urlscan.io logo urlscan.io
SecurityTrails logo

www.sophos.com Open in urlscan Pro
104.111.233.221  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis.aspx
Effective URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Submission: On September 23 via api from NL — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 21 IPs in 6 countries across 17 domains to perform 60 HTTP transactions. The main IP is 104.111.233.221, located in Frankfurt am Main, Germany and belongs to AKAMAI-AS, US. The main domain is www.sophos.com. The Cisco Umbrella rank of the primary domain is 129053.
TLS certificate: Issued by GlobalSign Extended Validation CA - S... on January 5th 2022. Valid for: a year.
This is the only time www.sophos.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 29 104.111.233.221 16625 (AKAMAI-AS)
6 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 96.16.149.96 16625 (AKAMAI-AS)
2 3 2a00:1450:400... 15169 (GOOGLE)
4 34.96.102.137 15169 (GOOGLE)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 2 192.29.202.14 31898 (ORACLE-BM...)
2 2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1288:80:... 203220 (YAHOO-DEB)
1 2 142.250.186.102 15169 (GOOGLE)
1 13.32.27.124 16509 (AMAZON-02)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 143.204.215.77 16509 (AMAZON-02)
2 2 52.30.152.75 16509 (AMAZON-02)
1 2 143.204.215.100 16509 (AMAZON-02)
1 35.244.174.68 15169 (GOOGLE)
3 212.82.100.181 34010 (YAHOO-IRD)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
60 21
29    104.111.233.221 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-233-221.deploy.static.akamaitechnologies.com
www.sophos.com
6    2606:4700::6810:9540 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.cookielaw.org
1    2a00:1450:4001:812::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2606:4700:4400::6812:2962 (United States)

ASN13335 (CLOUDFLARENET, US)
geolocation.onetrust.com
1    96.16.149.96 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a96-16-149-96.deploy.static.akamaitechnologies.com
img03.en25.com
3    2a00:1450:400c:c08::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
4    34.96.102.137 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 137.102.96.34.bc.googleusercontent.com
dev.visualwebsiteoptimizer.com
1    2a02:26f0:3500:592::11a6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
s.go-mpulse.net
2    192.29.202.14 (Amsterdam, Netherlands)

ASN31898 (ORACLE-BMC-31898, US)
s1777052651.t.eloqua.com
2    2a00:1450:400d:80d::2004 (Ireland)

ASN15169 (GOOGLE, US)
www.google.com
2    2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.nl
3    2a00:1288:80:807::1 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)
s.yimg.com
2    142.250.186.102 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f6.1e100.net
9570324.fls.doubleclick.net
1    13.32.27.124 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-124.fra56.r.cloudfront.net
scripts.demandbase.com
1    2a02:26f0:3500:991::11a6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
c.go-mpulse.net
1    143.204.215.77 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-77.fra53.r.cloudfront.net
api.company-target.com
2    52.30.152.75 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-152-75.eu-west-1.compute.amazonaws.com
match.prod.bidr.io
2    143.204.215.100 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-100.fra53.r.cloudfront.net
segments.company-target.com
1    35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
id.rlcdn.com
3    212.82.100.181 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com
sp.analytics.yahoo.com
1    2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
1    2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.nl
Apex Domain
Subdomains		 Transfer
29 sophos.com
www.sophos.com — Cisco Umbrella Rank: 129053
725 KB
6 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 410
125 KB
5 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 79
9570324.fls.doubleclick.net — Cisco Umbrella Rank: 634145
19 KB
4 visualwebsiteoptimizer.com
dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 5201
75 KB
3 yahoo.com
sp.analytics.yahoo.com — Cisco Umbrella Rank: 1244
958 B
3 company-target.com
api.company-target.com — Cisco Umbrella Rank: 3282
segments.company-target.com — Cisco Umbrella Rank: 1225
2 KB
3 yimg.com
s.yimg.com — Cisco Umbrella Rank: 480
13 KB
3 google.nl
www.google.nl — Cisco Umbrella Rank: 9480
adservice.google.nl — Cisco Umbrella Rank: 14952
1 KB
3 google.com
www.google.com — Cisco Umbrella Rank: 2
adservice.google.com — Cisco Umbrella Rank: 75
2 KB
2 bidr.io
match.prod.bidr.io — Cisco Umbrella Rank: 488
1 KB
2 eloqua.com
s1777052651.t.eloqua.com — Cisco Umbrella Rank: 274113
1 KB
2 go-mpulse.net
s.go-mpulse.net — Cisco Umbrella Rank: 1280
c.go-mpulse.net — Cisco Umbrella Rank: 599
51 KB
1 rlcdn.com
id.rlcdn.com — Cisco Umbrella Rank: 561
98 B
1 demandbase.com
scripts.demandbase.com — Cisco Umbrella Rank: 6283
16 KB
1 en25.com
img03.en25.com — Cisco Umbrella Rank: 15799
3 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 678
385 B
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 62
73 KB
60 17
Domain Requested by
29 www.sophos.com 1 redirects www.sophos.com
6 cdn.cookielaw.org www.sophos.com
cdn.cookielaw.org
4 dev.visualwebsiteoptimizer.com www.sophos.com
dev.visualwebsiteoptimizer.com
3 sp.analytics.yahoo.com www.sophos.com
s.yimg.com
3 s.yimg.com www.sophos.com
s.yimg.com
3 stats.g.doubleclick.net 2 redirects www.sophos.com
2 segments.company-target.com 1 redirects www.sophos.com
2 match.prod.bidr.io 2 redirects
2 9570324.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 www.google.nl www.sophos.com
2 www.google.com 2 redirects
2 s1777052651.t.eloqua.com 1 redirects www.sophos.com
1 adservice.google.nl adservice.google.com
1 adservice.google.com 9570324.fls.doubleclick.net
1 id.rlcdn.com www.sophos.com
1 api.company-target.com scripts.demandbase.com
1 c.go-mpulse.net s.go-mpulse.net
1 scripts.demandbase.com www.sophos.com
1 s.go-mpulse.net www.sophos.com
1 img03.en25.com www.sophos.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 www.googletagmanager.com www.sophos.com
60 22
Subject Issuer Validity Valid
www.sophos.com
GlobalSign Extended Validation CA - SHA256 - G3		 2022-01-05 -
2023-02-06		 a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3		 2022-05-01 -
2023-05-01		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-08-29 -
2022-11-21		 3 months crt.sh
onetrust.com
Cloudflare Inc ECC CA-3		 2022-01-12 -
2023-01-12		 a year crt.sh
*.en25.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-07-17 -
2023-07-18		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-09-05 -
2022-11-28		 3 months crt.sh
*.visualwebsiteoptimizer.com
Starfield Secure Certificate Authority - G2		 2022-07-04 -
2023-08-05		 a year crt.sh
akstat.io
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-04-15 -
2023-04-19		 a year crt.sh
*.api.fantasysports.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2022-09-05 -
2022-10-26		 2 months crt.sh
*.doubleclick.net
GTS CA 1C3		 2022-09-05 -
2022-11-28		 3 months crt.sh
tag.demandbase.com
Go Daddy Secure Certificate Authority - G2		 2022-08-17 -
2023-09-18		 a year crt.sh
api.demandbase.com
Go Daddy Secure Certificate Authority - G2		 2022-09-16 -
2023-10-18		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2022-02-03 -
2023-02-25		 a year crt.sh
real.sp.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2022-08-09 -
2023-02-01		 6 months crt.sh
*.google.com
GTS CA 1C3		 2022-09-05 -
2022-11-28		 3 months crt.sh
*.google.nl
GTS CA 1C3		 2022-08-29 -
2022-11-21		 3 months crt.sh

