malware.news Open in urlscan Pro
2606:4700:20::ac43:4a41 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Submission: On December 29 via api (December 29th 2021, 2:34:31 pm UTC) from US — Scanned from DE

Summary HTTP 34 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 34 HTTP transactions. The main IP is 2606:4700:20::ac43:4a41, located in United States and belongs to CLOUDFLARENET, US. The main domain is malware.news.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 15th 2021. Valid for: a year.

This is the only time malware.news was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
31	2606:4700:20:... 2606:4700:20::ac43:4a41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:812::200e	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:621	13335 (CLOUDFLAR...) (CLOUDFLARENET)
34	3

31 2606:4700:20::ac43:4a41 (United States)

ASN13335 (CLOUDFLARENET, US)

malware.news	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:621 (United States)

ASN13335 (CLOUDFLARENET, US)

therecord.media	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
31	malware.news malware.news	1 MB
2	google-analytics.com www.google-analytics.com	20 KB
1	therecord.media therecord.media	85 KB
34	3

	Domain	Requested by
31	malware.news	malware.news
2	www.google-analytics.com	malware.news www.google-analytics.com
1	therecord.media	malware.news
34	3

This site contains links to these domains. Also see Links.

Domain
therecord.media
www.techmeme.com
www.cisa.gov

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-15` - `2022-06-14`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Frame ID: 3F7BF9F2D8E0FDED786017A0EB0D611C
Requests: 34 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Iranian hackers behind Cox Media Group ransomware attack - Malware News - Malware Analysis, News and Indicators

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

34
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1257 kB
Transfer

5416 kB
Size

3
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://therecord.media/iranian-hackers-behind-cox-media-group-ransomware-attack/
Title: 2

Search URL Search Domain Scan URL

URL: https://therecord.media/live-streams-go-down-across-cox-radio-tv-stations-in-apparent-ransomware-attack/
Title: on June 3

Search URL Search Domain Scan URL

URL: https://therecord.media/four-months-later-cox-media-confirms-ransomware-attack/
Title: four months later

Search URL Search Domain Scan URL

URL: https://therecord.media/us-charges-iranian-hackers-for-spoofed-proud-boys-emails-threatening-us-voters/
Title: charged two Iranian nationals

Search URL Search Domain Scan URL

URL: https://www.techmeme.com/211119/p20#a211119p20
Title: Lee Enterprises

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/uscert/ncas/alerts/AA18-337A
Title: SamSam

Search URL Search Domain Scan URL

URL: https://therecord.media/
Title: The Record by Recorded Future

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

34 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 55892 Show response
malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/ 75 KB
17 KB 290ms
250ms Document
text/html 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c339152e8df845241ffe11c39dccfd65bc08f18e6e155482e2414129f07b5b1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src https://malware.news/logs/ https://malware.news/sidekiq/ https://malware.news/mini-profiler-resources/ https://malware.news/assets/ https://malware.news/brotli_asset/ https://malware.news/extra-locales/ https://malware.news/highlight-js/ https://malware.news/javascripts/ https://malware.news/plugins/ https://malware.news/theme-javascripts/ https://malware.news/svg-sprite/ https://www.google-analytics.com/analytics.js; worker-src 'self' https://malware.news/assets/ https://malware.news/brotli_asset/ https://malware.news/javascripts/ https://malware.news/plugins/; frame-ancestors 'self'; manifest-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding Accept
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: strict-origin-when-cross-origin
x-discourse-route: topics/show
cache-control: no-cache, no-store
content-security-policy: upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src https://malware.news/logs/ https://malware.news/sidekiq/ https://malware.news/mini-profiler-resources/ https://malware.news/assets/ https://malware.news/brotli_asset/ https://malware.news/extra-locales/ https://malware.news/highlight-js/ https://malware.news/javascripts/ https://malware.news/plugins/ https://malware.news/theme-javascripts/ https://malware.news/svg-sprite/ https://www.google-analytics.com/analytics.js; worker-src 'self' https://malware.news/assets/ https://malware.news/brotli_asset/ https://malware.news/javascripts/ https://malware.news/plugins/; frame-ancestors 'self'; manifest-src 'self'
x-discourse-cached: store
x-request-id: 539f2bc0-0f10-45c4-a6eb-86853fc6eed3
x-runtime: 0.123123
x-discourse-trackview: 1
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nSp4maZTHzGdjzDRdqzhHF%2BHQhDkKEnpMY4Q8xN0EF4cqf%2B5aFk1JPnjSe9383K1UiYH0pSXVEw%2BxbkCtX86Ys9LKrTZCUFiApypKatGKd3PBgQQ%2Frmh8nleKiJy29%2BuWu%2Bh%2BvJqkBMIeg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6c53bfc76b702b22-FRA
content-encoding: br

GET
H2 200 color_definitions_base__2_6def72eaa1a4ff9cfff127d8e413e022eddd8f7e.css
malware.news/stylesheets/ 2 KB
1 KB 20ms
19ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/color_definitions_base__2_6def72eaa1a4ff9cfff127d8e413e022eddd8f7e.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

300a1ca6c2afa8f2e2f848147170f01ff50b01f40622a7bce9f83b20a7a1ea26

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies: none
age: 415599
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B2ba3hgMwjYwE25wDSFd%2BMW3w3Bu6vb%2BJHGK2gc9Te3%2B2YwOm7do56SjMOgVKqPX%2Fd8BCgGuEf5PqQHupkHxWnNrwu%2FSfICoZxeKnUH1KG%2F3CvuGV%2F%2F0Wyq2irzVJj1VSNYZx8UWFEasew%3D%3D"}],"group":"cf-nel","max_age":604800}
x-discourse-route: stylesheets/show
content-disposition: inline; filename="color_definitions_base__2_6def72eaa1a4ff9cfff127d8e413e022eddd8f7e.css"; filename*=UTF-8''color_definitions_base__2_6def72eaa1a4ff9cfff127d8e413e022eddd8f7e.css
x-xss-protection: 1; mode=block
x-request-id: a54a6b0d-20b7-4941-8cd2-66e620023578
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 24 Dec 2021 18:27:49 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept
x-download-options: noopen
content-type: text/css
cache-control: public, max-age=31556952, immutable
cf-ray: 6c53bfc90e572b22-FRA
content-transfer-encoding: binary

