c35aafbe5bf0e127950.bundle.min.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU1lywjAMvVCNgaQsH50ehXFiEQyOlVo2FE5fZYPMFEKH6U8cS/JbLPlUiRxdABdkrCwqTVJR8EoordEN/8UiyderZQ6QpqtkLtLpep7Mk/VkT2+nG0plY2EcyT2ESuWHft0cwWn0UsWApQrB5H1GWHU5C1OqAkhqQ0EaRvIEeTDMihmBP4L/f5pB4AH4DpQGL7aILEiAhZKzjG4cw5Lc+qZePzh9rReVR75JgkDSmkxSqXzgVGT5XxH8eXKLTErjnljd1PRZNFbLXHmMBPZqsg8MYLjaRs2mWXHrtm4z6BGmaANXBhhYHsq3hlU035cxDGHACvr1JRw+I9hTVGBFhRTG7m5cTduFPic8kLlAF920uxHsu31mYSfImp5wdOKjYwF/QvmN8OLpfjxFiTpaoAcz0byF7tl4KMCBV7WZ56RF5G0GvuimsQXhKWOIwC2x562xj0ZxSMupO9XP6HaIh5pMw3d36rP8mC2W79P5Kp0tfgBi4toQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
359c32724ded3d649d66332ac70da65306ff8c45ff08f9d0e253ae1fd175e109
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 21 Dec 2022 18:01:21 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63a349f1-54f"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
expires
Tue, 14 Feb 2023 11:05:12 GMT
v2.js
js.hsforms.net/forms/ Frame 52F5
505 KB
158 KB
Script
General
Full URL
https://js.hsforms.net/forms/v2.js
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:b749 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5736f20e2a413433b3af338e6cccd1318197981ce66e68ac810e723ccbf9c10c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
x-amz-version-id
JAvvLYrbAadG1K4h0HWbN.C2V4PipDw0
via
1.1 46e2fa2a811f54853547788992d9aca0.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
IAD55-P3
age
1
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=forms-embed/static-1.2642/bundles/project-v2.js&cfRay=795ba62418f33a8e-IAD
x-cache
Hit from cloudfront
cache-tag
staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
content-encoding
br
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Fri, 03 Feb 2023 10:10:35 UTC
server
cloudflare
etag
W/"bc37deecb11dd26ba785db0381926c28"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1JOxrwzibY4Qo93IDVRopGKxCd5TEQwMpFsjN31xx06TqXehxPHKTgcJxgIkana3sO3yi1SGzO6AB6xRD0EvPalaanXBkCfcC05gHegUgHQ3wyYGB9F8Xc2RmIzc6y2PHDx8pCRxH68PPaiV"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-hs-cache-status
HIT
cache-control
s-maxage=600, max-age=300
cf-ray
795ba62bdbef3a8e-FRA
x-amz-cf-id
fJ-zx-Z71kP3gwXBKKfi9mmhdktLJC_ko4JP8rOqNjP6ZD8qGPzzuA==
x-hs-target-asset
forms-embed/static-1.2642/bundles/project-v2.js
v2.js
js.hsforms.net/forms/ Frame 2BAC
505 KB
158 KB
Script
General
Full URL
https://js.hsforms.net/forms/v2.js
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:b749 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5736f20e2a413433b3af338e6cccd1318197981ce66e68ac810e723ccbf9c10c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
x-amz-version-id
JAvvLYrbAadG1K4h0HWbN.C2V4PipDw0
via
1.1 46e2fa2a811f54853547788992d9aca0.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
IAD55-P3
age
1
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=forms-embed/static-1.2642/bundles/project-v2.js&cfRay=795ba62418f33a8e-IAD
x-cache
Hit from cloudfront
cache-tag
staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
content-encoding
br
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Fri, 03 Feb 2023 10:10:35 UTC
server
cloudflare
etag
W/"bc37deecb11dd26ba785db0381926c28"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wFi%2F8w3MndMVM%2BqoZrmoYY3zMxPaNqifqUJaa5N0c6LfCPdiC2%2FDAaMzpi37xo4CB1mfSRyqsyS9KdLvFRieQojYDl%2FCx25oNwZSIl0w4qlO%2F5kjcDNWh3KzpzernqBn9u%2Fd46EaNmGKjIQS"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-hs-cache-status
HIT
cache-control
s-maxage=600, max-age=300
cf-ray
795ba62bec013a8e-FRA
x-amz-cf-id
fJ-zx-Z71kP3gwXBKKfi9mmhdktLJC_ko4JP8rOqNjP6ZD8qGPzzuA==
x-hs-target-asset
forms-embed/static-1.2642/bundles/project-v2.js
index.js
s.adroll.com/j/exp/
Redirect Chain
  • https://s.adroll.com/j/exp/ELNAF2EZDFHJRAP3ODLCUU/index.js
  • https://s.adroll.com/j/exp/index.js
28 B
785 B
Script
General
Full URL
https://s.adroll.com/j/exp/index.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
HTTP/1.1
Server
2600:9000:211e:c800:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

X-Amz-Version-Id
CiD7z5Qr2ECIL.Zbw84rFXTGVfvZ9kAA
Date
Mon, 06 Feb 2023 17:34:16 GMT
Via
1.1 34435958fa6d40b77fd22fa1c1f56176.cloudfront.net (CloudFront)
Age
63058
X-Amz-Cf-Pop
FRA56-C2
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
28
Last-Modified
Thu, 01 Dec 2022 00:29:34 GMT
Server
AmazonS3
Etag
"5816cced8568d223aa09d889f300692b"
Vary
Accept-Encoding
Access-Control-Max-Age
600
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
U2CWefdUxs3n1QQzox1InIZltd-tIF5GtqozBpM6yDdODjbHA-jrpA==

Redirect headers

Date
Tue, 07 Feb 2023 04:18:54 GMT
Via
1.1 34435958fa6d40b77fd22fa1c1f56176.cloudfront.net (CloudFront)
Age
24377
X-Amz-Cf-Pop
FRA56-C2
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Location
https://s.adroll.com/j/exp/index.js
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
Go-4fXFijF19QEEJjP64gwoDTYACwEfjpc4Krf82y_W9DIlE-dPPgA==
/
blog.cyble.com/
0
80 B
Image
General
Full URL
https://blog.cyble.com/?wmcAction=wmcTrack&action_name=Cyble%20%E2%80%94%20Massive%20Ransomware%20Attack%20Targets%20VMware%20ESXi%20Servers&siteId=1&rec=1&rand=814237&h=11&m=5&s=12&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&uid=0&pid=15619&visitorId=fbb14855d087934c&fvts=1675767912&vc=1&idn=0&refts=0&lvts=1675767912&fullRef=&send_image=1&pdf=1&qt=0&rp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gtms=246&pvId=wmXFGx&browser=Chrome_109&os=Windows_10&device=Desktop
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

cf-edge-cache
cache,platform=wordpress
x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=31536000
content-encoding
br
x-ac
2.hhn _atomic_ams BYPASS
server
nginx
vary
Accept-Encoding, Cookie
content-type
text/html; charset=utf-8
host-header
WordPress.com
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-201575643-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 07 Feb 2023 10:54:50 GMT
last-modified
Tue, 10 Jan 2023 21:29:14 GMT
server
Golfe2
age
622
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20085
expires
Tue, 07 Feb 2023 12:54:50 GMT
js
www.googletagmanager.com/gtag/
177 KB
66 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-4FJGSRPM4S&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-201575643-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:808::2008 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e510f6d13f1fc7aa8beffe8001f6182594c33e644cc690cc71c09e22cc6ea990
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
67104
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Tue, 07 Feb 2023 11:05:12 GMT
conversations-embed.js
js.usemessages.com/
73 KB
21 KB
Script
General
Full URL
https://js.usemessages.com/conversations-embed.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.19
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:edcc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b9a4ac7fc4b84ffae0f68c36e7a94d7f83a6784a4c448641ef6e1004904da4fe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
x-amz-version-id
J0wnkRCkj94Ay74FvdN415rBCXbQPrOY
via
1.1 3b2c32f90b8e4193dda6d9be63628ab2.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-amz-cf-pop
IAD55-P3
age
89
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=conversations-embed/static-1.12048/bundles/project.js&cfRay=795ba3ffea4dbbc8-FRA
x-cache
Hit from cloudfront
cache-tag
staticjsapp-conversations-embed-web-prod,staticjsapp-prod
x-amz-replication-status
COMPLETED
last-modified
Fri, 03 Feb 2023 11:03:30 UTC
server
cloudflare
etag
W/"4235774fb72246d66209ed3872079491"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-hs-cache-status
HIT
cache-control
max-age=600
cf-ray
795ba62cee709054-FRA
x-amz-cf-id
LOpqEd5bBrVrF_Um7rxAndC2NGUAK2njwHHiTvt_otyXXjcGPkyf9g==
x-hs-target-asset
conversations-embed/static-1.12048/bundles/project.js
fb.js
js.hsadspixel.net/
6 KB
3 KB
Script
General
Full URL
https://js.hsadspixel.net/fb.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.19
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:72b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7455fff3d4e08245186e113636f69cbc44679bdf8870de5e4fd9a835e3d2e93

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
x-amz-version-id
voeLZ8jD1qAOp4h9t0pVQ2YHSdN3ebgQ
via
1.1 0ed062928320c9569a09db8a928795e4.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-amz-cf-pop
IAD55-P3
age
477
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=adsscriptloaderstatic/static-1.317/bundles/pixels-release.js&cfRay=795b9a873a5e9950-IAD
x-cache
Hit from cloudfront
cache-tag
staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
x-amz-replication-status
COMPLETED
last-modified
Tue, 31 Jan 2023 04:09:31 UTC
server
cloudflare
etag
W/"bde7af4ffd2c05ea8423271f767ebc69"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-hs-cache-status
HIT
cache-control
max-age=600
cf-ray
795ba62cd81b9b52-FRA
x-amz-cf-id
FTwykzlt9Shl4EPc3Y4p6nEBvFXUFmYGsagsRH84m9o7fNZXm2SXNA==
x-hs-target-asset
adsscriptloaderstatic/static-1.317/bundles/pixels-release.js
collectedforms.js
js.hscollectedforms.net/
68 KB
25 KB
Script
General
Full URL
https://js.hscollectedforms.net/collectedforms.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.19
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:80ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3999cf864b43937c278afeae5b60b6db69bb234d5641202c9e7a2385029aa3b7

Request headers

Referer
https://blog.cyble.com/
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
x-amz-version-id
SN4HXBautbT5xHa4DdPckLpyluwLE8QR
via
1.1 397dd692cad53f0026fab5b236c0a518.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-amz-cf-pop
IAD55-P3
age
520
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=collected-forms-embed-js/static-1.312/bundles/project.js&cfRay=795b997afa15bb59-IAD
x-cache
Hit from cloudfront
cache-tag
staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-amz-replication-status
COMPLETED
last-modified
Wed, 07 Dec 2022 02:49:13 UTC
server
cloudflare
etag
W/"349cabd549e2249f8fb6ac3ac6f08e00"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-hs-cache-status
MISS
vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
cache-control
s-maxage=600, max-age=300
cf-ray
795ba62cd8e430c3-FRA
x-amz-cf-id
5jOSb9sjZYTfkAAtjqDecnKUWvryzKrsLP-cruZvsIbEJgMaFWn9hw==
x-hs-target-asset
collected-forms-embed-js/static-1.312/bundles/project.js
21289959.js
js.hs-analytics.net/analytics/1675767900000/
65 KB
20 KB
Script
General
Full URL
https://js.hs-analytics.net/analytics/1675767900000/21289959.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.19
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:43b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
014b2b1c41f3a79609ab3dc05b4de33205240052b0f2bc7715415eacaad638f3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
x-amz-version-id
null
content-encoding
br
cf-cache-status
MISS
x-amz-request-id
JMMVS9P7T2K1YWB2
x-amz-server-side-encryption
AES256
x-amz-id-2
7t8CxNCfJc1OiSnEzdzJwwxmUeKrO1ICOZ7Wvr2FlagAkyWwehmNSupmLRkchsU+UDMr+0HYLHU=
last-modified
Wed, 18 Jan 2023 21:07:15 GMT
server
cloudflare
etag
W/"d1e3abab0720d93eaa00510214f6df4a"
vary
origin, Accept-Encoding
content-type
text/javascript
cache-control
max-age=300, public
access-control-allow-credentials
false
cf-ray
795ba62cda4c926e-FRA
expires
Tue, 07 Feb 2023 11:10:12 GMT
leadflows.js
js.hsleadflows.net/
544 KB
87 KB
Script
General
Full URL
https://js.hsleadflows.net/leadflows.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.19
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:e6cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd43cd92e272c2e3872abd9559900116d85f2899e76c00015c59360060bcf062