This page contains 5 frames:

Primary Page: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Frame ID: 5F2B6A5A38C8F80B955192C6FC69C93B
Requests: 57 HTTP requests in this frame

Frame: https://s.go-mpulse.net/boomerang/98YDQ-4R7DD-Y3XRM-CVBHP-WX4A4
Frame ID: 7CB42B203A4A5263AEC397AA77603D95
Requests: 2 HTTP requests in this frame

Frame: https://9570324.fls.doubleclick.net/activityi;dc_pre=CLfyhcu0qvoCFRTaGwod75QBcQ;src=9570324;type=sopapj;cat=sopho00;ord=5300808499916;gtm=2wg9l0;auiddc=2002450161.1663918806;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis;~oref=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis
Frame ID: 776895576622ED8528B4AD70C43AA198
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CLfyhcu0qvoCFRTaGwod75QBcQ;src=9570324;type=sopapj;cat=sopho00;ord=5300808499916;gtm=2wg9l0;auiddc=2002450161.1663918806;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis;~oref=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis
Frame ID: 2405285339C82065BDEC495594F2CF44
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.nl/ddm/fls/i/dc_pre=CLfyhcu0qvoCFRTaGwod75QBcQ;src=9570324;type=sopapj;cat=sopho00;ord=5300808499916;gtm=2wg9l0;auiddc=2002450161.1663918806;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis;~oref=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis
Frame ID: 4E005C8F5BEA96D49AF4EFC120D7BC1F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Detailed Analysis - Troj/Sage-G - Viruses and Spyware - Advanced Network Threat Protection | ATP from Targeted Malware Attacks and Persistent Threats | sophos.com - Threat Center Back ButtonFilter Button

Page URL History Show full URLs

  1. https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed... HTTP 301
    https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • backbone.*\.js
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js
Overall confidence: 100%
Detected patterns
  • dev\.visualwebsiteoptimizer\.com/?([\d.]+)