GET
H2 200 desktop_8ece7bbcad81adf9a973e63dece091ab17c044d6.css
malware.news/stylesheets/ 392 KB
71 KB 33ms
32ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/desktop_8ece7bbcad81adf9a973e63dece091ab17c044d6.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f468ed9c322f3ab5069a922ca421c4f637892d870e83767625659ff432628e9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies: none
age: 414774
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZASEpYf6SuXhno81SQ9g%2BjhExEllhd2%2Bn2S%2FIcDxaSSWPIkqcM5DivwL%2FhzY3uJO6LQnb0wCI%2F5FBxzZmS1mD90ui5R0mj7P51Fv%2Fdoo4Gr0cX4%2FhTrNHqjSFqvqAHf1k1ST1mNNK7aSBg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-discourse-route: stylesheets/show
content-disposition: inline; filename="desktop_8ece7bbcad81adf9a973e63dece091ab17c044d6.css"; filename*=UTF-8''desktop_8ece7bbcad81adf9a973e63dece091ab17c044d6.css
x-xss-protection: 1; mode=block
x-request-id: 96f3e8bb-6d01-4b44-8ad8-cdc7d7d04786
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 24 Dec 2021 18:27:45 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept
x-download-options: noopen
content-type: text/css
cache-control: public, max-age=31556952, immutable
cf-ray: 6c53bfc90e592b22-FRA
content-transfer-encoding: binary

GET
H2 200 discourse-details_8ece7bbcad81adf9a973e63dece091ab17c044d6.css
malware.news/stylesheets/ 1 KB
974 B 18ms
15ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-details_8ece7bbcad81adf9a973e63dece091ab17c044d6.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d1460046f707605a81e287d2479f7dc420dbb3ccbd82d33eb5aa2fe06f36e779

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies: none
age: 415599
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VKmYf1t7MWf5aPZijxOREQ%2FQGX4a4Mp6GK%2FmXHmq5kGcwBi9KuiZdzAqeWeBTWizL5bNR%2FjarjvfUsuoONQL5OyCh1kGCCdSTGuGLn6cWI1p3eIW6hxLQ90gl9HKOEyGM1wZVHbfLFMV5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-discourse-route: stylesheets/show
content-disposition: inline; filename="discourse-details_8ece7bbcad81adf9a973e63dece091ab17c044d6.css"; filename*=UTF-8''discourse-details_8ece7bbcad81adf9a973e63dece091ab17c044d6.css
x-xss-protection: 1; mode=block
x-request-id: a1b1694b-8783-4edc-b5f8-c2510d23ee3d
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 24 Dec 2021 18:27:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept
x-download-options: noopen
content-type: text/css
cache-control: public, max-age=31556952, immutable
cf-ray: 6c53bfc90e5b2b22-FRA
content-transfer-encoding: binary

GET
H2 200 discourse-local-dates_8ece7bbcad81adf9a973e63dece091ab17c044d6.css
malware.news/stylesheets/ 7 KB
2 KB 19ms
15ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-local-dates_8ece7bbcad81adf9a973e63dece091ab17c044d6.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

16fb7b18d00aabaecaf43aa630c91856e7b029b5b1b94a1613239c4e781d9c24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies: none
age: 415598
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1KSooMhZeEeh73PMALS%2FFqgax3O4hGPzni0EcfcFr0SfAIjzK1aqyytPtiSTQgkby7bz3GAsg6SPXmAzKcSMgdako4eBhv5LwldOD%2FWyD2U3OJzhrYCF4cc0PcJH4RzQ7MYl6XE0HWrjTQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-discourse-route: stylesheets/show
content-disposition: inline; filename="discourse-local-dates_8ece7bbcad81adf9a973e63dece091ab17c044d6.css"; filename*=UTF-8''discourse-local-dates_8ece7bbcad81adf9a973e63dece091ab17c044d6.css
x-xss-protection: 1; mode=block
x-request-id: b9e881a9-94ee-44d3-9ae2-f6a51d9e6bb8
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 24 Dec 2021 18:27:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept
x-download-options: noopen
content-type: text/css
cache-control: public, max-age=31556952, immutable
cf-ray: 6c53bfc90e5d2b22-FRA
content-transfer-encoding: binary

GET
H2 200 discourse-narrative-bot_8ece7bbcad81adf9a973e63dece091ab17c044d6.css
malware.news/stylesheets/ 153 B
899 B 28ms
23ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-narrative-bot_8ece7bbcad81adf9a973e63dece091ab17c044d6.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be00f0746bbdac7ac238240ba5594d4a2ee4fdc66bbc3513767504e1b9cac6c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies: none
age: 415598
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I8kwkKbvlMjLoDuhIwozBUn8QofZFSqp3dP%2FfPn68c0R%2FzN5zkkBLHKLcsnZFRAU0hHLuvDrfUjFUiCZoht2izPPFlQrsIVhyKLWkde%2BlsSBHmWnS0qFIIqpp9hViqkD%2B1y2GgUYkw0cnw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-discourse-route: stylesheets/show
content-disposition: inline; filename="discourse-narrative-bot_8ece7bbcad81adf9a973e63dece091ab17c044d6.css"; filename*=UTF-8''discourse-narrative-bot_8ece7bbcad81adf9a973e63dece091ab17c044d6.css
x-xss-protection: 1; mode=block
x-request-id: c2d1db41-f78e-437b-95c3-c4e8578ebc29
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 24 Dec 2021 18:27:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept
x-download-options: noopen
content-type: text/css
cache-control: public, max-age=31556952, immutable
cf-ray: 6c53bfc90e602b22-FRA
content-transfer-encoding: binary