Request headers

Referer
https://blog.cyble.com/
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
x-amz-version-id
9g41IgVIr3w9wyiFOHn4rgapkQc72OJD
via
1.1 736ad67f05a9a5a8fd5ed8cba30196f4.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-amz-cf-pop
IAD12-P3
age
29128
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=lead-flows-js/static-1.1134/bundle/main/lead-flows-release.js&cfRay=7958df0c1bd13735-IAD
x-cache
Hit from cloudfront
cache-tag
staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-amz-replication-status
COMPLETED
last-modified
Thu, 02 Feb 2023 01:26:06 UTC
server
cloudflare
etag
W/"998dfd36d3c4078a3a05a1a77e61963c"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-hs-cache-status
MISS
vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
cache-control
s-maxage=86400, max-age=0
cf-ray
795ba62cbe483732-FRA
x-amz-cf-id
EjJfXkwpNkA12QLTTFeLDRAKuyQzQxIVJ_RH9lbRQ9jQMKs0TxHyYw==
x-hs-target-asset
lead-flows-js/static-1.1134/bundle/main/lead-flows-release.js
banner.js
js.hs-banner.com/v2/21289959/
202 KB
63 KB
Script
General
Full URL
https://js.hs-banner.com/v2/21289959/banner.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/21289959.js?integration=WordPress&ver=10.0.19
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:9a55 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fa28de0db846c10133053b2afac2c078ac3655d4cb66d5d7e46eba419e5a6566