Page Statistics

60
Requests

93 %
HTTPS

50 %
IPv6

17
Domains

22
Subdomains

21
IPs

6
Countries

1102 kB
Transfer

4557 kB
Size

35
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis.aspx HTTP 301
    https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 35
  • https://s1777052651.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=1777052651&ref2=elqNone&tzo=0&ms=705&optin=disabled HTTP 302
  • https://s1777052651.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1777052651&ref2=elqNone&tzo=0&ms=705&optin=disabled&elqCookie=1
Request Chain 36
  • https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=850287863&utmhn=www.sophos.com&utme=8(4!CampaignID)9(4!0)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Detailed%20Analysis%20-%20Troj%2FSage-G%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&utmhid=406990331&utmr=-&utmp=%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis&utmht=1663918805718&utmac=UA-737537-1&utmcc=__utma%3D1.75279720.1663918806.1663918806.1663918806.1%3B%2B__utmz%3D1.1663918806.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1364898699&utmredir=3&utmu=q1AAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=75279720.1663918806&jid=1364898699&_v=5.7.2dc&z=850287863 HTTP 302
  • https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=75279720.1663918806&jid=1364898699&_v=5.7.2dc&z=850287863&slf_rd=1&random=1358904062
Request Chain 37
  • https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=2&utmn=217141345&utmhn=www.sophos.com&utme=8(4!CampaignID)9(4!0)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Detailed%20Analysis%20-%20Troj%2FSage-G%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&utmhid=406990331&utmr=-&utmp=%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis&utmht=1663918805724&utmac=UA-737537-18&utmcc=__utma%3D1.75279720.1663918806.1663918806.1663918806.1%3B%2B__utmz%3D1.1663918806.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=250827226&utmredir=3&utmmt=1&utmu=q1AgAAAAAAAAAAAAAAAAAAAE~ HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-18&cid=75279720.1663918806&jid=250827226&_v=5.7.2dc&z=217141345 HTTP 302
  • https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-18&cid=75279720.1663918806&jid=250827226&_v=5.7.2dc&z=217141345&slf_rd=1&random=2366833531
Request Chain 44
  • https://9570324.fls.doubleclick.net/activityi;src=9570324;type=sopapj;cat=sopho00;ord=5300808499916;gtm=2wg9l0;auiddc=2002450161.1663918806;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis;~oref=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis HTTP 302
  • https://9570324.fls.doubleclick.net/activityi;dc_pre=CLfyhcu0qvoCFRTaGwod75QBcQ;src=9570324;type=sopapj;cat=sopho00;ord=5300808499916;gtm=2wg9l0;auiddc=2002450161.1663918806;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis;~oref=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis
Request Chain 52
  • https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
  • https://segments.company-target.com/log?vendor=choca&user_id=AAEZ0E7GWsYAAB6OE3We4w HTTP 303
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAEZ0E7GWsYAAB6OE3We4w&verifyHash=801daa5507d0ab6914f5ea86bf24da56f2f98717

60 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request detailed-analysis
www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/
Redirect Chain
  • https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis.aspx
  • https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
129 KB
29 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
68ff399833b0eff8b79aa63ee942f9fc324148047e7bb0db23c2880a8e4004a0
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

cache-control
max-age=0, no-cache, no-store
content-encoding
gzip
content-length
28407
content-type
text/html; charset=utf-8
date
Fri, 23 Sep 2022 07:40:05 GMT
expires
Fri, 23 Sep 2022 07:40:05 GMT
last-modified
Fri, 18 May 2018 19:04:42 GMT
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server-timing
cdn-cache; desc=MISS edge; dur=72 origin; dur=1178
strict-transport-security
max-age=10886400
vary
Accept-Encoding
x-akamai-transformed
9 26384 0 pmb=mTOE,2mRUM,2
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-ua-compatible
IE=edge
x-xss-protection
1; mode=block

Redirect headers

cache-control
max-age=0, no-cache, no-store
content-length
231
content-type
text/html; charset=UTF-8
date
Fri, 23 Sep 2022 07:40:03 GMT
edge-sophos-cookie-lang
en-us
expires
Fri, 23 Sep 2022 07:40:03 GMT
location
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server-timing
cdn-cache; desc=MISS edge; dur=18 origin; dur=16
strict-transport-security
max-age=10886400
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-ua-compatible
IE=edge
x-xss-protection
1; mode=block
Legacy.css
www.sophos.com/Styles/Bundles/ 		73 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.sophos.com/Styles/Bundles/Legacy.css?v=1
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
70b2c85c2a1e64a8bf5a7080944b925350eac2df76e3115bca01ff0d7e903db4
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
content-encoding
gzip
x-content-type-options
nosniff
sophos-redirection
509
server-timing
cdn-cache; desc=HIT, edge; dur=73
vary
Accept-Encoding
content-length
14857
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 25 Sep 2017 18:54:47 GMT
etag
74860e4a0a98c4d21b579a9a0e04aa37
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
public, max-age=900
date
Fri, 23 Sep 2022 07:40:05 GMT
expires
Fri, 23 Sep 2022 07:55:05 GMT
otSDKStub.js
cdn.cookielaw.org/scripttemplates/ 		21 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Sep 2022 07:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
7BKk7WQU1Z9EDMZmf1T6Vg==
age
1442
vary
Accept-Encoding
content-length
7151
x-ms-lease-status
unlocked
last-modified
Fri, 23 Sep 2022 06:42:23 GMT
server
cloudflare
etag
0x8DA9D2EC58B2EA3
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
8747b20a-301e-00bb-1e1b-cf3912000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
74f1a153fae5b760-AMS
global.js
www.sophos.com/scripts/bundles/ 		1 MB
282 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.sophos.com/scripts/bundles/global.js?v=8
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c6e79c02c276ce7b505c898813dcc571d7ed91db3ccc1a8d4b4bae0b926ae523
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency
165, 165
strict-transport-security
max-age=10886400
content-encoding
br
x-content-type-options
nosniff
x-edgeconnect-midmile-rtt
118, 119
sophos-redirection
508
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
287882
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 19 Sep 2022 07:53:08 GMT
etag
e265952c0c58ea499f61bbcb7c67a265
x-frame-options
SAMEORIGIN
content-type
text/javascript
cache-control
public, max-age=259940
date
Fri, 23 Sep 2022 07:40:05 GMT
expires
Mon, 26 Sep 2022 07:52:25 GMT
Global.css
www.sophos.com/Styles/Bundles/ 		500 KB
80 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.sophos.com/Styles/Bundles/Global.css?v=11
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
095cef01d97174531cc4396240f52e552aac3aaaf9c7e80aafa955c132e10037
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
content-encoding
gzip
x-content-type-options
nosniff
sophos-redirection
509
server-timing
cdn-cache; desc=HIT, edge; dur=1
vary
Accept-Encoding
content-length
81169
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 08 Oct 2021 10:21:06 GMT
etag
7f7774180519ecacdc0e527af4c4044b
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
public, max-age=129
date
Fri, 23 Sep 2022 07:40:05 GMT
expires
Fri, 23 Sep 2022 07:42:14 GMT
nonhtmltracking.js
www.sophos.com/en-us/medialibrary/scripts/tracking/ 		2 KB
977 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.sophos.com/en-us/medialibrary/scripts/tracking/nonhtmltracking.js
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
9f3c45aae8d14cee7c2fa3bcd7604c6936a4886ff864fb743e11dc61705cd516
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
content-encoding
gzip
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 10 Jun 2016 10:57:40 GMT
date
Fri, 23 Sep 2022 07:40:05 GMT
x-frame-options
SAMEORIGIN
content-type
application/x-javascript
x-ua-compatible
IE=edge
cache-control
private, max-age=129
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=1
vary
Accept-Encoding
content-length
615
x-xss-protection
1; mode=block
expires
Fri, 23 Sep 2022 07:42:14 GMT
3a62e8a0
www.sophos.com/akam/13/ 		26 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.sophos.com/akam/13/3a62e8a0
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
eea1b7873151984ab07645f9dfa06237e3080de0726a4319dd628ba370eb9afa