GET
H2 200 discourse-presence_8ece7bbcad81adf9a973e63dece091ab17c044d6.css
malware.news/stylesheets/ 1 KB
942 B 25ms
20ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-presence_8ece7bbcad81adf9a973e63dece091ab17c044d6.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eeea9b6ddd2529f655a7fad2d03f26457ac9200375dd0a9bdb57a0356e78b919

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies: none
age: 415598
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1Uv%2FIT2YFtcl2NSmCxsvjbJXljN0H%2BP%2BHN6pA3IrbybyZ9%2F7669Ns4XF6nJdCnllrL8KlFVNBpmRC%2FTZ71I8M7UwLwE7yWC%2BZ4YyarWEBJtFuifMD2AWHi7a1eyv7Wr%2BTOo4Eur2yGlQTw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-discourse-route: stylesheets/show
content-disposition: inline; filename="discourse-presence_8ece7bbcad81adf9a973e63dece091ab17c044d6.css"; filename*=UTF-8''discourse-presence_8ece7bbcad81adf9a973e63dece091ab17c044d6.css
x-xss-protection: 1; mode=block
x-request-id: ae8f609c-2729-4e7d-9f0c-e0516ad522af
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 24 Dec 2021 18:27:49 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept
x-download-options: noopen
content-type: text/css
cache-control: public, max-age=31556952, immutable
cf-ray: 6c53bfc90e622b22-FRA
content-transfer-encoding: binary

GET
H2 200 lazy-yt_8ece7bbcad81adf9a973e63dece091ab17c044d6.css
malware.news/stylesheets/ 2 KB
2 KB 30ms
25ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/lazy-yt_8ece7bbcad81adf9a973e63dece091ab17c044d6.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

70485b720211d2732fba8de2d6e7c1ffb02200a2fd1a470c54bc33ffc986099d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies: none
age: 415598
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=18IOWDUpv%2BTetccnwF58zCB0FnqUqfX9lm7NObroYLpFT%2BWt0mGwjFtWPf1tdzvoL9ZxRxGulKthoLJr9qJCI4ejx%2FGBVqRc96NJ7jrBS3pQHCm9XBLiqaQj%2BqY2JcfTe1DU3QXPYGqKUg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-discourse-route: stylesheets/show
content-disposition: inline; filename="lazy-yt_8ece7bbcad81adf9a973e63dece091ab17c044d6.css"; filename*=UTF-8''lazy-yt_8ece7bbcad81adf9a973e63dece091ab17c044d6.css
x-xss-protection: 1; mode=block
x-request-id: 920b1be3-7099-4882-b10f-71921431de55
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 24 Dec 2021 18:27:49 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept
x-download-options: noopen
content-type: text/css
cache-control: public, max-age=31556952, immutable
cf-ray: 6c53bfc90e642b22-FRA
content-transfer-encoding: binary

GET
H2 200 poll_8ece7bbcad81adf9a973e63dece091ab17c044d6.css
malware.news/stylesheets/ 6 KB
2 KB 22ms
17ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/poll_8ece7bbcad81adf9a973e63dece091ab17c044d6.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5d475ea2236a2932c30b2c351f1367d3a22dfaf78d5461968d71970915ef7d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies: none
age: 415598
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=USxfAiIHj0Cs2Fm3k0dF0p1yMLj6KlKZJJ5Dz7aKz3bRqIP9kGUYlsM1odnYZm4Bkx%2F76gACb07Xud5oETXONMjMNQi0YPdBz1o5p5VXfQ8QQ7V9iUDDsQoQ7GPLRAwxTZ6TOsuFJbeFBA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-discourse-route: stylesheets/show
content-disposition: inline; filename="poll_8ece7bbcad81adf9a973e63dece091ab17c044d6.css"; filename*=UTF-8''poll_8ece7bbcad81adf9a973e63dece091ab17c044d6.css
x-xss-protection: 1; mode=block
x-request-id: ded33df5-5eb5-40d7-81ee-0566aa741ccf
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 24 Dec 2021 18:27:49 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept
x-download-options: noopen
content-type: text/css
cache-control: public, max-age=31556952, immutable
cf-ray: 6c53bfc90e652b22-FRA
content-transfer-encoding: binary

GET
H2 200 poll_desktop_8ece7bbcad81adf9a973e63dece091ab17c044d6.css
malware.news/stylesheets/ 2 KB
1 KB 28ms
24ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/poll_desktop_8ece7bbcad81adf9a973e63dece091ab17c044d6.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9937b70058eb1986713cc5d9f68c8111a28d5aae0eeaab2d3fe76388edbbcb86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies: none
age: 403770
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mmmNAcXOROilqbul0c5EUMotzZ%2BiThuwnL5JXqZ3lb%2F2tblT4LQOUvzoP5jBlhTUv7Hk8VEYSUH%2FF7Uv9VuQGfvS3zvMdb07q6NRvCy7G414oUMnuCGIvB5qoGUcINodWe7YIGv87%2F6ubA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-discourse-route: stylesheets/show
content-disposition: inline; filename="poll_desktop_8ece7bbcad81adf9a973e63dece091ab17c044d6.css"; filename*=UTF-8''poll_desktop_8ece7bbcad81adf9a973e63dece091ab17c044d6.css
x-xss-protection: 1; mode=block
x-request-id: b2f08d62-006d-4945-b9b2-a7dae4917e79
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 24 Dec 2021 18:27:49 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept
x-download-options: noopen
content-type: text/css
cache-control: public, max-age=31556952, immutable
cf-ray: 6c53bfc90e662b22-FRA
content-transfer-encoding: binary

GET
H2 200 desktop_theme_2_ee0e6d574e3047f7bdfb1a40822efc59303d6abc.css
malware.news/stylesheets/ 90 B
626 B 24ms
19ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/desktop_theme_2_ee0e6d574e3047f7bdfb1a40822efc59303d6abc.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

