![](/screenshots/1d4c5ead-9fee-4043-9111-36d0e6610bc4.png)
www.gdatasoftware.com
Open in
urlscan Pro
212.23.151.164
Public Scan
Submission: On November 05 via manual from CR
Summary
TLS certificate: Issued by Sectigo RSA Organization Validation S... on May 19th 2020. Valid for: 2 years.
This is the only time www.gdatasoftware.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
16 | 212.23.151.164 212.23.151.164 | 12329 (TMR) (TMR) | |
3 | 85.25.214.189 85.25.214.189 | 8972 (GD-EMEA-D...) (GD-EMEA-DC-SXB1) | |
19 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
gdatasoftware.com
www.gdatasoftware.com file.gdatasoftware.com |
2 MB |
19 | 1 |
Domain | Requested by | |
---|---|---|
16 | www.gdatasoftware.com |
www.gdatasoftware.com
|
3 | file.gdatasoftware.com |
www.gdatasoftware.com
|
19 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.gdata.de |
feeds.feedblitz.com |
twitter.com |
github.com |
en.wikipedia.org |
www.bleepingcomputer.com |
www.xing.com |
www.linkedin.com |
www.facebook.com |
reddit.com |
www.youtube.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.gdatasoftware.com Sectigo RSA Organization Validation Secure Server CA |
2020-05-19 - 2022-08-17 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.gdatasoftware.com/blog/2020/11/36459-babax-stealer-rebrands-to-osno-installs-rootkit
Frame ID: 9CC6D3A82B992AE7EFB4DC5FCBDE952D
Requests: 19 HTTP requests in this frame
17 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title: @backsla3h
Search URL Search Domain Scan URL
Title: sold on forums
Search URL Search Domain Scan URL
Title: open source rootkit
Search URL Search Domain Scan URL
Title: SharpExec
Search URL Search Domain Scan URL
Title: XXTEA
Search URL Search Domain Scan URL
Title: An article by Bleepingcomputer
Search URL Search Domain Scan URL
Title: @backsla3h pointed out
Search URL Search Domain Scan URL
Title: tweet
Search URL Search Domain Scan URL
Title: share
Search URL Search Domain Scan URL
Title: share
Search URL Search Domain Scan URL
Title: share
Search URL Search Domain Scan URL
Title: share
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
36459-babax-stealer-rebrands-to-osno-installs-rootkit
www.gdatasoftware.com/blog/2020/11/ |
34 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vhs-assets-5b9de08ed4381d6d419362e5ce725858.css
www.gdatasoftware.com/typo3temp/assets/ |
180 KB 34 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vhs-assets-1b134abf3ac2eb960301b83b9d6c2ff4.js
www.gdatasoftware.com/typo3temp/assets/ |
109 KB 39 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_claim_white.png
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
DE.svg
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Images/Flags/ |
966 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
babax_giveaway_46403035a9.png
www.gdatasoftware.com/fileadmin/_processed_/4/1/ |
249 KB 250 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
babax_advertisment_f13ae7ad45.png
www.gdatasoftware.com/fileadmin/_processed_/8/b/ |
293 KB 293 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
osno_advertisment_cfbcf33537.png
www.gdatasoftware.com/fileadmin/_processed_/d/0/ |
539 KB 540 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
r77_installationcode.png
www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2020/11/ |
43 KB 44 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
r77.gif
www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2020/11/ |
144 KB 145 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
osno_ransom.png
www.gdatasoftware.com/fileadmin/user_upload/Presse/Deutschland/2020/11/ |