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Sep 2022 07:40:05 GMT
content-encoding
gzip
last-modified
Wed, 09 Feb 2022 15:09:30 GMT
etag
"0dfe948402332b53dc4693b3741ce0095d5cd166d97d9d324cef240b3082cf6b"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=0, no-cache, no-store
server-timing
cdn-cache; desc=HIT, edge; dur=190
content-length
8788
expires
Fri, 23 Sep 2022 07:40:05 GMT
WebResource.axd
www.sophos.com/ 		23 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.sophos.com/WebResource.axd?d=pynGkmcFUV13He1Qd6_TZJOSk0UCLAIsVcp1lGhjDOtuIgnMJ-Grvo38PGQgf8V85Jrv0w2&t=637814653746327080
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
content-encoding
gzip
referrer-policy
strict-origin-when-cross-origin
last-modified
Sat, 26 Feb 2022 09:42:54 GMT
date
Fri, 23 Sep 2022 07:40:05 GMT
x-frame-options
SAMEORIGIN
content-type
application/x-javascript
x-ua-compatible
IE=edge
cache-control
public, max-age=30806522
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=27
vary
Accept-Encoding
content-length
4627
x-xss-protection
1; mode=block
expires
Thu, 14 Sep 2023 21:02:07 GMT
WebResource.axd
www.sophos.com/ 		350 B
695 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.sophos.com/WebResource.axd?d=3WTd45ClInYAUa1dBtg1Dx3scYg9bCub9YQFIdxPHkSTB8jCCAZuRBuMGXYyiUTcH0_h7qtwgZh_UAS8UQ22cCAx3Q3OFyzyESB-cDl3avMWoV6j73u70f0iz2KiFVj0m3Ddo5IgxrGe8w9egmF4tzC1T4nGrqyOvfP2Qft-th9rBC06C1XuFLlbq1xBaG0D20oqDw2&t=637939211220000000
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
189a7158414e4fab1d24249e6eef0b73fcf61dc28c070fb90da996ca9936f111
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 20 Jul 2022 12:38:42 GMT
date
Fri, 23 Sep 2022 07:40:05 GMT
x-frame-options
SAMEORIGIN
content-type
application/x-javascript
cache-control
public, max-age=30806522
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=22
x-ua-compatible
IE=edge
content-length
350
x-xss-protection
1; mode=block
expires
Thu, 14 Sep 2023 21:02:07 GMT
ScriptResource.axd
www.sophos.com/ 		100 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.sophos.com/ScriptResource.axd?d=uHIkleVeDJf4xS50Krz-yN1ZvwfhxvHncooXRVKlBTvhmoCy5bupVsuGQkkLDTjm_jeXn8iO6HKP26I7IDatS8OjrL3TZARrPj65IRkIyM0vqtH5ucJW9TRfUMNR2gGqjWeoyvt0XQhPDZePYL5A24lVIUM1&t=49337fe8
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
66b804e7a96a87c11e1dd74ea04ac2285df5ad9043f48046c3e5000114d39b1c
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
content-encoding
gzip
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 14 Sep 2022 23:18:56 GMT
date
Fri, 23 Sep 2022 07:40:05 GMT
x-frame-options
SAMEORIGIN
content-type
application/x-javascript; charset=utf-8
x-ua-compatible
IE=edge
cache-control
public, max-age=30814731
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=20
vary
Accept-Encoding
content-length
25597
x-xss-protection
1; mode=block
expires
Thu, 14 Sep 2023 23:18:56 GMT
ScriptResource.axd
www.sophos.com/ 		39 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.sophos.com/ScriptResource.axd?d=Jw6tUGWnA15YEa3ai3FadNldxw-oCDto7EOAGJmZziNa8LT7qiasmCz0ObdMfKLRM0A-Bp6BZcpUP_cUC_iK-o_OwnHmAvTfphOefNoD-JNhN4rMOvpecOoqdhPDdFOnQg07auL3O_3RWt5JqB-KKiM6gEM1&t=49337fe8
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
398cdf1b27ef247e5bc77805f266bb441e60355463fc3d1776f41aae58b08cf1
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
content-encoding
gzip
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 14 Sep 2022 23:18:56 GMT
date
Fri, 23 Sep 2022 07:40:05 GMT
x-frame-options
SAMEORIGIN
content-type
application/x-javascript; charset=utf-8
x-ua-compatible
IE=edge
cache-control
public, max-age=30814731
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=28
vary
Accept-Encoding
content-length
9972
x-xss-protection
1; mode=block
expires
Thu, 14 Sep 2023 23:18:56 GMT
CoveoJsSearchLazymin.js
www.sophos.com/medialibrary/Scripts/ 		704 KB
186 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.sophos.com/medialibrary/Scripts/CoveoJsSearchLazymin.js
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a325d69859df35ccdd1cd6a5b071bb9ef737b2775552c6c319f372a51f6fadd9
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
content-encoding
gzip
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 25 Jan 2021 13:32:03 GMT
date
Fri, 23 Sep 2022 07:40:05 GMT
x-frame-options
SAMEORIGIN
content-type
application/x-javascript
x-ua-compatible
IE=edge
cache-control
private, max-age=129
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=2
vary
Accept-Encoding
content-length
189176
x-xss-protection
1; mode=block
expires
Fri, 23 Sep 2022 07:42:14 GMT
sophos-logo.svg
www.sophos.com/en-us/medialibrary/SophosNext/Images/Header-Navigation/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Header-Navigation/sophos-logo.svg?la=en
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a55150a4cc33c9d0e381368e1b4d6170a7fde72ecba6de0ab043b3dc43dfad73
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency
133
strict-transport-security
max-age=10886400
content-encoding
gzip
x-content-type-options
nosniff
x-edgeconnect-midmile-rtt
0
server-timing
cdn-cache; desc=HIT, edge; dur=83
content-length
1084
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 07 Feb 2019 19:59:02 GMT
x-frame-options
SAMEORIGIN
date
Fri, 23 Sep 2022 07:40:05 GMT
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
private, max-age=689
expires
Fri, 23 Sep 2022 07:51:34 GMT
navigation-accordian-img2.svg
www.sophos.com/en-us/medialibrary/SophosNext/Images/SophosHomePage/ 		733 B
772 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sophos.com/en-us/medialibrary/SophosNext/Images/SophosHomePage/navigation-accordian-img2.svg?h=34&&w=34&la=en&hash=FCE1C766C4188FD9B0E9173F3C1F0E7241DCCA05
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
517a16fedc3c2f5ba86a4c4c9567552088e1572016fc835ba0bd79e83bdd1c6e
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency
134
strict-transport-security
max-age=10886400
content-encoding
gzip
x-content-type-options
nosniff
x-edgeconnect-midmile-rtt
29
server-timing
cdn-cache; desc=HIT, edge; dur=70
content-length
364
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 20 Aug 2018 15:48:35 GMT
x-frame-options
SAMEORIGIN
date
Fri, 23 Sep 2022 07:40:05 GMT
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
private, max-age=717
expires
Fri, 23 Sep 2022 07:52:02 GMT
nav-close-icon.png