46c573f798a87c0297cf772355e87f5cf5e5c47147e26b959fa6aedf98519aa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies: none
age: 414774
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=znhD6m%2B2kqUzLeXcRszr5VdUUFnXzWewcG2JSjh8JCrpYLRQHVRyLkojFZ4Hf4NJsM0dDJSCdQHP7ngsmL99yEO2wFYdUvMKCglA38zqpRcGdUxsP2hT3kIS%2B74dVbAUUgNDFoBOolx4WA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-discourse-route: stylesheets/show
content-disposition: inline; filename="desktop_theme_2_ee0e6d574e3047f7bdfb1a40822efc59303d6abc.css"; filename*=UTF-8''desktop_theme_2_ee0e6d574e3047f7bdfb1a40822efc59303d6abc.css
x-xss-protection: 1; mode=block
x-request-id: 0f4a8682-41ca-4a12-a5b7-ed53d6bbc701
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 24 Dec 2021 18:27:49 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept
x-download-options: noopen
content-type: text/css
cache-control: public, max-age=31556952, immutable
cf-ray: 6c53bfc90e672b22-FRA
content-transfer-encoding: binary

GET
H2 200 start-discourse-330ecabb99d562b3be656b4bfb638312addb2e0ee5f5780aa47d519efd0b53f4.js Show response
malware.news/assets/ 135 B
495 B 21ms
16ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/start-discourse-330ecabb99d562b3be656b4bfb638312addb2e0ee5f5780aa47d519efd0b53f4.js
Requested by: Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d8ed6633f39595f2c3e353f96ddd5262f4ae11311d80de8bbad7d17eb4dc261

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 12 Dec 2021 01:15:17 GMT
server: cloudflare
age: 1513603
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oTYrm1NcjJiMBDJkXTb7ZfM97fpSKwQkBypmWipGeCgYEJ5eQjXNBOpUSW73T0S3brtq%2Fq5XWBKthVdtZxjO8ZVLMnAE4raMZAAI1vFaVYYl2wrZlmI97jvawP9PSU7ts%2BwRZZR7evj5Xg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6c53bfc91e692b22-FRA
expires: Mon, 12 Dec 2022 01:19:07 GMT

GET
H2 200 browser-update-eec13eb6f8386f18f10b5dd6ebb7a3598d28421bb796e539b91a7e4a4c5d4c08.js Show response
malware.news/assets/ 2 KB
1 KB 27ms
23ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/browser-update-eec13eb6f8386f18f10b5dd6ebb7a3598d28421bb796e539b91a7e4a4c5d4c08.js
Requested by: Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a933fa87d48ac7c2f381036d364fa92767c5dae738491b16aa668671abc23442

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 05 May 2021 19:28:24 GMT
server: cloudflare
age: 5499033
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oTgruZm4dYDK9se0gA31bWiOsciFgr3SU4XeehpVPKNbxuI4wpghm%2BUEIe3RmMjA3g%2F09X645PfGc25cYxYqIs9snncJHC4oyXJv8NWAH2adk6tETou5ObvNWDOkDzV6Jp9wlKDZxrcHTw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6c53bfc91e6a2b22-FRA
expires: Tue, 25 Oct 2022 03:10:14 GMT

GET
H2 200 browser-detect-16ca87077aead9f656700e192992122d3a7eee8c1bb76da992127945464d4777.js Show response
malware.news/assets/ 279 B
539 B 28ms
24ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/browser-detect-16ca87077aead9f656700e192992122d3a7eee8c1bb76da992127945464d4777.js
Requested by: Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 20ec9f960e177cdd0ab1fbb1c3e2721a9ee1f2dccf21b0f242f15e92d3360d08

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Oct 2021 17:28:04 GMT
server: cloudflare
age: 3596127
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1OxNuLbIFP4v0L794p5hxIeJ8jTv4OySKgkp9%2FRtpWTGFX8zgk46FzPBJGZINOBbsdzEZsMXM7EJvK1l8j%2BlkvU%2B%2BYDdKFxviBpHoRhNccOt9CsYrcvJnbRY5TcykoEZtNRkU6%2FNFHu54w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6c53bfc91e6b2b22-FRA
expires: Wed, 09 Nov 2022 11:03:38 GMT

GET
H2 200 en-e4a3f3d1f29498f7c75a258846aba1a24bb1b99a476a4fba16887e21090177c9.js Show response
malware.news/assets/locales/ 271 KB
77 KB 38ms
35ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/locales/en-e4a3f3d1f29498f7c75a258846aba1a24bb1b99a476a4fba16887e21090177c9.js
Requested by: Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 76448e872f2e01432964c5f7223c10376625e8395510e05c872c559a8f1aea79

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 24 Dec 2021 18:27:09 GMT
server: cloudflare
age: 415598
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kXH0CEKKWANxGSTNws9uBJr6oScD%2BYLYwu6mjfVMJ7Z1xAWUNwT8ZYaaU7nP%2BrqcpQ6S7o5Z1%2FyMOSPPn2Y0KcUg3gC638Jq%2FCp7KATbrmxbYgH9ZgBevAUmFpe5PUHDRMRLH%2BfYFSc%2BRg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6c53bfc91e6d2b22-FRA
expires: Sat, 24 Dec 2022 18:29:53 GMT

GET
H2 200 vendor-5ecfe2db96e15c8431ae6b3e8fc90d6e1b3b67936972a19841ce43620f0181f4.js Show response
malware.news/assets/ 952 KB
279 KB 39ms
35ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/vendor-5ecfe2db96e15c8431ae6b3e8fc90d6e1b3b67936972a19841ce43620f0181f4.js
Requested by: Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 188c5cfa7ad7bc7f5d900aa5b4e8768f041c704144fa5980c6c366f3a85c00c5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 24 Dec 2021 18:26:16 GMT
server: cloudflare
age: 415597
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aCaLpm0tbJNO3SJF8h9U1lxHFlqMEq%2BiCjDgwCmSIT5Dg0K5%2BZfh%2BpMzQHk1MxQsOYd3qB8WqI%2FsClxOyceLEvHJeuTRvBuKdyvWMydF9kz%2FO1AcLDunPoTJMr7Z5FgoFu2gKCosWrq9Kw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6c53bfc91e702b22-FRA
expires: Sat, 24 Dec 2022 18:29:53 GMT