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
x-amz-version-id
9PVx6RHh0AxWs6vZv1y.SO2DCM7C9pcn
content-encoding
br
cf-cache-status
HIT
x-amz-request-id
BVBD4G27BWZ31M2X
age
220
x-amz-server-side-encryption
AES256
x-amz-id-2
f4Dm8Pfp5YTZqgwu1DiyDyitDKzaRjnGDtdGwrc3IT1zXWf25o9ZqUxdFXhK83Osbu78vifyRkM=
last-modified
Fri, 03 Feb 2023 23:00:19 GMT
server
cloudflare
etag
W/"80410d0b77494d74b75f59d3556a1422"
access-control-max-age
604800
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://blog.cyble.com
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control
max-age=300, public
access-control-allow-credentials
true
vary
origin, Accept-Encoding
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray
795ba62cfba19a0b-FRA
expires
Tue, 07 Feb 2023 11:06:32 GMT
Figure-1-Statistics-of-Args-Ransomware-Source-Shodan.jpg
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/
10 KB
10 KB
Image
General
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/Figure-1-Statistics-of-Args-Ransomware-Source-Shodan.jpg?w=962&ssl=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
e545d0e2a57ee8fb5f5e003c77db10aa2b602284859fe1c8f805682960950858
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Tue, 07 Feb 2023 11:05:12 GMT
x-content-type-options
nosniff
last-modified
Mon, 06 Feb 2023 15:32:22 GMT
server
nginx
etag
"6959f40fef26b888"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://blog.cyble.com/wp-content/uploads/2023/02/Figure-1-Statistics-of-Args-Ransomware-Source-Shodan.jpg>; rel="canonical"
content-length
10302
expires
Thu, 06 Feb 2025 03:32:22 GMT
counters.gif
forms.hsforms.com/embed/v3/
35 B
393 B
Image
General
Full URL
https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:5905 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
server
cloudflare
x-hubspot-correlation-id
af6aaafd-8f98-4a38-9b2f-7b9a48635781
x-trace
2B49B4CED63192396DD23E0FF1DEB8CCB775352A1F000000000000000000
vary
origin
content-type
image/gif
access-control-expose-headers
X-Origin-Hublet
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
x-robots-tag
none
cf-ray
795ba62cfcb4372e-FRA
content-length
35
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
eicons.woff2
blog.cyble.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/
91 KB
91 KB
Font
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff2?5.16.0
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJylVO12qyAQfKFSEo0x+dFznwVhY7dB1sPH8eTt72pNa05KWts/6sLMMAyLQy80uQguyvgKHQSpQvSKnwFikDoE2aHDE4KRJz8hzTOPPPPM0/BJ7m1q0QXZJi4b8K1sElojG0v6LCw2XvmLDPFiIUe16kIpitajuQWi0zYZtvbGZsCgAstOmbkseqaDFxZapS9Lh1k2zy3r3+9KW04LdY48kDe9hxBEiCoG0SmnWrbae5ryfRjKKyjD2BNR5NdslfzyfDKQnOKdBm9DAjLsXe5jXkxjj2L50s6jLkm9JWWWxJHRU4iiqjeHb9eZMvvhWldyshE7FeE+PCaJUSVxC4hf2j4W2+3as+OOlAOalj2Im11kdN4g9kqfZUcmWRgP7AyZtrk6nS6xUMaQW36LfamPh1qDroqmqERZ1LuiLDcrNnwoj9Ua+G5TroHvN3fquRjmCGUgjcq+d+tNkRPSRGcE4Siihs8+WtXp46U5MUioAQJ1swwPzPXfxfjf4sy66/elTiCLDy/INdcRPH+P0H/dy3ZfV1W5K/b1f7+7VUI=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
691fa7d17effc7d303eda0ad7e4a1d91b2f375506cfc8a774480cc2b55f156ea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://blog.cyble.com/_static/??-eJylVO12qyAQfKFSEo0x+dFznwVhY7dB1sPH8eTt72pNa05KWts/6sLMMAyLQy80uQguyvgKHQSpQvSKnwFikDoE2aHDE4KRJz8hzTOPPPPM0/BJ7m1q0QXZJi4b8K1sElojG0v6LCw2XvmLDPFiIUe16kIpitajuQWi0zYZtvbGZsCgAstOmbkseqaDFxZapS9Lh1k2zy3r3+9KW04LdY48kDe9hxBEiCoG0SmnWrbae5ryfRjKKyjD2BNR5NdslfzyfDKQnOKdBm9DAjLsXe5jXkxjj2L50s6jLkm9JWWWxJHRU4iiqjeHb9eZMvvhWldyshE7FeE+PCaJUSVxC4hf2j4W2+3as+OOlAOalj2Im11kdN4g9kqfZUcmWRgP7AyZtrk6nS6xUMaQW36LfamPh1qDroqmqERZ1LuiLDcrNnwoj9Ua+G5TroHvN3fquRjmCGUgjcq+d+tNkRPSRGcE4Siihs8+WtXp46U5MUioAQJ1swwPzPXfxfjf4sy66/elTiCLDy/INdcRPH+P0H/dy3ZfV1W5K/b1f7+7VUI=
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
strict-transport-security
max-age=31536000
x-ac
2.hhn _atomic_ams BYPASS
last-modified
Wed, 21 Dec 2022 18:01:21 GMT
server
nginx
etag
"63a349f1-16cbc"
access-control-allow-methods
GET, HEAD
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=315360000
accept-ranges
bytes
content-length
93372
expires
Thu, 31 Dec 2037 23:55:55 GMT
ELNAF2EZDFHJRAP3ODLCUU
d.adroll.com/consent/check/
456 B
549 B
Script
General
Full URL
https://d.adroll.com/consent/check/ELNAF2EZDFHJRAP3ODLCUU?pv=45456889393.71566&arrfrr=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&_s=1010434ce557cc3c564e05207aa15e50&_b=2
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/roundtrip.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:cc3:fe04:b28b:5c08:310b:9699 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.22.1 /
Resource Hash
be6b0e93746c524b22c5fb86e371f59137c0e5fa6ca601f48a05b4f0b76390b0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
server
nginx/1.22.1
content-length
456
content-type
application/javascript
share-link.min.js
blog.cyble.com/wp-content/plugins/elementor/assets/lib/share-link/
3 KB
1 KB
Script
General
Full URL
https://blog.cyble.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.9.2
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.9.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.183 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
138154c0deed3326477b9b4909175101070a5a3a95342291b53d8cc9879a5f47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 21 Dec 2022 18:01:21 GMT
server
nginx
x-ac
2.hhn _atomic_ams BYPASS
etag
W/"63a349f1-a3c"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
counters.gif
forms-na1.hsforms.com/embed/v3/
35 B
438 B
Image
General
Full URL
https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5805 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
server
cloudflare
x-hubspot-correlation-id
3c7d6abe-abe3-4a04-b356-d35df8177774
x-trace
2B2CE19DBC537FC0CB0D7A62A5C90C1D9B18FAC9AE000000000000000000
vary
origin
content-type
image/gif
access-control-expose-headers
X-Origin-Hublet
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
x-robots-tag
none
cf-ray
795ba62e8f4839bc-FRA
content-length
35
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
collect
www.google-analytics.com/j/
2 B
206 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j99&aip=1&a=1412388147&t=pageview&_s=1&dl=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&ul=en-us&de=UTF-8&dt=Cyble%20%E2%80%94%20Massive%20Ransomware%20Attack%20Targets%20VMware%20ESXi%20Servers&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBACUABBAAAACAAI~&jid=2017438099&gjid=354736242&cid=728672374.1675767913&tid=UA-201575643-1&_gid=1719886509.1675767913&_r=1&gtm=457e3210h1&did=dZTNiMT&gdid=dZTNiMT&z=933452814
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 07 Feb 2023 11:05:12 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.cyble.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
Widespread-Ransomware-Attack-Targeting-VMware-ESXi-Servers.png
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/
43 KB
44 KB
Image
General
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/Widespread-Ransomware-Attack-Targeting-VMware-ESXi-Servers.png?fit=300%2C150&ssl=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU1lywjAMvVCNgaQsH50ehXFiEQyOlVo2FE5fZYPMFEKH6U8cS/JbLPlUiRxdABdkrCwqTVJR8EoordEN/8UiyderZQ6QpqtkLtLpep7Mk/VkT2+nG0plY2EcyT2ESuWHft0cwWn0UsWApQrB5H1GWHU5C1OqAkhqQ0EaRvIEeTDMihmBP4L/f5pB4AH4DpQGL7aILEiAhZKzjG4cw5Lc+qZePzh9rReVR75JgkDSmkxSqXzgVGT5XxH8eXKLTErjnljd1PRZNFbLXHmMBPZqsg8MYLjaRs2mWXHrtm4z6BGmaANXBhhYHsq3hlU035cxDGHACvr1JRw+I9hTVGBFhRTG7m5cTduFPic8kLlAF920uxHsu31mYSfImp5wdOKjYwF/QvmN8OLpfjxFiTpaoAcz0byF7tl4KMCBV7WZ56RF5G0GvuimsQXhKWOIwC2x562xj0ZxSMupO9XP6HaIh5pMw3d36rP8mC2W79P5Kp0tfgBi4toQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
d5aa61a003aa8e1379fa28c926ff8da5a6b08b7fbc9ba65f82dedd1842be2e5a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Tue, 07 Feb 2023 11:05:12 GMT
x-content-type-options
nosniff
last-modified
Mon, 06 Feb 2023 15:10:20 GMT
server
nginx
etag
"2769212042f11536"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://blog.cyble.com/wp-content/uploads/2023/02/Widespread-Ransomware-Attack-Targeting-VMware-ESXi-Servers.png>; rel="canonical"
content-length
44526
expires
Thu, 06 Feb 2025 03:10:20 GMT
Mirai-Botnet-Medusa-Linux.png
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/
35 KB
35 KB
Image
General
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/Mirai-Botnet-Medusa-Linux.png?fit=300%2C150&ssl=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU1lywjAMvVCNgaQsH50ehXFiEQyOlVo2FE5fZYPMFEKH6U8cS/JbLPlUiRxdABdkrCwqTVJR8EoordEN/8UiyderZQ6QpqtkLtLpep7Mk/VkT2+nG0plY2EcyT2ESuWHft0cwWn0UsWApQrB5H1GWHU5C1OqAkhqQ0EaRvIEeTDMihmBP4L/f5pB4AH4DpQGL7aILEiAhZKzjG4cw5Lc+qZePzh9rReVR75JgkDSmkxSqXzgVGT5XxH8eXKLTErjnljd1PRZNFbLXHmMBPZqsg8MYLjaRs2mWXHrtm4z6BGmaANXBhhYHsq3hlU035cxDGHACvr1JRw+I9hTVGBFhRTG7m5cTduFPic8kLlAF920uxHsu31mYSfImp5wdOKjYwF/QvmN8OLpfjxFiTpaoAcz0byF7tl4KMCBV7WZ56RF5G0GvuimsQXhKWOIwC2x562xj0ZxSMupO9XP6HaIh5pMw3d36rP8mC2W79P5Kp0tfgBi4toQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
9f85c527cd792a07dd77636f74775b8e1fe3cc586225af910685a64c9ff5ed9b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Tue, 07 Feb 2023 11:05:12 GMT
x-content-type-options
nosniff
last-modified
Fri, 03 Feb 2023 17:30:06 GMT
server
nginx
etag
"cca555d7d300fece"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://blog.cyble.com/wp-content/uploads/2023/02/Mirai-Botnet-Medusa-Linux.png>; rel="canonical"
content-length
36094
expires
Mon, 03 Feb 2025 05:30:06 GMT
BATLoader-RATs-Stealers-OneNote.jpg
i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/
24 KB
25 KB
Image
General
Full URL
https://i0.wp.com/blog.cyble.com/wp-content/uploads/2023/02/BATLoader-RATs-Stealers-OneNote.jpg?fit=300%2C150&ssl=1
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/_static/??-eJytU1lywjAMvVCNgaQsH50ehXFiEQyOlVo2FE5fZYPMFEKH6U8cS/JbLPlUiRxdABdkrCwqTVJR8EoordEN/8UiyderZQ6QpqtkLtLpep7Mk/VkT2+nG0plY2EcyT2ESuWHft0cwWn0UsWApQrB5H1GWHU5C1OqAkhqQ0EaRvIEeTDMihmBP4L/f5pB4AH4DpQGL7aILEiAhZKzjG4cw5Lc+qZePzh9rReVR75JgkDSmkxSqXzgVGT5XxH8eXKLTErjnljd1PRZNFbLXHmMBPZqsg8MYLjaRs2mWXHrtm4z6BGmaANXBhhYHsq3hlU035cxDGHACvr1JRw+I9hTVGBFhRTG7m5cTduFPic8kLlAF920uxHsu31mYSfImp5wdOKjYwF/QvmN8OLpfjxFiTpaoAcz0byF7tl4KMCBV7WZ56RF5G0GvuimsQXhKWOIwC2x562xj0ZxSMupO9XP6HaIh5pMw3d36rP8mC2W79P5Kp0tfgBi4toQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i0.wp.com
Software
nginx /
Resource Hash
5dd1d4901a2aa0c9c999e4666f76cfaad441a0e75affd1b4be6bbc754e73e6ba
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Tue, 07 Feb 2023 11:05:12 GMT
x-content-type-options
nosniff
last-modified
Thu, 02 Feb 2023 09:41:16 GMT
server
nginx
etag
"7650c6f6e76eef59"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://blog.cyble.com/wp-content/uploads/2023/02/BATLoader-RATs-Stealers-OneNote.jpg>; rel="canonical"
content-length
24894
expires
Sat, 01 Feb 2025 21:41:16 GMT
public
api.hubspot.com/livechat-public/v1/message/
3 KB
2 KB
XHR
General
Full URL
https://api.hubspot.com/livechat-public/v1/message/public?portalId=21289959&conversations-embed=static-1.12048&mobile=false&messagesUtk=f8ba518128bb44b68924c2ca387494be&traceId=f8ba518128bb44b68924c2ca387494be
Requested by
Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2d49eabfc4c9ea154b616159357e5cb5708e39b43b7d11c3ee64e00bcf69ce85
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
X-HubSpot-Messages-Uri
https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
115c7485-784f-42d9-b6b6-26065ab07f94
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1414
server
cloudflare
x-trace
2BBBA9045BB716ED370CF7DF66BAAFD9B6DDA73976000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vAIXACjurTnReEOulw8h%2BAWDptc001AEsgZxzPQMw9%2Bsab8FsfZt52PS29HWOo7ehcoZ4gTYjiz%2F%2FqIibuoLXCAXi8%2B9ZJq7fmCTLg38xKleFcV2fm4w22%2BNBkzQNDldVuLlqhjXOQ0DToX5qg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials
false
cf-ray
795ba6301f6d915f-FRA
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
public
api.hubspot.com/livechat-public/v1/message/ Frame
0
0
Preflight
General
Full URL
https://api.hubspot.com/livechat-public/v1/message/public?portalId=21289959&conversations-embed=static-1.12048&mobile=false&messagesUtk=f8ba518128bb44b68924c2ca387494be&traceId=f8ba518128bb44b68924c2ca387494be
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
*/*
Access-Control-Request-Headers
x-hubspot-messages-uri
Access-Control-Request-Method
GET
Origin
https://blog.cyble.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-credentials
false
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin
https://blog.cyble.com
allow
HEAD,GET,OPTIONS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
795ba62f3e5b915f-FRA
content-length
18
content-type
text/plain; charset=utf-8
date
Tue, 07 Feb 2023 11:05:12 GMT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CiqmOa2Z75PZxakBtvdElBnJ9sFmMQfBi17ymZHNst8MPEbs%2BTWbl%2BBAxMw58NjmG8knsmkZOBtxwHf1Fo2euZtH5NaNcSjw20m1p2qd5RIPSMF4V1BTqkf5C5Pvajv7iuwEe94159cn%2F%2FqeRw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
origin, Accept-Encoding
x-hubspot-correlation-id
353c8b7a-6a6d-4859-9759-87ef8295d7d3
x-trace
2BBA8CC42C1B04E70A07C58B4248A02A6113E1BE52000000000000000000
collect
region1.google-analytics.com/g/
0
244 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-4FJGSRPM4S&gtm=45je3210&_p=1412388147&gdid=dZTNiMT&cid=728672374.1675767913&ul=en-us&sr=1600x1200&uaW=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1675767912&sct=1&seg=0&dl=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&dt=Cyble%20%E2%80%94%20Massive%20Ransomware%20Attack%20Targets%20VMware%20ESXi%20Servers&en=page_view&_fv=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4FJGSRPM4S&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 07 Feb 2023 11:05:12 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.cyble.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
json
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/
114 B
877 B
XHR
General
Full URL
https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=21289959
Requested by
Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:c8cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
90b705145ef82e9d8493aae55c9bfb3200ec0620c8946b20b0b28366557d6a4a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
27c508a4-23af-45c1-9764-fe51b236258f
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
x-trace
2BEBEE691B9B39721D9E8672589EFC7D803FFB38E6000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h%2Bk4D%2BuFI7CvOSs6pI%2BYMWzkN0VieEsUIdjpWdf3urErf9duZlaONiS8lzcBw1qpmwK9Oh73Ap6lwDbpn2asSNU%2BZ2i%2BBWE48ApON4HyjHYOkzYX3Fc5%2BAZr8Ilw9HLCMAmoJVo4MQ7kS95r"}],"group":"cf-nel","max_age":604800}
access-control-max-age
180
access-control-allow-credentials
false
cf-ray
795ba62f9ae63738-FRA
access-control-allow-headers
*
json
forms.hubspot.com/collected-forms/v1/config/
116 B
702 B
XHR
General
Full URL
https://forms.hubspot.com/collected-forms/v1/config/json?portalId=21289959&utk=
Requested by
Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c27a8d0abc42f5fcd3a4ad9480ca7bd1bbe1fcb23d5438b4420f1cbcab3ecc9f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/plain, */*
Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
8d3c4458-6b8e-474a-82cf-124d04362247
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
vary
origin
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qGSQr1aPZph8uDbBNpTYpFG3FiAWaZN97hedLUKowUpgKljLBL8ytSZRzkrHyTkqx2vUB30j9bXhhZydiUIH5FH%2BMip2ZROh6ttfP45FoUATZS96E7rZZjtG3X3%2FJWTutzysPaFyy%2BDI47Qp5M6S"}],"group":"cf-nel","max_age":604800}
access-control-max-age
180
access-control-allow-credentials
false
x-robots-tag
none
access-control-allow-headers
*
cf-ray
795ba62fbeed915f-FRA
collect
stats.g.doubleclick.net/j/
1 B
345 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-201575643-1&cid=728672374.1675767913&jid=2017438099&gjid=354736242&_gid=1719886509.1675767913&_u=YGBACUAABAAAACAAI~&z=678954890
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4025:401::9a Den Helder, Netherlands, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Tue, 07 Feb 2023 11:05:13 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://blog.cyble.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
consent_tcfv2.js
s.adroll.com/j/
410 KB
55 KB
Script
General
Full URL
https://s.adroll.com/j/consent_tcfv2.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/ELNAF2EZDFHJRAP3ODLCUU/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:211e:c800:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
91144fbcc0e3f609b021e362ec29d2a9b58f15e840f229eb99ea2c04d927882b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