25 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hahn_karsten_7c2341c8d2.jpg
www.gdatasoftware.com/fileadmin/_processed_/0/d/ |
4 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_claim_2016_white.png
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Images/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vhs-assets-72fbd3c3fac64cddf69a69a19bc35c07.js
www.gdatasoftware.com/typo3temp/assets/ |
260 KB 80 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
G_DATA_Blog_RebrandBabax_Header.jpg
www.gdatasoftware.com/fileadmin/web/general/images/blog/2020/11_2020/ |
481 KB 482 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
source-sans-pro-v13-latin-ext_latin-regular.woff2
file.gdatasoftware.com/s/font/source-sans-pro/ |
25 KB 25 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gcon1-988.woff2
www.gdatasoftware.com/typo3conf/ext/gd_sites/Resources/Public/Styles/font/ |
48 KB 48 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
source-sans-pro-v13-latin-ext_latin-300.woff2
file.gdatasoftware.com/s/font/source-sans-pro/ |
25 KB 25 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
source-sans-pro-v13-latin-ext_latin-600.woff2
file.gdatasoftware.com/s/font/source-sans-pro/ |
25 KB 25 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
29 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| _typeof object| html5 object| Modernizr function| $ function| jQuery function| _createClass function| _classCallCheck function| decryptCharcode function| decryptString function| linkTo_UnCryptMailto object| GdPlatform undefined| filetypes undefined| baseHref undefined| hrefRedirect undefined| gaHitCallbackHandler object| GdWebsite function| objectFitImages function| GDataMainMenu object| GdScrollIndicator object| Foundation object| jQuery1124018075564443235925 function| Shariff function| GdTrackingModule object| hljs object| GdTracking0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | frame-ancestors 'self' *.gdata.de *.gdata.ch *.gdata.fr *.gdata.at *.gdata.nl *.gdata.it *.gdata.be *.gdata.es *.gdata.pt *.gdatasoftware.co.uk *.gdatasoftware.com *.gdata-software.com *.gdata-advancedanalytics.de *.gdata-advancedanalytics.com *.gdata.co.jp *.gdata-china.com *.gdata-hongkong.com *.inventorofantivirus.com; |
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
file.gdatasoftware.com
www.gdatasoftware.com
212.23.151.164
85.25.214.189
014684be81085820addbcbbee61e251c1bf470e18c566dc43e8e44c2da030997
0c0d12955e7c7be4502937afa995b065989d9ef9e0b3166a59995ea572c4bf93
19d66a51d12c87c2c254f61d3dc66f4765bc852b03138e4b38ed5fbc3dd01d19
211965735fd707f91c38ac8508801e7fd74a7b54662282fdf6b76aedcebeed40
5b7ade4116e14b315421eb6e4eeabbf1a1c7301a575ee1311fb1659eaaecd6f4
6947f324559487c302f64de73640dca76f34ef2210f4069254af756dbc3605a1
6b5dd5b2e4bc34adcd4a2c15384f6d7a1fa7c3bc9c83848e11f63aab8a6775fd
72e086ecb5eed26e489b633ce3a7a85522747d8583852bf8756e290fec0f3d3b
7c657d342491cefb26c956267727635a22e3e85fb12dd8f525e811ec000e658f
9d20a8fc1de189bad815a78bd3a36550412788bc1d8e6f2d7eba6bb18bc901a2
9f2b51127480efe96c95b26ac1666e4c93cfc2e7c15ca42700413f10ad232959
9fa6010d0cbc460c5fe9fb3b99adfde3f1b6b8418474dad9aad6afd0ad1c0085
a7c09e7324dc156cc02b82fc482fc15cb3417c9396a535265789731e455dbb5c
ab12a263ae21799ecbd4a660abbbff3747f762433026fb4997df8bd8cebf941f
ba2e195c3f2698789b4695762e78ec6e6d67b42fb6b1d370aeaaa54d840a808e
c7d95622998bcad0e3e66d1166afac250972de6701f6ef3ce0e538ff3af69c1d
d8943a697b9c2a188d99c20145b16849ec3e2feac56c4771980cc92bcca72d85
ed6adae660bb866303826f11fbd012548ad51f7373d4060ebb3d695b9e5df2db
f0d7235d98912d59a66a0f59f7ecfc05c1df303ab42fa21ba07eb3a5f4af6172