GET
H2 200 application-76a969399432fe632ff622fd3bcaf47f7935244cd53a5beae535c55aeb49e373.js Show response
malware.news/assets/ 3 MB
559 KB 44ms
41ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/application-76a969399432fe632ff622fd3bcaf47f7935244cd53a5beae535c55aeb49e373.js
Requested by: Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ffd57d62fb169b58dd1af89ecf8ad062efdd2241d9404df323c506204da8ed65

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 24 Dec 2021 18:27:37 GMT
server: cloudflare
age: 415597
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PCUhcAgs0xXljg8Q1SK9TetCIJtAg6g%2FOYzYe5jNh0PoJNVR1xR3HDM4FovsSppAZvFDrPS1CuU2rlIkGINvGqg27FsLo%2FQN2%2B1VM5IbiiOJgJB4yI529YZFDRfImWXeTbUp0mX2NN2xmw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6c53bfc91e722b22-FRA
expires: Sat, 24 Dec 2022 18:29:53 GMT

GET
H2 200 discourse-details-a5c71c75398c735e851440262e3c9ba43f9d8a2a7d81d8ecec16c8b2dbf452c3.js Show response
malware.news/assets/plugins/ 1 KB
1 KB 26ms
23ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-details-a5c71c75398c735e851440262e3c9ba43f9d8a2a7d81d8ecec16c8b2dbf452c3.js
Requested by: Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d4a605cb261ecd589679cc0cf166f73216953dbae4b98aa285f18c71c9ee639

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Oct 2021 17:29:00 GMT
server: cloudflare
age: 2403334
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VJlkJHeeCIX%2BYMXNb4QO39AO%2BqHeR5JU6MSZe1QUFFtYSXZ%2BNabn6e0DrhZCUNpwfXrn%2FfeoCM39sb2FGg2QqRL6BQTlMtip5kzqR3zDtbkI7RE%2F72RcD19GpI%2BW%2Fx3IITZWHs7BgQ5bSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6c53bfc91e732b22-FRA
expires: Fri, 25 Nov 2022 01:22:18 GMT

GET
H2 200 discourse-local-dates-8f1e7b3adec2176faf7c3013e32e0151d0db362d12f5a9ee2d73771a194379e8.js Show response
malware.news/assets/plugins/ 37 KB
10 KB 38ms
35ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-local-dates-8f1e7b3adec2176faf7c3013e32e0151d0db362d12f5a9ee2d73771a194379e8.js
Requested by: Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: edfdefc73deb22048a66061d7b7e168310bf89c42ab5b180ea56630546339610

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 12 Dec 2021 01:15:31 GMT
server: cloudflare
age: 1513602
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WDoANdgOJOtpokOy3swbBRSl1wVAzQEdToYyrEZkA1RVjc3v2cEaLmr%2FztRNL4bqCGYRBiyfKzvscyqgkygefLc8COXWmxnFSLCmP77MQQGiBhxOG5lhB%2FHeObUyycxgA69R3KmT2i9ADw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6c53bfc91e742b22-FRA
expires: Mon, 12 Dec 2022 01:19:07 GMT

GET
H2 200 discourse-narrative-bot-bc7c0392ef6abf0858f0d6a20600eb7f84d741b114e64c2a736831b45a1339c3.js Show response
malware.news/assets/plugins/ 2 KB
1 KB 23ms
21ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-narrative-bot-bc7c0392ef6abf0858f0d6a20600eb7f84d741b114e64c2a736831b45a1339c3.js
Requested by: Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3abfdd09ca6b2baa336249da3f0d07ad5aa5f30f13ccd9594ba445be12033067

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 24 Dec 2021 18:27:14 GMT
server: cloudflare
age: 415597
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4jID3WPXeOc5SJuWWfklJLt%2FtcoilYh4%2BFEBajSFO9AjmrMd2XAVIMEOEXTNkzjRre5qsmsnlIToqfiBVkdM8O0vD3e5c9dOGXbWsAOyJb6hPHsB25FvFJhUOW%2Bl0sFtrC%2FPP76YNTTSHw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6c53bfc91e762b22-FRA
expires: Sat, 24 Dec 2022 18:29:53 GMT

GET
H2 200 discourse-presence-bc826a395189b32e4676ad0c4414f821f9bab8245747789b6d555fc16581dacd.js Show response
malware.news/assets/plugins/ 13 KB
4 KB 29ms
27ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-presence-bc826a395189b32e4676ad0c4414f821f9bab8245747789b6d555fc16581dacd.js
Requested by: Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c78e68d00e8a4230a4c932745cf90f8ca362ea6358c77e5d3af0d5e85366d87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 12 Dec 2021 01:15:33 GMT
server: cloudflare
age: 1513602
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ipUA5nG8W1ahrgV2wgm%2FbTu93vXmbr7TdMi4XGY%2BSJ%2BitJApmNK5d0Yxr7TEM%2BiLTtHsL7iiaKSEj7bothgXbamEQtIQt1DwC%2BrgKvJynW9193EWVMtcPhL4UgdayltDRBWAQidTGghJJw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6c53bfc91e7a2b22-FRA
expires: Mon, 12 Dec 2022 01:19:08 GMT

GET
H2 200 docker_manager-4ced9f9c7bda9ba563c04006dbb93828d43f2c7d5b533065717c5a63da77d5fc.js Show response
malware.news/assets/plugins/ 2 KB
1 KB 26ms
24ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/docker_manager-4ced9f9c7bda9ba563c04006dbb93828d43f2c7d5b533065717c5a63da77d5fc.js
Requested by: Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 73edfabfded13666c4a05cc461f0fc719721b799584445dc700c7d169504e25e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 26 Oct 2021 17:29:03 GMT
server: cloudflare
age: 738042
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oBlpS%2B0wSvYtxZeeggK%2Ba3cEOg1m66lsPOUNsFSttA2AzFoboqQJLURRIcLu23KCYA7LapN%2B9RZ7DscRg6Za3F08vBwD1UJg%2FsWbCcsS%2F534JnsAYnsZMtAXaidxsFJDtwH32LL8MjMKsA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6c53bfc91e7c2b22-FRA
expires: Sat, 10 Dec 2022 09:25:12 GMT