X-Amz-Version-Id
44sIT20LqRj70wQHqyIoOw7etYYdjkbK
Content-Encoding
gzip
Via
1.1 34435958fa6d40b77fd22fa1c1f56176.cloudfront.net (CloudFront)
Date
Tue, 07 Feb 2023 11:03:10 GMT
Age
123
X-Amz-Cf-Pop
FRA56-C2
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Wed, 04 May 2022 19:41:48 GMT
Server
AmazonS3
Etag
W/"0a7d0ea8d7d31b07e925fe340acf431b"
Vary
Accept-Encoding
Access-Control-Max-Age
600
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET
Cache-Control
max-age=300, must-revalidate
Access-Control-Allow-Credentials
false
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
M12GNpucmQXakeiimuAk4JYV-AD8OGv_i4HDkT6BVVFkMOm5eRFavg==
stats.json
injection.amibreached.com/ Frame 6CD4
124 B
995 B
Fetch
General
Full URL
https://injection.amibreached.com/stats.json
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bbdb1d21246d1c1a65aca8b41818f593b2d4704a459983866c0d331151b91887
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 c60880d44880ad913f911851a63aacde.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
13843
x-amz-cf-pop
WAW50-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:52 GMT
server
cloudflare
etag
W/"b660d52d56d1db01c2e37397c007a1e4"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json
access-control-allow-origin
https://blog.cyble.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2Ha3ufLnGV67ZXIot60ytPAEtuIx5XTW3TKv6ZDwDIcbIu4JS8FqW8vXzL8OK%2BWFpkCGFOA4g3hwtuIXUiLYubLUuLE%2Bm2b0U9g5T%2BpPgkmrbHvZ7eoB2%2F%2B%2BQdv%2FwqKb2Hse3cAKCDyw43ZbLNWzEArok%2B21QVU%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
x-amz-server-side-encryption, x-amz-request-id, x-amz-id-2, x-origin
access-control-max-age
3000
access-control-allow-credentials
true
cf-ray
795ba6305b485b38-FRA
x-amz-cf-id
-M_X5AH2R5sj3sQYH9U9yJUUi63KBpYX4TBFcl_4mU2yTnEg6MXnSQ==
nextroll-32x32.png
s.adroll.com/i/favicon/
2 KB
2 KB
Image
General
Full URL
https://s.adroll.com/i/favicon/nextroll-32x32.png
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:211e:c800:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

X-Amz-Version-Id
eTpwxbAIDHDUN.4tfrROIgU_pzKN9Xh0
Date
Tue, 07 Feb 2023 10:06:42 GMT
Via
1.1 34435958fa6d40b77fd22fa1c1f56176.cloudfront.net (CloudFront)
Age
13154
X-Amz-Cf-Pop
FRA56-C2
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
1615
Last-Modified
Mon, 28 Jun 2021 18:19:21 GMT
Server
AmazonS3
Etag
"403a0a7dcf2d617e7ea852bfb9d11945"
Vary
Accept-Encoding
Access-Control-Max-Age
600
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
dRWjZeM8WZSKdv8AykD667TrWMBUQDkj9p5YXBH9-mSt5qDrn5aW1g==
__ptq.gif
track.hubspot.com/
45 B
555 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1858685340&v=1.1&a=21289959&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&t=Cyble+%E2%80%94+Massive+Ransomware+Attack+Targets+VMware+ESXi+Servers&cts=1675767913036&vi=90cef9fbe5322d867ea1dfeee17eb131&nc=true&u=27441379.90cef9fbe5322d867ea1dfeee17eb131.1675767913032.1675767913032.1675767913032.1&b=27441379.1.1675767913032&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
4fbad478-bfc4-471c-be7c-ca37630eae77
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
45
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ULgWNs56xzfjbu1Y3y9WJW%2Fn%2FbcV80Xsh5ZQ7hZTyG8f8IIwCXwQlpdalriTP8ANmAfcKBgrSsT9%2Boi3x8F3atBOAQBndD0Cyebb4dsqM%2B5TKCcrBFlNVig%2BYGMoAcTM5DYx1sOcIag1en97jsvq"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
795ba630ffa32c47-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
893 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=15&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=d9c47b85-7e8a-451f-825f-bf0ffdcfa339&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1858685340&v=1.1&a=21289959&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&t=Cyble+%E2%80%94+Massive+Ransomware+Attack+Targets+VMware+ESXi+Servers&cts=1675767913038&vi=90cef9fbe5322d867ea1dfeee17eb131&nc=true&u=27441379.90cef9fbe5322d867ea1dfeee17eb131.1675767913032.1675767913032.1675767913032.1&b=27441379.1.1675767913032&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
64ee0ae9-8e3e-45bf-9df9-6268a262aaa4
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
45
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EJXAIfCg8g7g6IybDQoeIjb0%2BC53iKgHCZjgAkyRtP0NZOw0MlSfMXlYF%2BGIk3ejPGpwvO2U607NfrRKOxBquw3LgIo1uIDX1e3VoJUiFAp6J7cr91XVgX%2Fk73mybb0KXygkLTNWpXCvNbGt8iyl"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
795ba6310fa52c47-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
556 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=17&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=d9c47b85-7e8a-451f-825f-bf0ffdcfa339&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1858685340&v=1.1&a=21289959&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&t=Cyble+%E2%80%94+Massive+Ransomware+Attack+Targets+VMware+ESXi+Servers&cts=1675767913039&vi=90cef9fbe5322d867ea1dfeee17eb131&nc=true&u=27441379.90cef9fbe5322d867ea1dfeee17eb131.1675767913032.1675767913032.1675767913032.1&b=27441379.1.1675767913032&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
22a7d4c9-dff1-48d1-823d-9d901b0b7222
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
45
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yKlSvIegujCTpfDp1%2FJopNbXDuU5yPo0FlfhIY0Te5EUOeU9huwqulABfDyIvpUwBB73f%2FG1fwcja8JVqrUkzJRvOvWhAft%2FjHn7udnPTX76%2BjB4nYQWdtoBWAJpHkCprnlsI1oG48tNPceihuVC"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
795ba6310fa82c47-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
561 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=15&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=6dc69a34-518a-464e-a198-9377489ddcce&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1858685340&v=1.1&a=21289959&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&t=Cyble+%E2%80%94+Massive+Ransomware+Attack+Targets+VMware+ESXi+Servers&cts=1675767913040&vi=90cef9fbe5322d867ea1dfeee17eb131&nc=true&u=27441379.90cef9fbe5322d867ea1dfeee17eb131.1675767913032.1675767913032.1675767913032.1&b=27441379.1.1675767913032&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
63c25970-e3a5-4f34-a3a2-222f9e9bffb3
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
45
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MD4p3norzpbDWB0ogOcaBzcH81LS%2F2a1RMVfERSPaay0Z1DVWKTMWzgX86owWGWZR9gqYNJTSTMJrAxv%2FKmS1v7khzkPvzv8izJTBlUG%2BvlDN%2FfAJ%2F2%2BhuRZdmuSfVBc%2BE3nPYw8R6o7cnQUHENC"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
795ba6310fa92c47-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
554 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=17&fi=f7da69d1-3801-430f-b109-5f44b65a9326&fci=6dc69a34-518a-464e-a198-9377489ddcce&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1858685340&v=1.1&a=21289959&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&t=Cyble+%E2%80%94+Massive+Ransomware+Attack+Targets+VMware+ESXi+Servers&cts=1675767913040&vi=90cef9fbe5322d867ea1dfeee17eb131&nc=true&u=27441379.90cef9fbe5322d867ea1dfeee17eb131.1675767913032.1675767913032.1675767913032.1&b=27441379.1.1675767913032&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
508ce981-531c-4852-a9a3-8eca2493d039
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
45
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DuVLLv4rCVe6T1jsPLxFJZe43jUnxXtWXTRqASDmpam1ARzAcldOEZ6WhfwYK0xiIl3SFPtWgdhNtayGEY5cDDXc9OZMoRqNaiaY7%2BS9nrenXe%2Fa3pr%2FCqt1kApM3BHltxqBzj18L8x3b4sBHhJv"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
795ba6310fac2c47-FRA
x-robots-tag
none
insight.min.js
snap.licdn.com/li.lms-analytics/
13 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:11a::6867:4832 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 10 Jan 2023 17:22:56 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=63796
accept-ranges
bytes
content-length
4777
counters.gif
forms.hsforms.com/embed/v3/
35 B
357 B
Image
General
Full URL
https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:5905 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
server
cloudflare
x-hubspot-correlation-id
f8213fec-a671-42f7-b75b-5a7eb7784831
x-trace
2B77D0CC0BCB966200EC3BCD6E3E2452489D649EE5000000000000000000
vary
origin
content-type
image/gif
access-control-expose-headers
X-Origin-Hublet
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
x-robots-tag
none
cf-ray
795ba630d97f372e-FRA
content-length
35
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
json
forms.hubspot.com/lead-flows-config/v1/config/
22 KB
5 KB
XHR
General
Full URL
https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=21289959&utk=90cef9fbe5322d867ea1dfeee17eb131&__hstc=27441379.90cef9fbe5322d867ea1dfeee17eb131.1675767913032.1675767913032.1675767913032.1&__hssc=27441379.1.1675767913032&currentUrl=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F
Requested by
Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da2dfacdb9a6855bfe38d21950a999ffb33a12c7ea806d605bb32f2cca7328c2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
a9016e22-8065-4d44-9760-6a1134b1220d
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
vary
origin
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://blog.cyble.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qTai89HA3eCOeK7y%2BPTbSTe6oBTyVyX%2Bm8x%2BewA7h4%2Fe4pNVYQRfCOOMUtea1aZ%2FkbWypLFvXphugXaobfNQ22KpWphXqPRtSCJXnZFt3C6GWoKrtmsph%2BTAM8gDTiaTKCxnB5Z2WXj4nZDbfNgb"}],"group":"cf-nel","max_age":604800}
access-control-max-age
180
access-control-allow-credentials
false
cache-control
max-age=0, no-cache, no-store
x-robots-tag
none
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray
795ba6310dc7381c-FRA
inject.8d8a39d8fa64efbb0671.bundle.js
injection.amibreached.com/ Frame 6CD4
130 KB
44 KB
Script
General
Full URL
https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9af44543fbf7b09c3d68e46dcb21d2cb9ec5f18bbd537cea92360a85c5db793e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 fdd677a35b242f0199586a71e2f6859e.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
6602
x-amz-cf-pop
FRA56-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:51 GMT
server
cloudflare
etag
W/"046f84a87526210ff005ab33291675c9"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zfItuGtxD9esISgdYoQ%2BOHBxMb5KLn8sAFlxBHGV6Ok%2Bz9O9%2BJA5AEuxN2PXeFxd1iVcBDfsS6K1E4I2LKe6bddASW2rE9cieQgzO2MvmvmLWHx0ogbZeUjkHFmXnmjMnn2KiAqjLD%2B8s4DHR4Fdl4XYr90ziXk%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=120
cf-ray
795ba6315ee6377b-FRA
x-amz-cf-id
tzLbz1kBtdTLV54_UkLpDPryXBG9GY92lHo8XEbX_-hccyA3EOkAsQ==
main.8d8a39d8fa64efbb0671.css
injection.amibreached.com/css/ Frame 6CD4
703 B
729 B
Stylesheet
General
Full URL
https://injection.amibreached.com/css/main.8d8a39d8fa64efbb0671.css
Requested by
Host: blog.cyble.com
URL: https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7d0240fd43289ab1411c5fa1277574ee436d3a3bbb82d34c4d82f32d04517b8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 a383f82b5d4e98bbd66535c2c4b20c9e.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
2981
x-amz-cf-pop
FRA56-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:51 GMT
server
cloudflare
etag
W/"ff4f518052149a21c5b6397b3f717f6a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EgyQPlCtEJNuH2mBzXPvmeNIXb5VpbXge3hTXWgtho4AW9pqp1wmaRgRAaHIvXdNpPL3prb94h9MCZAz8ceGdgkRbdvfwxMwMyJtIo%2FL7oRdWrMG3SzvlzL0eKo38cpdGB5bDPPqQpMOj7DCW1h7v5s%2B0QegM74%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=120
cf-ray
795ba6315ee7377b-FRA
x-amz-cf-id
-QepZwwL-OsaDXUMml04Z9fOXRtBwDg43BTXk9OBRe7cLEgxKDRv8Q==
f8ba518128bb44b68924c2ca387494be
app.hubspot.com/conversations-visitor/21289959/threads/utk/ Frame 20FB
51 KB
18 KB
Document
General
Full URL
https://app.hubspot.com/conversations-visitor/21289959/threads/utk/f8ba518128bb44b68924c2ca387494be?uuid=db4a7d690e5343bbada18ee5b79462c1&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=f8ba518128bb44b68924c2ca387494be&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Requested by
Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7caf8e90e89ddd7ade412df4a07c33c9a817460d9659a8323136c2a55fb58e33
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.cyble.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
false
age
2358
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=600
cache-tag
staticjsapp-conversations-visitor-ui-web-prod,staticjsapp-prod
cf-cache-status
DYNAMIC
cf-ray
795ba63198982c47-FRA
content-encoding
br
content-security-policy-report-only
script-src 'self' www.hubspot.com *.hsappstatic.net *.hs-analytics.net *.hs-banner.com *.hsforms.net *.hsleadflows.net *.hs-scripts.com *.hubspotfeedback.com *.usemessages.com js.hubspot.com *.hsadspixel.net *.hscollectedforms.net js-agent.newrelic.com bam.nr-data.net bam-cell.nr-data.net *.google-analytics.com www.googletagmanager.com data: 'unsafe-inline' 'unsafe-eval' blob: connect.facebook.net www.gstatic.cn www.gstatic.com www.google.com *.fullstory.com fullstory.com apis.google.com snap.licdn.com; report-uri https://exceptions.hubspot.com/csp/report?resource=conversations-visitor-ui/static-1.14500/html/index.html&cfRay=795ba63198982c47&reqUrl=https%3A%2F%2Fapp.hubspot.com%2Fconversations-visitor%2F21289959%2Fthreads%2Futk%2Ff8ba518128bb44b68924c2ca387494be%3Fuuid%3Ddb4a7d690e5343bbada18ee5b79462c1%26mobile%3Dfalse%26mobileSafari%3Dfalse%26hideWelcomeMessage%3Dfalse%26hstc%3Dnull%26domain%3Dblog.cyble.com%26inApp53%3Dfalse%26messagesUtk%3Df8ba518128bb44b68924c2ca387494be%26url%3Dhttps%253A%252F%252Fblog.cyble.com%252F2023%252F02%252F06%252Fmassive-ransomware-attack-targets-vmware-esxi-servers%252F%26inline%3Dfalse%26isFullscreen%3Dfalse%26globalCookieOptOut%3Dnull%26isFirstVisitorSession%3Dtrue%26isAttachmentDisabled%3Dfalse%26enableWidgetCookieBanner%3Dfalse%26isInCMS%3Dfalse&referrer=https%3A%2F%2Fblog.cyble.com%2F&cfenv=prod&pdt=2023-02-07&csp=ro
content-type
text/html; charset=utf-8
date
Tue, 07 Feb 2023 11:05:13 GMT
etag
W/"c7834f4849c29cc06653b205cd75f153"
last-modified
Fri, 03 Feb 2023 11:03:30 UTC
report-to
{"group":"default","max_age":86400,"endpoints":[{"url":"https://exceptions.hubspot.com/csp/reports"}]}
reporting-endpoints
default="https://exceptions.hubspot.com/csp/reports?cfRay=795ba63198982c47&resource=conversations-visitor-ui/static-1.14500/html/index.html"
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
origin, Accept-Encoding
via
1.1 d6b2e9bf1f40c8fcec509faeb60f8c54.cloudfront.net (CloudFront)
x-amz-cf-id
iWNeabxWM4pYCwnQQLbSEDL4GyW8NNBahRYSVQbBSTkCsD5MyiAhKw==
x-amz-cf-pop
IAD55-P3
x-amz-replication-status
COMPLETED
x-amz-server-side-encryption
AES256
x-amz-version-id
0BolSuBNOKX9GFlWXn7I8dZgZevrr7yJ
x-cache
Hit from cloudfront
x-hs-cache-status
MISS
x-hs-target-asset
conversations-visitor-ui/static-1.14500/html/index.html
x-hs-worker-debug-mode
false
token
cdn.linkedin.oribi.io/partner/4053396/domain/blog.cyble.com/
36 B
376 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/4053396/domain/blog.cyble.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2304:8800:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://blog.cyble.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 10:18:23 GMT
content-encoding
gzip
via
1.1 127e1ddb6224f10ae9e484392afd1b6c.cloudfront.net (CloudFront)
x-amz-cf-pop
VIE50-P1
age
2810
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
Ib46dhHg6xtMMZYYpEE3WX0lCkPlazMKrmrijb1DrOUDkQ3wDhBEjQ==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1675767913239&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4053396%26time%3D1675767913239%26url%3Dhttps%253A%252F%252Fblog.cyble.com%252F202...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1675767913239&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&liSync=true
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1675767913239&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&liSync=tr...
0
265 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1675767913239&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&liSync=true&e_ipv6=AQIjM3ct7OpEFQAAAYYrjR3X9kDD2wAgJ9BUxsSRPuSNkN6qMj_mrCtacKF8T5ZXVAW3AX89eO1GjwXjcCV5ODAA0WsDWg
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 03BEBA79D5FE465FA48CA7966B476E6D Ref B: FRAEDGE1422 Ref C: 2023-02-07T11:05:14Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lor1
x-li-proto
http/2
content-length
0
x-li-uuid
AAX0Gh9CpHotHcAQSeTdUg==