www.sophos.com/en-us/medialibrary/SophosNext/Images/SophosHomePage/ 		237 B
570 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sophos.com/en-us/medialibrary/SophosNext/Images/SophosHomePage/nav-close-icon.png?h=24&&w=24&la=en&hash=60BCD18464B4DB8D822AA78F2AA7412BD7EF60F4
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
8ca76658afe65a55a56d4b0819cd3749888d68b7e8a8994f2a32f8d80166e37c
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 12 Nov 2020 05:34:56 GMT
date
Fri, 23 Sep 2022 07:40:05 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
private, max-age=6026
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=63
x-ua-compatible
IE=edge
content-length
237
x-xss-protection
1; mode=block
expires
Fri, 23 Sep 2022 09:20:31 GMT
ithreat1.gif
www.sophos.com/en-us/medialibrary/Images/Content/Threat-Center/Threat-Levels/ 		388 B
829 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sophos.com/en-us/medialibrary/Images/Content/Threat-Center/Threat-Levels/ithreat1.gif?h=14&&w=175&la=en&hash=102ED5BEB7F28D7E5D5F241E3365A79E9E90C7E8
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f4d2ded74dc0c44de5d0f39f567cd0576d011f9924150530b4cb8c459c3c9f55
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 05 Apr 2011 15:39:54 GMT
date
Fri, 23 Sep 2022 07:40:05 GMT
x-frame-options
SAMEORIGIN
content-type
image/gif
cache-control
private, max-age=14400
x-content-type-options
nosniff
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=106, origin; dur=51
x-ua-compatible
IE=edge
content-length
388
x-xss-protection
1; mode=block
expires
Fri, 23 Sep 2022 11:40:05 GMT
promoicondl_small.gif
www.sophos.com/en-us/medialibrary/Images/Common/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sophos.com/en-us/medialibrary/Images/Common/promoicondl_small.gif?w=17&h=16&as=1&hash=958821FEAC81A4EE3A67A347E9A97BC5C73E6116
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
632c55966e23462867a7804060857901969e5613adfde633e91e5557d4539956
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 31 Aug 2012 18:44:38 GMT
date
Fri, 23 Sep 2022 07:40:05 GMT
x-frame-options
SAMEORIGIN
content-type
image/gif
cache-control
private, max-age=14390
x-content-type-options
nosniff
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=58, origin; dur=40
x-ua-compatible
IE=edge
content-length
1049
x-xss-protection
1; mode=block
expires
Fri, 23 Sep 2022 11:39:55 GMT
download25x25.gif
www.sophos.com/en-us/medialibrary/Images/Common/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sophos.com/en-us/medialibrary/Images/Common/download25x25.gif?w=25&h=25&as=1&hash=783867BAA9398AC9B1900EBCDD6DA463D2BE7D06
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1fd7dd180ba5bff6e2fc533346f450838c1f05aea5bc95b009f73d2b10ad989e
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 08 Jul 2013 14:21:11 GMT
date
Fri, 23 Sep 2022 07:40:05 GMT
x-frame-options
SAMEORIGIN
content-type
image/gif
cache-control
private, max-age=14362
x-content-type-options
nosniff
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=59, origin; dur=41
x-ua-compatible
IE=edge
content-length
1357
x-xss-protection
1; mode=block
expires
Fri, 23 Sep 2022 11:39:27 GMT
2e456f46-6b86-42c8-be0a-01efd4471533.json
cdn.cookielaw.org/consent/2e456f46-6b86-42c8-be0a-01efd4471533/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/2e456f46-6b86-42c8-be0a-01efd4471533/2e456f46-6b86-42c8-be0a-01efd4471533.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9bebf16bfa9710edb204ea20eabab3b3f736f357d23107a4270c3389e91f58ea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Sep 2022 07:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
rNeSq2ZpHvvfHoUuomYVLg==
age
4147
vary
Accept-Encoding
content-length
1338
x-ms-lease-status
unlocked
last-modified
Mon, 03 May 2021 14:33:58 GMT
server
cloudflare
etag
0x8D90E407D15CA2F
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
aef48da6-901e-00f9-20bf-4f1206000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
74f1a1554bc2b972-AMS
expires
Fri, 23 Sep 2022 11:40:05 GMT
gtm.js
www.googletagmanager.com/ 		234 KB
73 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-556N8KS
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d3b52faf5be7daa1313c027b7ec9fbc17c723afd68206ce75769ad86d12ab31a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Fri, 23 Sep 2022 07:40:05 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
74192
x-xss-protection
0
last-modified
Fri, 23 Sep 2022 06:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 23 Sep 2022 07:40:05 GMT
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 		184 B
385 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2962 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0ffe46125c2a270822a1c04a7f3d80cfff046267e4a42ed1f4cd25383429d483
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://www.sophos.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Fri, 23 Sep 2022 07:40:05 GMT
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
74f1a156f896b88b-AMS
access-control-allow-headers
Content-Type
elqCfg.min.js
img03.en25.com/i/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://img03.en25.com/i/elqCfg.min.js
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
96.16.149.96 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-149-96.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Connection
keep-alive
Content-Length
2183
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 12 Jul 2022 22:09:35 GMT
Date
Fri, 23 Sep 2022 07:40:05 GMT
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
no-store
ETag
"a2d639123c96d81:0"
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Expires
Fri, 23 Sep 2022 07:40:05 GMT
dc.js
stats.g.doubleclick.net/ 		45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/dc.js
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c08::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 11 Sep 2022 13:50:09 GMT
server
Golfe2
age
3889
date
Fri, 23 Sep 2022 06:35:16 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17093
expires
Fri, 23 Sep 2022 08:35:16 GMT
j.php
dev.visualwebsiteoptimizer.com/ 		7 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/j.php?a=25349&u=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis&f=1&r=0.37956266567719865
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gams1 /
Resource Hash
8b58995549c9e4b5feeb7851b9901647b98be600971ecf743c931a61385cb9b4