GET
H2 200 lazy-yt-362fd991a752ebdc53b9b3b70aea43cb46676f634c323d6c79c0bef4c6bebad3.js Show response
malware.news/assets/plugins/ 5 KB
3 KB 27ms
25ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/lazy-yt-362fd991a752ebdc53b9b3b70aea43cb46676f634c323d6c79c0bef4c6bebad3.js
Requested by: Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 085453d90220cde66ef999b84db6272099dc84cde4498793c5f02961da1955b6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 12 Dec 2021 01:15:33 GMT
server: cloudflare
age: 1513601
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WwnkcrIV2l54fGO5sQHZryYCrddgrl%2F6yDqyK7B630AvgvU3gCznsr95ZG0ZR4H6zDC3tTMA47tBXLgHA9lcNGHtH8Z6k8iIVgD3UQdi2FZ2BdH%2F5QWQQxEfUo5Jk7iRpUcWg9UFUE%2Bweg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6c53bfc91e7d2b22-FRA
expires: Mon, 12 Dec 2022 01:19:07 GMT

GET
H2 200 poll-388d992e7cce4bd8f7d5a1f1a0666143cab925ef911a97333edd41b56029a2bd.js Show response
malware.news/assets/plugins/ 60 KB
16 KB 37ms
35ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/poll-388d992e7cce4bd8f7d5a1f1a0666143cab925ef911a97333edd41b56029a2bd.js
Requested by: Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 52e2a460b510c61bcfe4c1d84cea08661a68ce8a65f7cecddb11aa7107e87a9c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 24 Dec 2021 18:27:16 GMT
server: cloudflare
age: 415596
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZVxXHTEJijC5hiVfyNNCsMTRgIm11W5BV42eXc4WqdI590tzCPLjkfB3ucQnVp%2FZOweQYrVxy8NUuIA2p%2F0%2B06UW7jN9UCtZ6nWIgxBQftsmzCRfGbFKXfn83gOC9Dgv8QvgJrZkGbS1rQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6c53bfc91e7f2b22-FRA
expires: Sat, 24 Dec 2022 18:29:53 GMT

GET
H2 200 google-universal-analytics-v3-706f1d28f0a97f67a47515c96189277240ec4940d968955042066d7873fd1fe8.js Show response
malware.news/assets/ 714 B
750 B 23ms
22ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/google-universal-analytics-v3-706f1d28f0a97f67a47515c96189277240ec4940d968955042066d7873fd1fe8.js
Requested by: Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8819a1e1d71488799884b1f3ee3794fefa09bb011f2752d71d4f652eabe49b74

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 29 Nov 2020 17:14:50 GMT
server: cloudflare
age: 21749663
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cKz2RdN3XYHOj%2BYvbUBIu6OEFevlO6SCgb09q6c%2BbwVXltcGE0JnsCX5JMtZ%2F389OGLXv8zwQ3%2BS%2FPCMPWFblrFLXG1Uf7VN%2FNUWPpe2eB%2BXjyfmk5DQ38HLy7VWYWvAAehLweGF2%2FAcGA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6c53bfc91e812b22-FRA
expires: Fri, 15 Apr 2022 13:38:45 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 124ms
39ms Script
text/javascript 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: malware.news
URL: https://malware.news/assets/google-universal-analytics-v3-706f1d28f0a97f67a47515c96189277240ec4940d968955042066d7873fd1fe8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 3572
date: Wed, 29 Dec 2021 13:34:54 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 29 Dec 2021 15:34:54 GMT

GET
H2 200 svg-2-a63c82e1d7ca12b72b28a3395e96e4231ebe0584.js Show response
malware.news/svg-sprite/malware.news/ 114 KB
37 KB 20ms
19ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/svg-sprite/malware.news/svg-2-a63c82e1d7ca12b72b28a3395e96e4231ebe0584.js

Requested by

Host: malware.news
URL: https://malware.news/assets/application-76a969399432fe632ff622fd3bcaf47f7935244cd53a5beae535c55aeb49e373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13cbd5ba2a63471fd2570088d4b3ca5761239b375385a957752dc0f397baa7ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies: none
age: 738039
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vyRdyruB2VQS1b4KuzBGkxfhBTebZHVFVi69VC4uw17nO4C9BZP1ftXGNDBXUooeMCPnpvaM0WuTgOnB3Z8hOIAamiFpHtnZTv4U8QAUWocDhqlk087uxFKMGhLH2YvYvbNPRyQZgKoPwQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-discourse-route: svg_sprite/show
x-xss-protection: 1; mode=block
x-request-id: 0cc3114a-18f4-40a4-ad82-9a7c8095c654
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 26 Oct 2011 17:31:47 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept
x-download-options: noopen
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31556952, immutable
cf-ray: 6c53bfca68c12b22-FRA

GET
H2 200 jquery.magnific-popup.min.js Show response
malware.news/javascripts/magnific-popup/1.1.0/ 20 KB
8 KB 20ms
19ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/javascripts/magnific-popup/1.1.0/jquery.magnific-popup.min.js
Requested by: Host: malware.news
URL: https://malware.news/assets/application-76a969399432fe632ff622fd3bcaf47f7935244cd53a5beae535c55aeb49e373.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 24 Dec 2021 18:22:12 GMT
server: cloudflare
age: 34266
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k%2FJiR9EOAdqZBINsJEqS3Hc6e8cJFiyTOHSMi%2FS9DRFzsMG5BxliSlgkJwga5pioFgH8%2FLyFtpM7vQWqrJX0APUsDF4DTSMHysmPcDD0NizTnEU64KEJlNLPSGqSY3uyHjC3JtRaZKtzlw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6c53bfcb3a232b22-FRA
expires: Wed, 29 Dec 2021 14:53:59 GMT