Redirect headers

date
Tue, 07 Feb 2023 11:05:13 GMT
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 2F2F677D6EBE4030BAA15A6D75B9612B Ref B: FRAEDGE1215 Ref C: 2023-02-07T11:05:13Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lor1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4053396&time=1675767913239&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&liSync=true&e_ipv6=AQIjM3ct7OpEFQAAAYYrjR3X9kDD2wAgJ9BUxsSRPuSNkN6qMj_mrCtacKF8T5ZXVAW3AX89eO1GjwXjcCV5ODAA0WsDWg
x-li-proto
http/2
content-length
0
x-li-uuid
AAX0Gh88eWQRHYQRKzRvfw==
272.8d8a39d8fa64efbb0671.css
injection.amibreached.com/css/ Frame 6CD4
348 KB
52 KB
Stylesheet
General
Full URL
https://injection.amibreached.com/css/272.8d8a39d8fa64efbb0671.css
Requested by
Host: injection.amibreached.com
URL: https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c77d2ba289d0e2827ad7f79b00972a63c7f4426d89b8ce6b5da90a368760cfe4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 b3dc72c60418e8887de31f772538f118.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
2981
x-amz-cf-pop
FRA56-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:51 GMT
server
cloudflare
etag
W/"a858af055119af47585aeffbfd69ceac"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7eL90uZdBErUHM7f9Ft7KMPBzVNd8DwCfCE7WC5Jbx9C9UmHcru1we%2FPsgfQpIBXOTZ15LfceynhRpEluisLCIhjo%2FJiGa83hCe%2BvgcZghAjaWPm8e%2FhZGqy%2FzGajBhYIqoq8lvnTRvtEF%2BvvRxpKz2rr0jY92o%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=120
cf-ray
795ba6320faf377b-FRA
x-amz-cf-id
ZDVlY9QIpys45tJDblcd5gVhGlnQqwRlta-2U8yIE_mq5qgnRzFOkg==
272.8d8a39d8fa64efbb0671.chunk.js
injection.amibreached.com/chunks/ Frame 6CD4
381 KB
101 KB
Script
General
Full URL
https://injection.amibreached.com/chunks/272.8d8a39d8fa64efbb0671.chunk.js
Requested by
Host: injection.amibreached.com
URL: https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
29d409fee0f34ebc05fa36076c101b77e28dccbcfdbfbf4cf248371820ca9ddb
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
6602
x-amz-cf-pop
FRA56-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:50 GMT
server
cloudflare
etag
W/"a161e1a55882deeacea4aadc5ab6a660"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lcz5TrJKTr0pcpyaepJDrQjpKYlGcTRCReTtR1rYhktrDmXRjYwtMAy6EIgDK7mSbUcoaZtLOq2c94Q7wnVEn8g13qM6wJ3Jds8RS1EOoojSULKSDuRY%2FzQdiFvp%2BcMsl0B4rcAVDqDeGZF5Y6elmBZjChFvJxA%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=120
cf-ray
795ba6320fb3377b-FRA
x-amz-cf-id
XsVq1QKIB3DPZyov1IWHpa7CfD-QocAcvEVwEJBKMPAWEowN-fRppA==
349.8d8a39d8fa64efbb0671.css
injection.amibreached.com/css/ Frame 6CD4
3 KB
2 KB
Stylesheet
General
Full URL
https://injection.amibreached.com/css/349.8d8a39d8fa64efbb0671.css
Requested by
Host: injection.amibreached.com
URL: https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9d904f71a4d973dac278821490969eb0a63dd97635584930bbbbec0a3e608d75
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 f2fa38e6635ded6d22a69d089217bc90.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
6602
x-amz-cf-pop
FRA56-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:51 GMT
server
cloudflare
etag
W/"d5e9ad0edf5f90c0d209a111611b1fba"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UEhJDZgY12kR7dvf%2BVaXTGcwW6ZS4ki4MDjn%2FFB7XkXvYZ6eJLUqkwy6CHeZz%2BeSNcNFaRUPZvetz8nHoUAUAITD1woLwzMycl5GLb%2BfbP9S1JeiQzVT74SunvOc0h81km0mfqjYWZUL9cu%2BHuOC8bPfVDlQNlw%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=120
cf-ray
795ba6320fb2377b-FRA
x-amz-cf-id
XSOmTNIUC4tNgIsbFIAPtaCG4T6e6VmAwGSZFTku1butz7qkOFFtrw==
349.8d8a39d8fa64efbb0671.chunk.js
injection.amibreached.com/chunks/ Frame 6CD4
16 KB
5 KB
Script
General
Full URL
https://injection.amibreached.com/chunks/349.8d8a39d8fa64efbb0671.chunk.js
Requested by
Host: injection.amibreached.com
URL: https://injection.amibreached.com/inject.8d8a39d8fa64efbb0671.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2c197367cb631f88fca96c13ec0c06d0a99bc5398d0349716bc06ce7a91e8ce
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 eab88762658052b4a1e386f8521a38ce.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
6602
x-amz-cf-pop
FRA2-C1
content-encoding
br
x-cache
Hit from cloudfront
last-modified
Mon, 23 May 2022 20:31:51 GMT
server
cloudflare
etag
W/"0e05edf25a54d46e1a8ef01ec442978b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l3L2tY3zlnm8wcuo3eK%2FyjMtWp%2B50dy6C%2FXSt5%2FwtI4ww8TCLFpZPZ4IOJ7e0moCexCIacctUapLRhZvzOz%2Ff0yiCK21uryeYCKI55mEaFPhwtxoMkjH7UXxrxlsrbVr7GBmMnq2nI1enA0MtHblmZQuYiZfM04%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=120
cf-ray
795ba6320fb4377b-FRA
x-amz-cf-id
fOXYeKZo72csGnrfL0HfZJq2YWZBSomT9wKFVwle6R8XPHjW5-2Abw==
enterprise.js
www.google.com/recaptcha/
942 B
901 B
Script
General
Full URL
https://www.google.com/recaptcha/enterprise.js?render=explicit
Requested by
Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80e::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
133525dcf0069ee49fdfd1761ae7cc86679febf3e8c81fc3a357e2e5359933c1
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
581
x-xss-protection
1; mode=block
expires
Tue, 07 Feb 2023 11:05:13 GMT
__ptq.gif
track.hubspot.com/
45 B
356 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=16&fi=790ac0ff-0b05-4061-9a47-31d43798706a&lfi=3647704&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1858685340&v=1.1&a=21289959&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&t=Cyble+%E2%80%94+Massive+Ransomware+Attack+Targets+VMware+ESXi+Servers&cts=1675767913294&vi=90cef9fbe5322d867ea1dfeee17eb131&nc=true&u=27441379.90cef9fbe5322d867ea1dfeee17eb131.1675767913032.1675767913032.1675767913032.1&b=27441379.1.1675767913032&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
6a07f8b4-78b2-4177-a6b9-9202048d790d
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
45
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x0GqIFwcbj9aSbBVkzskdEPx%2BA7lZ%2FXavZwNuLp4jjHlGBMfmDeiTSk0XVo4PrRhevxZiR1rH8laFt5nnYXkBBTOXSMyeWiK%2BLfkVpoqzH0XoIvccfeSvZ3bvDLfsaEpaCiUQraMe97jZtMvoFe3"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
795ba63239842c47-FRA
x-robots-tag
none
__ptq.gif
track.hubspot.com/
45 B
665 B
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=16&fi=8af5df7f-7224-4e24-859c-130a9ca0ccda&lfi=3720108&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1858685340&v=1.1&a=21289959&rcu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&pu=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&t=Cyble+%E2%80%94+Massive+Ransomware+Attack+Targets+VMware+ESXi+Servers&cts=1675767913295&vi=90cef9fbe5322d867ea1dfeee17eb131&nc=true&u=27441379.90cef9fbe5322d867ea1dfeee17eb131.1675767913032.1675767913032.1675767913032.1&b=27441379.1.1675767913032&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
fb2a250b-d65f-45c4-848a-c2e1647e3f4e
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
45
server
cloudflare
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oBTLZHp9wLfgXmz68vUj8DqzLV%2Bjz071TUVpcMgpQvZmUOiqvNkVzAFFfbDW1A7Y9ceBd7CWPdGdein%2BhYnePhgf9INZRZaZjE9jqSEERE5w57WpuXYm8WiQy2m9xotElz%2F6cjvk1MXQvGHBofkr"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
cf-ray
795ba63239862c47-FRA
x-robots-tag
none
primeicons.ttf
injection.amibreached.com/assets/fonts/ Frame 6CD4
56 KB
57 KB
Font
General
Full URL
https://injection.amibreached.com/assets/fonts/primeicons.ttf
Requested by
Host: injection.amibreached.com
URL: https://injection.amibreached.com/css/272.8d8a39d8fa64efbb0671.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:c31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c1e93246e1f3ea9a11fa1a6d7c14e48a1da911f92043e2e6ef59da5ffd38f070
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://injection.amibreached.com/css/272.8d8a39d8fa64efbb0671.css
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
via
1.1 0e75d8f2d484ce463fc04f5c422aa178.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options
nosniff
age
2570
x-amz-cf-pop
FRA2-C1
x-cache
Hit from cloudfront
content-length
57384
last-modified
Mon, 23 May 2022 20:31:50 GMT
server
cloudflare
etag
"121254f73060bcbb53ca13258dbd134f"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
binary/octet-stream
access-control-allow-origin
https://blog.cyble.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rmBg3XY%2Bo5cGxAm3jOqoPIuSuZsyxNeWlcaj1LdMw%2Fk0ooYbxK8A364UtUpTCQEHp%2F2wzM1R1h3aNLRjvSqXhk9UwzDVFQSa5EIRv3VCg2bqADfH5rhDCEUO14XDkC%2BRrfnto2pAww%2BraWMbNdq%2FQCpn52LyAnQ%3D"}],"group":"cf-nel","max_age":604800}
access-control-expose-headers
x-amz-server-side-encryption, x-amz-request-id, x-amz-id-2, x-origin
cache-control
max-age=120
access-control-allow-credentials
true
access-control-max-age
3000
accept-ranges
bytes
cf-ray
795ba632cd925b38-FRA
x-amz-cf-id
yJwxKBPXEDrDHVWqXiXv_inEclLP4w3LR1YflO6XGPJbAUDSYaUJdQ==
recaptcha__de.js
www.gstatic.com/recaptcha/releases/gEr-ODersURoIfof1hiDm7R5/
406 KB
162 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/gEr-ODersURoIfof1hiDm7R5/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise.js?render=explicit
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:805::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7100633cff808ec01559c4579130f2d6cef8d43e7f02c56d727ed33787d30fb9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.cyble.com/
Origin
https://blog.cyble.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Mon, 06 Feb 2023 08:52:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
94361
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
165540
x-xss-protection
0
last-modified
Tue, 31 Jan 2023 02:51:47 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 06 Feb 2024 08:52:32 GMT
bundle.production.js
static.hsappstatic.net/head-dlb/static-1.255/ Frame 20FB
44 KB
16 KB
Script
General
Full URL
https://static.hsappstatic.net/head-dlb/static-1.255/bundle.production.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/f8ba518128bb44b68924c2ca387494be?uuid=db4a7d690e5343bbada18ee5b79462c1&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=f8ba518128bb44b68924c2ca387494be&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
92986d66f075209e933031c072211f82c4dffdfd374a3ef870a648505c789789
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
x-amz-version-id
BU1gUK9lO46wXw.GxLMLib8Ax.frs5Yp
via
1.1 77c9518ff58162b5acfe6c69f9a24ec8.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
SOF50-P1
age
670210
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Mon, 30 Jan 2023 15:51:53 GMT
server
cloudflare
etag
W/"ab8919e33a4c517337e452aa75144717"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=62egnJY9dQbuHeNqwiaZWKt2nIST0P4j1RXobacpSwzChl26YJtqbNOVmJDW1kxGLkC%2BRLdtN5nWL5wBQInT95vOg6jmbmGzAucuqwoZQ01xUdiYd%2B2ht3tVYgpKgeAqx70%2F3UI1px3%2BYW90toJffuHTG%2Bw%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
795ba6360c8f9066-FRA
x-amz-cf-id
IbiK3hRg90wAMMveeMFt2hJofCGs8UPFlwmHI1Wm5orsY-DjHJ-kWg==
expires
Wed, 07 Feb 2024 11:05:13 GMT
visitor.css
static.hsappstatic.net/conversations-visitor-ui/static-1.14289/sass/ Frame 20FB
20 KB
4 KB
Stylesheet
General
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.14289/sass/visitor.css
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/f8ba518128bb44b68924c2ca387494be?uuid=db4a7d690e5343bbada18ee5b79462c1&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=f8ba518128bb44b68924c2ca387494be&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