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Fri, 23 Sep 2022 07:40:04 GMT
via
1.1 google
server
gams1
etag
W/"1663853629"
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
no-cache,max-age=0
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
98YDQ-4R7DD-Y3XRM-CVBHP-WX4A4
s.go-mpulse.net/boomerang/ Frame 7CB4 		202 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.go-mpulse.net/boomerang/98YDQ-4R7DD-Y3XRM-CVBHP-WX4A4
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:3500:592::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Fri, 23 Sep 2022 07:40:05 GMT
content-encoding
br
last-modified
Tue, 16 Aug 2022 18:24:07 GMT
x-n
S
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=604800
timing-allow-origin
*
content-length
51580
header-arrow-white.svg
www.sophos.com/medialibrary/SophosNext/Images/EvolvedNavigation/ 		343 B
656 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sophos.com/medialibrary/SophosNext/Images/EvolvedNavigation/header-arrow-white.svg
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/Styles/Bundles/Global.css?v=11
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2a42c163168d9461b0bc20b3e9a1a10181ecb9f7c3d1b738903a7ee03ec36aa0
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/Styles/Bundles/Global.css?v=11
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency
12
strict-transport-security
max-age=10886400
content-encoding
gzip
x-content-type-options
nosniff
x-edgeconnect-midmile-rtt
119
server-timing
cdn-cache; desc=HIT, edge; dur=47
content-length
250
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 15 Apr 2019 10:19:19 GMT
x-frame-options
SAMEORIGIN
date
Fri, 23 Sep 2022 07:40:05 GMT
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
private, max-age=196
expires
Fri, 23 Sep 2022 07:43:21 GMT
735D3D2CB1D74CA185D9438103FF763D.ashx
www.sophos.com/medialibrary/ 		26 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.sophos.com/medialibrary/735D3D2CB1D74CA185D9438103FF763D.ashx
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/Styles/Bundles/Legacy.css?v=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d1fabd20a67738775bb84fda3b230d2f007a2c3a6629d327bc8ab4312cb5c0fe
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.sophos.com/Styles/Bundles/Legacy.css?v=1
Origin
https://www.sophos.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=37
content-length
26532
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 22 Oct 2019 13:33:58 GMT
date
Fri, 23 Sep 2022 07:40:05 GMT
x-frame-options
SAMEORIGIN
access-control-allow-methods
GET
content-type
application/font-woff2
access-control-allow-origin
https://www.sophos.com
cache-control
private, max-age=6177
access-control-allow-headers
*
expires
Fri, 23 Sep 2022 09:23:02 GMT
SophosSans-Light-woff2.woff2
www.sophos.com/medialibrary/Files/Fonts/ 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.sophos.com/medialibrary/Files/Fonts/SophosSans-Light-woff2.woff2
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/Styles/Bundles/Global.css?v=11
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f4a2fb1bd486b246823cfb9750f25a4323a8f74c23968d4a6fcdd96a65511631
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.sophos.com/Styles/Bundles/Global.css?v=11
Origin
https://www.sophos.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
x-content-type-options
nosniff
server-timing
cdn-cache; desc=MISS, edge; dur=1, origin; dur=60
content-length
25316
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 22 Oct 2019 13:28:18 GMT
date
Fri, 23 Sep 2022 07:40:05 GMT
x-frame-options
SAMEORIGIN
access-control-allow-methods
GET
content-type
application/font-woff2
access-control-allow-origin
https://www.sophos.com
cache-control
private, max-age=6035
access-control-allow-headers
*
expires
Fri, 23 Sep 2022 09:20:40 GMT
Hamburger.svg
www.sophos.com/medialibrary/SophosNext/Images/Navigation/2021/ 		512 B
662 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sophos.com/medialibrary/SophosNext/Images/Navigation/2021/Hamburger.svg
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/Styles/Bundles/Global.css?v=11
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
eb75190c0b45dd7c1bfbf62ac7b6c1912ef72a53e104ca22130c06f4d6312ae4
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/Styles/Bundles/Global.css?v=11
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency
375
strict-transport-security
max-age=10886400
content-encoding
gzip
x-content-type-options
nosniff
x-edgeconnect-midmile-rtt
130
server-timing
cdn-cache; desc=HIT, edge; dur=34
content-length
254
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 27 Jan 2021 07:09:49 GMT
x-frame-options
SAMEORIGIN
date
Fri, 23 Sep 2022 07:40:05 GMT
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
private, max-age=262
expires
Fri, 23 Sep 2022 07:44:27 GMT
line-marquee-full3.png