GET
H2 200 084d101d62e4ceb91462fa1464b341511141973f.js Show response
malware.news/highlight-js/malware.news/ 206 KB
40 KB 18ms
18ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/highlight-js/malware.news/084d101d62e4ceb91462fa1464b341511141973f.js

Requested by

Host: malware.news
URL: https://malware.news/assets/application-76a969399432fe632ff622fd3bcaf47f7935244cd53a5beae535c55aeb49e373.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87f1463e07a2fce1aad95943f7647731f779581d1d0adbcdf9121dfff681bfe1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies: none
age: 1513600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ENMU3DMkhTj5jdH6CiE5yShMecXVunANhHRmzs%2BKa0LP7259ghLE6d%2BitvVw01vZ8g3o077FXwltJXat0oEoyk%2BTw9noxbw74uko5OtmNw0r99xmC9%2BTB2qej5ZQRxhIEHrihju07TMHuQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-discourse-route: highlight_js/show
x-xss-protection: 1; mode=block
x-request-id: 16d6c19f-f9c8-4156-ad54-b84a3a81a42d
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 12 Dec 2011 01:19:09 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept
x-download-options: noopen
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31556952, immutable
cf-ray: 6c53bfcb3a242b22-FRA

GET
H2 200 ba8ee0a927a69022c651441ac23d01bcdbc09785.png
malware.news/uploads/default/original/3X/b/a/ 9 KB
9 KB 19ms
19ms Image
image/png 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://malware.news/uploads/default/original/3X/b/a/ba8ee0a927a69022c651441ac23d01bcdbc09785.png
Requested by: Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 041dc75fa9294876d29e6d78e76c9f7f3202f1763480da93d6ce2414d0a095c3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 9283476
content-length: 8758
last-modified: Sat, 22 Dec 2018 04:38:37 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0pqB0plEYqmhKpfpWv4V1b7o4oBpTa48erXmHGOY22cCjY0ElfnKwMWoKxMPMl7JdGAbQgxFlkKSKfzxFv%2BJCDDYxRbpLsPFzhdjB%2BZzRNDtyiVmXTcVX1bGLqfZAyN3ELyov4wP%2FgGX9w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 6c53bfcb7a8c2b22-FRA
expires: Thu, 08 Sep 2022 21:03:33 GMT

GET
H2 200 24_2.png
malware.news/user_avatar/malware.news/malbot/45/ 4 KB
5 KB 50ms
50ms Image
image/jpeg 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://malware.news/user_avatar/malware.news/malbot/45/24_2.png

Requested by

Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e6dbcb4fa67139ef1bfb019ef153f21b130a1f68f7d5bbe3c15033c14342ff7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies: none
age: 21749661
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rds69GfD%2FwwNRzs%2BTaEews%2FCtjbmGOA4d5BSulSTD7fKaI8uRcdGq6ZbOWWX2X363xnOxda9PyQxDIs0hIUuOHfay1zrUohNCZq2TDUsuklM3mhJP%2Buu4H5E9RdP0gN9cRA90pPPU87UPQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-discourse-route: user_avatars/show
content-length: 4324
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Sun, 29 Nov 2020 17:12:35 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: image/jpeg
cache-control: public, max-age=31556952, immutable
accept-ranges: bytes
cf-ray: 6c53bfcb7a932b22-FRA
content-transfer-encoding: binary
cf-bgj: h2pri

GET
H2 200 tv-radio-broadcast-1024x547.jpg
therecord.media/wp-content/uploads/2021/10/ 84 KB
85 KB 70ms
41ms Image
image/jpeg 2606:4700::6812:621
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://therecord.media/wp-content/uploads/2021/10/tv-radio-broadcast-1024x547.jpg

Requested by

Host: malware.news
URL: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:621 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9994b3d28152f3eb82a411040f0d0e66e6c316e7387eb5dae4f4c35b08944f8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://malware.news/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
via: 1.1 varnish, 1.1 varnish
cf-cache-status: HIT
age: 43298
cf-polished: origSize=86648, status=webp_bigger
x-pantheon-styx-hostname: styx-fe2-b-79754f9dc6-9hr9h
x-cache: MISS, HIT
cf-bgj: imgq:100,h2pri
content-length: 85975
x-served-by: cache-mdw17346-MDW, cache-wdc5563-WDC
last-modified: Mon, 25 Oct 2021 16:50:28 GMT
server: cloudflare
x-timer: S1640745168.218465,VS0,VE1
etag: "6176e054-15278"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/jpeg
x-styx-req-id: d5a1b9ca-5c16-11ec-8fd2-baa71e14cff3
expires: Fri, 30 Dec 2022 14:34:26 GMT
cache-control: public, max-age=31622400
accept-ranges: bytes
cf-ray: 6c53bfcba9cd7037-FRA
x-cache-hits: 0, 1

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
205 B 45ms
43ms XHR
text/plain 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1189016013&t=pageview&_s=1&dl=https%3A%2F%2Fmalware.news%2Ft%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F55892&dp=%2Ft%2Firanian-hackers-behind-cox-media-group-ransomware-attack%2F55892&ul=en-us&de=UTF-8&dt=Iranian%20hackers%20behind%20Cox%20Media%20Group%20ransomware%20attack%20-%20Malware%20News%20-%20Malware%20Analysis%2C%20News%20and%20Indicators&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1056061377&gjid=1658129717&cid=916512983.1640788467&tid=UA-79191654-1&_gid=378873225.1640788467&_r=1&_slc=1&z=1563347293

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://malware.news/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 29 Dec 2021 14:34:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://malware.news
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 poll
malware.news/message-bus/fd88f93b16e843789c9239a437236c16/ 283 B
0 140ms
140ms XHR
text/plain 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/message-bus/fd88f93b16e843789c9239a437236c16/poll