963563d75d17a3c2b444ad4d73e3e9c24a43f6f9e121cce484aa6c7d197af73c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.hubspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
x-amz-version-id
8cTUQYaMqbf6Yv8IIYst6y8hd.mcxuTh
via
1.1 2d0b830a524ee826124d2332ddda1354.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
MCT50-P1
age
1610959
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Miss from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 19 Jan 2023 19:32:55 GMT
server
cloudflare
etag
W/"3192955eca3e03437d10c02e718e1960"
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MzOr55ZHohpvtoWMlR2CU3rZm3k%2FJ8UeRjQaFjUuk0H99vnCf%2BNfC%2BzWWl23fYCi1Q61sY84XlVd0ciU1u5MwdAvmUpUTFgC2CXSJvP6EGRxvE5tdbgUys6uT7rK%2B3RaVXXeOchH8ocfJNwNcNEDsurZErY%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
public, max-age=31536000
cf-ray
795ba635fe40bb41-FRA
x-amz-cf-id
OX_q8Yim3HnabsHsmR5QuJnUhiaXsdlm5c18K3TElX3_6wspCW-08g==
expires
Wed, 07 Feb 2024 11:05:13 GMT
bundle.production.js
static.hsappstatic.net/hubspot-dlb/static-1.352/ Frame 20FB
295 KB
94 KB
Script
General
Full URL
https://static.hsappstatic.net/hubspot-dlb/static-1.352/bundle.production.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/f8ba518128bb44b68924c2ca387494be?uuid=db4a7d690e5343bbada18ee5b79462c1&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=f8ba518128bb44b68924c2ca387494be&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
af4d8295ed405b08a948022d81e7fe9048305144f193c11aba9dc53229758199
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
x-amz-version-id
lUmRJ.EMHGuGoOzmCmMes42qja_ehMGL
via
1.1 976d678772d12ef1dc632cc293efa4f4.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
MXP64-C3
age
1011712
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 26 Jan 2023 17:07:33 GMT
server
cloudflare
etag
W/"ad05b7da4f5b501dafa9768c8e784ff8"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L6auZLspIB1ggWfB2IUUDHuwiSETPYbPXigPIbPAcW7W0TWkqiRo6V2QGJj2S2g1fj%2FWh1wQf77yyo2trBG2buXCNbjJRsg1Zv5cEneOzy0fQmr5Oucnw%2B31T6g%2FLKsZgbahnxS7BmzMpdCrETSK%2ByUg7SQ%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
795ba6360c919066-FRA
x-amz-cf-id
VVM0nUW7xXTXaMRDxPZ7fhC-lDCWGVczDce61pyNxr3Kl1DfKGGjMg==
expires
Wed, 07 Feb 2024 11:05:13 GMT
visitor.js
static.hsappstatic.net/conversations-visitor-ui/static-1.14500/bundles/ Frame 20FB
605 KB
178 KB
Script
General
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.14500/bundles/visitor.js
Requested by
Host: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/21289959/threads/utk/f8ba518128bb44b68924c2ca387494be?uuid=db4a7d690e5343bbada18ee5b79462c1&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=f8ba518128bb44b68924c2ca387494be&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b472eb33327ad1cc49a95b84cb8ec38369af25a371b351495b6c83fdee48b38
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:13 GMT
x-amz-version-id
cqcw421lryQFer_mamqJJ12IwoNtRlfL
via
1.1 82636c8aa9a5ece412a0bc535c0ca124.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
HEL51-P1
age
302488
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Fri, 03 Feb 2023 22:50:10 GMT
server
cloudflare
etag
W/"13290f072ea05c2e76cbb2248aeb54d3"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JQNZ5AyxdZiyHL2hHj7vQwvdqrQa4BdCFsk%2FiJBjJQWSR4yJ9QB94AP3LtwnAtJD2JuXSVLV84Zb48F3AfaKy8ATz0kv%2BocANOpw95CNM2GzoczgI2%2BwM0uqULT1huENFA78xYgmwp8KS%2FZTjA%2Fq%2FeB5HJs%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
795ba6360c929066-FRA
x-amz-cf-id
IEDLXL_bda3v4vypLsEQuCaT-XvllLCXwww-FXj8aAdkc2IEtF1G1Q==
expires
Wed, 07 Feb 2024 11:05:13 GMT
i18n-data-data-locales-en-us.js
static.hsappstatic.net/conversations-visitor-ui/static-1.14383/ Frame 20FB
778 B
918 B
Script
General
Full URL
https://static.hsappstatic.net/conversations-visitor-ui/static-1.14383/i18n-data-data-locales-en-us.js
Requested by
Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/conversations-visitor-ui/static-1.14500/bundles/visitor.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7d2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2e77cbf4626dd2563752e49f945292d89532160815b80125ba37f31b3bfcdb20
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/
Origin
https://app.hubspot.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:14 GMT
x-amz-version-id
iKymcBZKV7wBbnwy0iz9SB_vwwt9ekV9
via
1.1 a23dafbbb9a61c77bda1d66d97f24e2e.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
FRA56-C2
age
680228
x-amz-server-side-encryption
AES256
content-encoding
br
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Fri, 27 Jan 2023 14:58:23 GMT
server
cloudflare
etag
W/"78a29048c85f5d506eaf8d909683dd3c"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
https://app.hubspot.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KRFBAJzoOgiEs6luDKhBL8bkJdtnPgoHdRu0%2BDwchDJ8K0iwNeodohdmpnZTM5rrI4nfBZjsuzMoDDtMP75Zz59h9rBnYoPBqZAz6KyD0MR8MYqTpsJJfFEULPjcTVW98PKkJEmJ%2F5UVfHNtbkDez8NAtlA%3D"}],"group":"cf-nel","max_age":604800}
vary
Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-credentials
true
cache-control
public, max-age=31536000
cf-ray
795ba6377f049066-FRA
x-amz-cf-id
BNdxtaahiQMIikMRIije6d_dxBY4uVTNkXwLS76XN0TFzyZACiBnmA==
expires
Wed, 07 Feb 2024 11:05:14 GMT
hawk.png
labs.cyble.com/hs-fs/hubfs/ Frame 20FB
10 KB
11 KB
Image
General
Full URL
https://labs.cyble.com/hs-fs/hubfs/hawk.png?width=108&height=108
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:67e2 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
979338f4aa8d1de1b994be15531b85f1d9deef4d8da685bf18286d9928488520
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.hubspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:14 GMT
strict-transport-security
max-age=31536000
via
1.1 6e44ac4753bea102fe3aae286f68acfe.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
80471
x-amz-cf-pop
IAD55-P1
cf-polished
origSize=13721, status=vary_header_present
x-amz-server-side-encryption
AES256
edge-cache-tag
F-83412232556,P-21289959,FLS-ALL
cache-tag
F-83412232556,P-21289959,FLS-ALL
x-amz-storage-class
INTELLIGENT_TIERING
x-cache
RefreshHit from cloudfront
x-hs-https-only
worker
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 15
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
10237
last-modified
Tue, 31 Jan 2023 17:55:34 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"71a4b4d7a329d9270ca923d26543acd7"
vary
origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l3wo2yngB2uVJ%2Fs64Ti0QF%2FUHHtUujWH3HrmmoSYI7HKzFiAiLD3Him1367aFl1YjRRyBejvaMMfjXDdTnmqvXAzgB2i7xZxv3%2FyE%2BJUETOKkRijEUtdzYyVFE0RUAA%2B6nBjw4O9W2Usm1Ad"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
795ba6398ab390a6-FRA
x-amz-cf-id
xdQSuLHWiGX9D0SO5pb_Jf1tQNlydGBW4FuBv7FzNa9pevH3xSSD3w==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 15
rhumb
app.hubspot.com/api/cartographer/v1/ Frame 20FB
0
1 KB
Ping
General
Full URL
https://app.hubspot.com/api/cartographer/v1/rhumb?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.14500
Requested by
Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/conversations-visitor-ui/static-1.14500/bundles/visitor.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.hubspot.com/conversations-visitor/21289959/threads/utk/f8ba518128bb44b68924c2ca387494be?uuid=db4a7d690e5343bbada18ee5b79462c1&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=f8ba518128bb44b68924c2ca387494be&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 07 Feb 2023 11:05:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
1ae39fb7-c5e9-462d-9a45-97aa9ba99f55
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dOvzN50ZTneu419XKuSDMndQ1GgsjHMBCW%2FDYz6cqwhLb8ub8cIIzindhtVPGjxw9lbtScKCAK1mAzT7uPpIevhQumW9kKXRcxwL5hOTHlknvY%2FZJ33%2BIzi9S%2BeyWjsQR82KSvAWi5T%2FHFpKZw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://app.hubspot.com
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing, X-Hubspot-Correct-Hublet, X-HubSpot-Auth-Failure
access-control-max-age
604800
access-control-allow-credentials
true
cf-ray
795ba638efc0901c-FRA
access-control-allow-headers
Authorization, Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer
timing-allow-origin
*
welcomeMessages
app.hubspot.com/api/livechat-public/v1/bots/public/bot/2122156/ Frame 20FB
941 B
1 KB
XHR
General
Full URL
https://app.hubspot.com/api/livechat-public/v1/bots/public/bot/2122156/welcomeMessages?hs_static_app=conversations-visitor-ui&hs_static_app_version=1.14500&conversations-visitor-ui=static-1.14500&traceId=f8ba518128bb44b68924c2ca387494be&sessionId=AMOaWbKNuSq9JbsT-xqJwPjk5q3WA9TbI8PzW8BNy8suWXMO8w3XMtcQvhSsfrd7dcw__LMwVovj4SP-rfzNwyT8-w3aVw29EV0mSHOBRDoeCjRqcQSVNYnybrZ3tU0Rxj3UlxKcjsBaQZSSY1NE4GZUluXvuPFK8IlYTECwr-7LVUdzPVR9eqk
Requested by
Host: static.hsappstatic.net
URL: https://static.hsappstatic.net/head-dlb/static-1.255/bundle.production.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ae1bd3deffdaee0c2874b2164980b8b45503d2009f5d26783f43964c3d6ac18
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://app.hubspot.com/conversations-visitor/21289959/threads/utk/f8ba518128bb44b68924c2ca387494be?uuid=db4a7d690e5343bbada18ee5b79462c1&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=null&domain=blog.cyble.com&inApp53=false&messagesUtk=f8ba518128bb44b68924c2ca387494be&url=https%3A%2F%2Fblog.cyble.com%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&inline=false&isFullscreen=false&globalCookieOptOut=null&isFirstVisitorSession=true&isAttachmentDisabled=false&enableWidgetCookieBanner=false&isInCMS=false
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:05:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
11ab176b-c4bd-4369-9fa5-6fd80d5a2508
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
x-trace
2BD8BA18A42055053D1C94661709D99E00EDA6C982000000000000000000
vary
origin, Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N6XuP2LoKs10CwXq8UpGI6cQmzI5WKTd9iUuKuzxAw%2BCC29S%2BC7no0ntCmO58eEDVIZ5Gu7EKAInwoVt6aEqegsK6%2BWQG8AIpZZFnNICtwVNml3%2FVG6b3xuMH3hnK7CGoDtTZpYhyNqOVrC4vw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
false
cf-ray
795ba638ffd1901c-FRA
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
boom.gif
pixel.wp.com/
0
37 B
Image
General
Full URL
https://pixel.wp.com/boom.gif?bilmur=1&cumulative_layout_shift=0.082&largest_contentful_paint=1904&batcache_hit=0&provider=wordpress.com&service=atomic&effective_connection_type=4g&rtt=0&downlink=10000&host_name=blog.cyble.com&url_path=%2F2023%2F02%2F06%2Fmassive-ransomware-attack-targets-vmware-esxi-servers%2F&nt_fetchStart=0&nt_domainLookupStart=2&nt_domainLookupEnd=17&nt_connectStart=17&nt_connectEnd=70&nt_secureConnectionStart=38&nt_requestStart=71&nt_responseStart=279&nt_responseEnd=317&nt_domLoading=282&nt_domInteractive=1587&nt_domContentLoadedEventStart=1618&nt_domContentLoadedEventEnd=1632&nt_domComplete=2571&nt_loadEventStart=2571&nt_loadEventEnd=2609&nt_redirectCount=0&nt_nextHopProtocol=h2&nt_api_level=2&start_render=1483&first_contentful_paint=1483&resource_size=2453816&resource_transferred=402243&js_size=595820&js_transferred=176248&resource_cache_percent=0&js_cache_percent=0&last_resource_end=3988
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://blog.cyble.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 07 Feb 2023 11:05:16 GMT
cache-control
no-cache
server
nginx