www.sophos.com/fairfax/media/images/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sophos.com/fairfax/media/images/line-marquee-full3.png
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/Styles/Bundles/Legacy.css?v=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
0c4272265b7ddaa6577a2287ce5c13be78cf6d89928dda95284527224a387b0c
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/Styles/Bundles/Legacy.css?v=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 20 Jul 2022 12:38:46 GMT
etag
"08f36a7359cd81:0"
x-frame-options
SAMEORIGIN
content-type
image/png
x-xss-protection
1; mode=block
cache-control
max-age=7200
date
Fri, 23 Sep 2022 07:40:05 GMT
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=30, origin; dur=20
accept-ranges
bytes
content-length
1054
x-content-type-options
nosniff
x-ua-compatible
IE=edge
93AE761DD5F444A2AE439BE56F0F7EB4.ashx
www.sophos.com/medialibrary/ 		99 B
461 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sophos.com/medialibrary/93AE761DD5F444A2AE439BE56F0F7EB4.ashx
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/Styles/Bundles/Legacy.css?v=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
42fe42ff953beca97d239dd6fb4549d2e2e179cbde0f8341e2aa1137a191208b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/Styles/Bundles/Legacy.css?v=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 11 Nov 2011 20:23:28 GMT
date
Fri, 23 Sep 2022 07:40:05 GMT
x-frame-options
SAMEORIGIN
content-type
image/gif
cache-control
private, max-age=14343
x-content-type-options
nosniff
server-timing
cdn-cache; desc=REVALIDATE, edge; dur=23, origin; dur=36
x-ua-compatible
IE=edge
content-length
99
x-xss-protection
1; mode=block
expires
Fri, 23 Sep 2022 11:39:08 GMT
sophos-shield-footer.svg
www.sophos.com/medialibrary/SophosNext/Images/Products/Icons/ 		780 B
832 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sophos.com/medialibrary/SophosNext/Images/Products/Icons/sophos-shield-footer.svg
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/Styles/Bundles/Global.css?v=11
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c348ab6de15c26b0acbf73117cc957127b32b670ea39528c659c137c35ca9b99
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/Styles/Bundles/Global.css?v=11
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency
87
strict-transport-security
max-age=10886400
content-encoding
gzip
x-content-type-options
nosniff
x-edgeconnect-midmile-rtt
120
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
426
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 17 May 2021 11:31:52 GMT
x-frame-options
SAMEORIGIN
date
Fri, 23 Sep 2022 07:40:05 GMT
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
private, max-age=42
expires
Fri, 23 Sep 2022 07:40:47 GMT
footer-down-arrow-grey.svg
www.sophos.com/medialibrary/SophosNext/Images/Navigation/Footer/ 		302 B
637 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.sophos.com/medialibrary/SophosNext/Images/Navigation/Footer/footer-down-arrow-grey.svg
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/Styles/Bundles/Global.css?v=11
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
31037d926621b0758c70fb400f05cd1bf962bceddd00aae8f9c9d3551858f65c
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/Styles/Bundles/Global.css?v=11
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency
125
strict-transport-security
max-age=10886400
content-encoding
gzip
x-content-type-options
nosniff
x-edgeconnect-midmile-rtt
31
server-timing
cdn-cache; desc=HIT, edge; dur=11
content-length
231
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 27 Nov 2018 14:55:13 GMT
x-frame-options
SAMEORIGIN
date
Fri, 23 Sep 2022 07:40:05 GMT
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
private, max-age=247
expires
Fri, 23 Sep 2022 07:44:12 GMT
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.16.0/ 		374 KB
83 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.16.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
353bcd41d11cc5a2bcb6763c269e41ac785c06ace29ac10053bb7c0fa3bf1ecf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Sep 2022 07:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
dGCXlveaBvO7BI0nfZKP+g==
age
1026
vary
Accept-Encoding
content-length
85065
x-ms-lease-status
unlocked
last-modified
Thu, 06 May 2021 19:31:04 GMT
server
cloudflare
etag
0x8D910C57D52F14C
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
fc994483-d01e-007d-116c-c4442e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
74f1a1579a67b760-AMS
va-3a8c03cc83fd9c554b5af6e1cc1ffa80.js
dev.visualwebsiteoptimizer.com/7.0/ 		226 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/7.0/va-3a8c03cc83fd9c554b5af6e1cc1ffa80.js
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=25349&u=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis&f=1&r=0.37956266567719865
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gams1 /
Resource Hash
b44e5840b6e2ab08c546c72d7af918fe0569f87da535e06dfdf9c10b49373dec