Requested by

Host: malware.news
URL: https://malware.news/assets/vendor-5ecfe2db96e15c8431ae6b3e8fc90d6e1b3b67936972a19841ce43620f0181f4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Discourse-Present: true
X-CSRF-Token: undefined
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-SILENCE-LOGGER: true
Accept: text/plain, */*; q=0.01
Referer: https://malware.news/t/iranian-hackers-behind-cox-media-group-ransomware-attack/55892
X-Requested-With: XMLHttpRequest

Response headers

date: Wed, 29 Dec 2021 14:34:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-methods: GET, POST
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 7200
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZSv03OGjF7P6gYaEGTbvAeBcBD7q8KdDakpHiBySUn2wu0oIzQncqt2NE58cdTg7OcstzNe0PWrMNnuF0EZS%2Fm%2F9airzMPkV36d7tsy0yE9Yj4%2Fsu8LGud%2FoD9Icg%2FmIrQhO5dLxgbaXgg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://malware.news
cache-control: must-revalidate, private, max-age=0
cf-ray: 6c53bfcd9e452b22-FRA
access-control-allow-headers: X-SILENCE-LOGGER, X-Shared-Session-Key, Dont-Chunk, Discourse-Present
expires: 0

Verdicts & Comments Add Verdict or Comment

43 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.malware.news/	1970-01-20 17:17:40	Name: _ga Value: GA1.2.916512983.1640788467
.malware.news/	1970-01-19 23:47:54	Name: _gid Value: GA1.2.378873225.1640788467
.malware.news/	1970-01-19 23:46:28	Name: _gat Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src https://malware.news/logs/ https://malware.news/sidekiq/ https://malware.news/mini-profiler-resources/ https://malware.news/assets/ https://malware.news/brotli_asset/ https://malware.news/extra-locales/ https://malware.news/highlight-js/ https://malware.news/javascripts/ https://malware.news/plugins/ https://malware.news/theme-javascripts/ https://malware.news/svg-sprite/ https://www.google-analytics.com/analytics.js; worker-src 'self' https://malware.news/assets/ https://malware.news/brotli_asset/ https://malware.news/javascripts/ https://malware.news/plugins/; frame-ancestors 'self'; manifest-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

malware.news
therecord.media
www.google-analytics.com
2606:4700:20::ac43:4a41
2606:4700::6812:621
2a00:1450:4001:812::200e
041dc75fa9294876d29e6d78e76c9f7f3202f1763480da93d6ce2414d0a095c3
085453d90220cde66ef999b84db6272099dc84cde4498793c5f02961da1955b6
0c78e68d00e8a4230a4c932745cf90f8ca362ea6358c77e5d3af0d5e85366d87
13cbd5ba2a63471fd2570088d4b3ca5761239b375385a957752dc0f397baa7ba
16fb7b18d00aabaecaf43aa630c91856e7b029b5b1b94a1613239c4e781d9c24
188c5cfa7ad7bc7f5d900aa5b4e8768f041c704144fa5980c6c366f3a85c00c5
1d4a605cb261ecd589679cc0cf166f73216953dbae4b98aa285f18c71c9ee639
20ec9f960e177cdd0ab1fbb1c3e2721a9ee1f2dccf21b0f242f15e92d3360d08
300a1ca6c2afa8f2e2f848147170f01ff50b01f40622a7bce9f83b20a7a1ea26
3abfdd09ca6b2baa336249da3f0d07ad5aa5f30f13ccd9594ba445be12033067
3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4
46c573f798a87c0297cf772355e87f5cf5e5c47147e26b959fa6aedf98519aa3
52e2a460b510c61bcfe4c1d84cea08661a68ce8a65f7cecddb11aa7107e87a9c
5c339152e8df845241ffe11c39dccfd65bc08f18e6e155482e2414129f07b5b1
70485b720211d2732fba8de2d6e7c1ffb02200a2fd1a470c54bc33ffc986099d
73edfabfded13666c4a05cc461f0fc719721b799584445dc700c7d169504e25e
76448e872f2e01432964c5f7223c10376625e8395510e05c872c559a8f1aea79
7e6dbcb4fa67139ef1bfb019ef153f21b130a1f68f7d5bbe3c15033c14342ff7
87f1463e07a2fce1aad95943f7647731f779581d1d0adbcdf9121dfff681bfe1
8819a1e1d71488799884b1f3ee3794fefa09bb011f2752d71d4f652eabe49b74
9937b70058eb1986713cc5d9f68c8111a28d5aae0eeaab2d3fe76388edbbcb86
9994b3d28152f3eb82a411040f0d0e66e6c316e7387eb5dae4f4c35b08944f8f
9d8ed6633f39595f2c3e353f96ddd5262f4ae11311d80de8bbad7d17eb4dc261
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a933fa87d48ac7c2f381036d364fa92767c5dae738491b16aa668671abc23442
be00f0746bbdac7ac238240ba5594d4a2ee4fdc66bbc3513767504e1b9cac6c7
d1460046f707605a81e287d2479f7dc420dbb3ccbd82d33eb5aa2fe06f36e779
d5d475ea2236a2932c30b2c351f1367d3a22dfaf78d5461968d71970915ef7d7
edfdefc73deb22048a66061d7b7e168310bf89c42ab5b180ea56630546339610
eeea9b6ddd2529f655a7fad2d03f26457ac9200375dd0a9bdb57a0356e78b919
f468ed9c322f3ab5069a922ca421c4f637892d870e83767625659ff432628e9b
ffd57d62fb169b58dd1af89ecf8ad062efdd2241d9404df323c506204da8ed65

malware.news Open in urlscan Pro 2606:4700:20::ac43:4a41 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

34 Requests

100 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

1257 kBTransfer

5416 kBSize

3 Cookies

7 Outgoing links

Redirected requests

34 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

malware.news Open in urlscan Pro
2606:4700:20::ac43:4a41 Public Scan

Screenshot
Live screenshot

Full Image

34
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1257 kB
Transfer

5416 kB
Size

3
Cookies

34 HTTP transactions
0 data transactions