Verdicts & Comments Add Verdict or Comment

165 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| oncontentvisibilityautostatechange object| _wpemojiSettings object| videopressAjax undefined| $ function| jQuery string| wsm_ajax object| cnArgs function| ajax_user_online function| gtag object| dataLayer object| _hsq object| _wsm string| adroll_adv_id string| adroll_pix_id string| adroll_version boolean| __adroll_loaded object| adroll object| hubspot object| HubSpotForms object| hbspt object| hsFormsOnReady object| artemis object| astra function| generateStyleVariables function| astraGetParents function| getParents function| astraToggleClass function| toggleClass function| astraTriggerEvent function| astraSmoothScroll function| astScrollToTopHandler function| popupTriggerClick function| AstraToggleSubMenu function| AstraToggleSetup function| astraNavMenuToggle object| leadin_wordpress object| astraAddon object| jetpackLazyImagesL10n object| jetpackSwiperLibraryPath object| jetpackCarouselStrings object| uael_posts_script function| display_mega_menu_on_load object| items function| apply_megamenu_width_styles object| runtime function| astraToggleSetupPro function| astraNavMenuTogglePro string| sticky_header_on_devices string| site_layout_box_width string| hook_sticky_footer string| sticky_footer_on_devices function| EvEmitter function| imagesLoaded function| jQueryBridget function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Isotope function| Masonry function| addResizeListener function| removeResizeListener object| webpackChunkelementor_pro object| webpackChunkelementor object| elementorModules object| regeneratorRuntime function| setImmediate function| clearImmediate object| wp function| sprintf function| vsprintf object| ElementorProFrontendConfig object| elementorProFrontend function| Waypoint object| uael_particles_script object| elementorFrontendConfig object| elementorFrontend object| scope_array number| backend function| Sticky object| _stq object| twemoji function| st_go function| linktracker_init object| wpcom function| __adroll__ string| adroll_sid object| __adroll function| __cmp function| __tcfapi boolean| adroll_sendrolling_cross_device object| adroll_form_fields function| adroll_tpc_callback object| JSON_WSM number| width number| height object| clientInfo object| Wsm function| wsm_log object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| _hsp object| __adroll_consent_data object| adroll_exp_list object| gaplugins object| gaGlobal object| gaData object| globalRoot undefined| hns function| bindToWindowOnError function| defineProperties object| leadflows function| OutpostErrorReporter function| _registerAvailablePopup object| _availablePopups boolean| popupPoliceActive undefined| hns2 undefined| jade undefined| I18n undefined| Pikaday undefined| reqwest undefined| exports undefined| define boolean| LEAD_FLOWS_RAN boolean| COMMON_SETUP_RAN boolean| PIXELS_RAN object| enabledEventSettings object| __hsCollectedFormsDebug boolean| hubspot_live_messages_running object| HubSpotConversations boolean| _hspb_loaded boolean| _hspb_ran object| __adroll_consent boolean| __adroll_consent_is_gdpr string| __adroll_consent_user_country string| __adroll_consent_adv_country function| ShareLink object| $jscomp string| BANNER_VERSION string| TCF_VERSION string| IABWRITE_NO_COOKIE object| __adroll_consent_banner object| __adroll_consent_prev_lastchild object| _paq function| sanitizeKey boolean| _hstc_loaded boolean| _hstc_ran string| __hsUserToken number| expireDateTime object| _linkedin_data_partner_ids function| lintrk boolean| _already_called_lintrk boolean| LEAD_FLOW_DOCUMENT_READY_RAN object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha

23 Cookies

Domain/Path Name / Value
blog.cyble.com/ Name: _wsm_id_1_abdf
Value: fbb14855d087934c.1675767912.1.1675767912.1675767912
blog.cyble.com/ Name: _wsm_ses_1_abdf
Value: *
.cyble.com/ Name: _gid
Value: GA1.2.1719886509.1675767913
.cyble.com/ Name: _gat_gtag_UA_201575643_1
Value: 1
.cyble.com/ Name: _ga_4FJGSRPM4S
Value: GS1.1.1675767912.1.0.1675767912.0.0.0
.cyble.com/ Name: _ga
Value: GA1.1.728672374.1675767913
.cyble.com/ Name: __hstc
Value: 27441379.90cef9fbe5322d867ea1dfeee17eb131.1675767913032.1675767913032.1675767913032.1
.cyble.com/ Name: hubspotutk
Value: 90cef9fbe5322d867ea1dfeee17eb131
.cyble.com/ Name: __hssrc
Value: 1
.cyble.com/ Name: __hssc
Value: 27441379.1.1675767913032
blog.cyble.com/ Name: ln_or
Value: eyI0MDUzMzk2IjoiZCJ9
.linkedin.com/ Name: UserMatchHistory
Value: AQKQOa3_afPg5wAAAYYrjRxClIN0cKCHX8U4uFBiomPDhtNMN9o-M-nq4IwE2LjG4GPzy3Ey2XH4bQ
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQIGyMkx8C6QfAAAAYYrjRxCoixIrQzmdyd90me3t4FbuougIm14kR3BST8tlLDyTlTWSr-8qhbGIibpEQYLDQ
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&51dbf578-afcf-4645-894c-ded66ecea542"
.linkedin.com/ Name: lidc
Value: "b=OGST09:s=O:r=O:a=O:p=O:g=2427:u=1:x=1:i=1675767913:t=1675854313:v=2:sig=AQHKVpOOeI3dO4Jz_cdINnQqxxrQEJLx"
.hubspot.com/ Name: __cf_bm
Value: ouEyaw66hzuXPJcZY04f83TqeJzF_2.yG6LPOMRPGdQ-1675767913-0-AXHNYG7PGRIOjDR0Mg/m2/VXl7o6n1a4cCQfj12SP1b/XhiEw0p5fuWknrnGdqHs/Co4vzW7hnpWImK/GFLq1gk=
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&2023020711051324ff22cd-c391-4e3b-8734-46121b628d2aAQEN4RFZRX4MdWhP_yZP5npj3DVC9CA6"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NzU3Njc5MTM7MjswMjHjfF0IMTokCuxZs0tPimLFnuyUJY5Jc3ziVaBDAp3FCQ==
.blog.cyble.com/ Name: messagesUtk
Value: f8ba518128bb44b68924c2ca387494be
.labs.cyble.com/ Name: __cf_bm
Value: SlKmGl0FJFzqKAbCGny8BJ7TR6AhTy38GQHP55l1X.8-1675767914-0-AfKUqWk++PNh/B76kVb7S9xjSkvhwA0NNlsqf8ecyknUa0FeuUIJcPil4IpeYalAQilaMSqCrx8V35vz3ZDi5YM=
.labs.cyble.com/ Name: __cfruid
Value: 8cef31c0f02ff97b3fbe146a8d277d6daace4911-1675767914

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.hubapi.com
api.hubspot.com
app.hubspot.com
blog.cyble.com
cdn.linkedin.oribi.io
d.adroll.com
fonts-api.wp.com
fonts.wp.com
forms-na1.hsforms.com
forms.hsforms.com
forms.hubspot.com
i0.wp.com
injection.amibreached.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsforms.net
js.hsleadflows.net
js.usemessages.com
labs.cyble.com
pixel.wp.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
s.adroll.com
s0.wp.com
snap.licdn.com
static.hsappstatic.net
stats.g.doubleclick.net
stats.wp.com
track.hubspot.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
13.107.42.14
192.0.76.3
192.0.77.2
192.0.77.32
192.0.78.183
2001:4860:4802:32::36
2001:4860:4802:38::178
2600:9000:211e:c800:6:9280:1080:93a1
2600:9000:2304:8800:2:53b2:240:93a1
2606:2c40::c73c:67e2
2606:4700:20::681a:c31
2606:4700:4400::ac40:9a55
2606:4700::6810:5805
2606:4700::6810:5905
2606:4700::6811:43b0
2606:4700::6811:72b0
2606:4700::6811:7d2
2606:4700::6811:80ab
2606:4700::6811:b749
2606:4700::6811:c8cc
2606:4700::6811:d4cc
2606:4700::6811:e6cc
2606:4700::6811:edcc
2606:4700::6813:9a53
2620:1ec:21::14
2a00:1450:400d:805::2003
2a00:1450:400d:808::2008
2a00:1450:400d:80e::2004
2a00:1450:4025:401::9a
2a02:26f0:11a::6867:4832
2a05:d018:cc3:fe04:b28b:5c08:310b:9699
014b2b1c41f3a79609ab3dc05b4de33205240052b0f2bc7715415eacaad638f3
05096f7a0e9de1566ba03be810da6d252f233a7c999021d5f2f3aa975e92ab0f
0b472eb33327ad1cc49a95b84cb8ec38369af25a371b351495b6c83fdee48b38
0d5d79b34f9adaf4c8c43ec93b7c80d8e401310d378d3fa48bdd0fee1e3c56f9
0f12c37bfbe94e5c37d4c4a0ab301f496683db922639b0e43f2b9977492fe57b
133525dcf0069ee49fdfd1761ae7cc86679febf3e8c81fc3a357e2e5359933c1
138154c0deed3326477b9b4909175101070a5a3a95342291b53d8cc9879a5f47
186cb05caa2a06748336b3123d7ac53986a650cffcab18f34e5c0ee3c057f591
1e6ebf687f918671709224ad3047910b592542de487e4a38209f42d58b0062a5
1f1cb60892b45c8e44a0f4222e01af33655dfb7c0e81dd8d937c6d44c38bb632
2616becd1fa25433adee513644da53245e542892264edc46b611ebc3c9e2d9ed
29d409fee0f34ebc05fa36076c101b77e28dccbcfdbfbf4cf248371820ca9ddb
2d49eabfc4c9ea154b616159357e5cb5708e39b43b7d11c3ee64e00bcf69ce85
2dfbd972f157603affc32572b9feb512ef6ac1a5da01cee30febd05e4742d926
2e77cbf4626dd2563752e49f945292d89532160815b80125ba37f31b3bfcdb20
34bbd1c367ffc7d80fcff86c7e5f8777e70f4911bb324e8ecfc7dd3604a96e68
359c32724ded3d649d66332ac70da65306ff8c45ff08f9d0e253ae1fd175e109
382e9768b5578d5ad05e51e37670a3cf93d4593a49bcbee1f5e8b66d0d8c1c53
3999cf864b43937c278afeae5b60b6db69bb234d5641202c9e7a2385029aa3b7
39e5a17105d5cd2a65e6d1a7b6a65afec887c339c3626016ed33265db4206be0
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
4acadd6be157476c80a0d0ce659b0a8033c2253f689cc84aa11a3597cea382ab
51dc1ea3b9642d966bbdf2c63346e4d2d3f668a693fa8e7f1e31bf6acbe48860
534fd5b9e499e6f74045f4bb61b214e928b4b57e4b4e1767554350626046a7c4
53c192dc46187ef72bb5623c417ad7e6a7cbf2c2ca98f58647704c78b0fb0579
5736f20e2a413433b3af338e6cccd1318197981ce66e68ac810e723ccbf9c10c
58cc3b65706bfd08a91d79d29efd7deeb284716dd9dde2123c32bf20aac754f5
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
5dd1d4901a2aa0c9c999e4666f76cfaad441a0e75affd1b4be6bbc754e73e6ba
691fa7d17effc7d303eda0ad7e4a1d91b2f375506cfc8a774480cc2b55f156ea
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7100633cff808ec01559c4579130f2d6cef8d43e7f02c56d727ed33787d30fb9
7883c3cfb3f71df2ec3c0574dd83d0b6849a12248b6b9142ea99752636310a47
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7caf8e90e89ddd7ade412df4a07c33c9a817460d9659a8323136c2a55fb58e33
81a3d1ed00e556a1243c67a8e55cc553e78e78649c1c7b03c890d52091cab599
81ca0d70f50ab00f0c1e0933c11bf7bb6aada2366994784564f4d324dfd7a60c
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
82dbeea789c21359a9d808969f52d40a37ac85078a6cd1cbee0e702314c46997
84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
90b705145ef82e9d8493aae55c9bfb3200ec0620c8946b20b0b28366557d6a4a
91144fbcc0e3f609b021e362ec29d2a9b58f15e840f229eb99ea2c04d927882b
92986d66f075209e933031c072211f82c4dffdfd374a3ef870a648505c789789
963563d75d17a3c2b444ad4d73e3e9c24a43f6f9e121cce484aa6c7d197af73c
979338f4aa8d1de1b994be15531b85f1d9deef4d8da685bf18286d9928488520
984d8a00a23b717ad2d084139b7a0880fb888e7c9030a11f5e3bfde3670ffa68
9a9f486dbced5fc30452e0967ddcc344a2efde5d0b5e4b2e7e32302e14a58235
9ae1bd3deffdaee0c2874b2164980b8b45503d2009f5d26783f43964c3d6ac18
9af44543fbf7b09c3d68e46dcb21d2cb9ec5f18bbd537cea92360a85c5db793e
9d904f71a4d973dac278821490969eb0a63dd97635584930bbbbec0a3e608d75
9f85c527cd792a07dd77636f74775b8e1fe3cc586225af910685a64c9ff5ed9b
a2c197367cb631f88fca96c13ec0c06d0a99bc5398d0349716bc06ce7a91e8ce
a3bfa651e02b66cada04727b09bc94fbeb60e7e28d141d24c5315181ca052dff
a9c399a3695f864f52665163ff94626e3b77b44747e1519b03e5f82597b004d7
af4d8295ed405b08a948022d81e7fe9048305144f193c11aba9dc53229758199
b9a4ac7fc4b84ffae0f68c36e7a94d7f83a6784a4c448641ef6e1004904da4fe
bbdb1d21246d1c1a65aca8b41818f593b2d4704a459983866c0d331151b91887
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355
be6b0e93746c524b22c5fb86e371f59137c0e5fa6ca601f48a05b4f0b76390b0
c1e93246e1f3ea9a11fa1a6d7c14e48a1da911f92043e2e6ef59da5ffd38f070
c27a8d0abc42f5fcd3a4ad9480ca7bd1bbe1fcb23d5438b4420f1cbcab3ecc9f
c77d2ba289d0e2827ad7f79b00972a63c7f4426d89b8ce6b5da90a368760cfe4
c7d0240fd43289ab1411c5fa1277574ee436d3a3bbb82d34c4d82f32d04517b8
c7d8282f2291011cd48b16089e8975695db10ed895d76793b8721fb1cd32ae05
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
ccd69c27d47887045e48ebbcd389d285a08d6cddf4b0c3d0e86070c35cceb1bd
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
d5aa61a003aa8e1379fa28c926ff8da5a6b08b7fbc9ba65f82dedd1842be2e5a
da2dfacdb9a6855bfe38d21950a999ffb33a12c7ea806d605bb32f2cca7328c2
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e1b2299955d137982d8e6eefb796b9bb4435ac23cf156ef9054b1c91fabcb1ae
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e510f6d13f1fc7aa8beffe8001f6182594c33e644cc690cc71c09e22cc6ea990
e545d0e2a57ee8fb5f5e003c77db10aa2b602284859fe1c8f805682960950858
ee3d3fafc874740d773a711482d0ace893f213475c290a38c3c1054e120c0020
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef896b86a77ae191af41c2714906decbab4bbb7fd32321c14f4f398eb7f264ba
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f7455fff3d4e08245186e113636f69cbc44679bdf8870de5e4fd9a835e3d2e93
f8392cf8d00ac45d817b2b02ee0bd33f1bcb59fd135568e3fb5df5ca3042101e
fa28de0db846c10133053b2afac2c078ac3655d4cb66d5d7e46eba419e5a6566
fd43cd92e272c2e3872abd9559900116d85f2899e76c00015c59360060bcf062
ff976a50da8b58f687acb98ea426edf769b690d57433e1640b6e514b3f832352