Request headers

Referer
https://www.sophos.com/
Origin
https://www.sophos.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Fri, 23 Sep 2022 07:40:05 GMT
content-encoding
br
last-modified
Thu, 22 Sep 2022 13:33:39 GMT
server
gams1
etag
"632c6433-fed2"
vary
Accept-Encoding, User-Agent
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
65234
via
1.1 google
v.gif
dev.visualwebsiteoptimizer.com/ 		35 B
214 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=25349&d=sophos.com&u=D07C60A8063822FC505ABFD355704641C&h=32e7d4e5d8a0e719cdfa8741ea22005b&t=false&r=0.6705931003553496
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gnv1c /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Sep 2022 07:40:05 GMT
via
1.1 google
x-content-type-options
nosniff
server
gnv1c
content-type
image/gif
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 10 Jan 2005 00:00:01 GMT
svrGP.aspx
s1777052651.t.eloqua.com/visitor/v200/
Redirect Chain
  • https://s1777052651.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=1777052651&ref2=elqNone&tzo=0&ms=705&optin=disabled
  • https://s1777052651.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1777052651&ref2=elqNone&tzo=0&ms=705&optin=disabled&elqCookie=1
49 B
448 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1777052651.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1777052651&ref2=elqNone&tzo=0&ms=705&optin=disabled&elqCookie=1
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
HTTP/1.1
Server
192.29.202.14 Amsterdam, Netherlands, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/
Resource Hash
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Content-Type
image/gif
Date
Fri, 23 Sep 2022 07:40:05 GMT
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control
no-store
X-Robots-Tag
noindex, nofollow
Content-Length
49
X-Xss-Protection
1; mode=block
Expires
-1

Redirect headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Date
Fri, 23 Sep 2022 07:40:05 GMT
X-Robots-Tag
noindex, nofollow
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Location
https://s1777052651.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1777052651&ref2=elqNone&tzo=0&ms=705&optin=disabled&elqCookie=1
Cache-Control
no-store
Content-Type
text/html; charset=utf-8
Content-Length
274
X-Xss-Protection
1; mode=block
Expires
-1
ga-audiences
www.google.nl/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=850287863&utmhn=www.sophos.com&utme=8(4!CampaignID)9(4!0)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&...
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=75279720.1663918806&jid=1364898699&_v=5.7.2dc&z=850287863
  • https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=75279720.1663918806&jid=1364898699&_v=5.7.2dc&z=850287863&slf_rd=1&random=1358904062
42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=75279720.1663918806&jid=1364898699&_v=5.7.2dc&z=850287863&slf_rd=1&random=1358904062
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Sep 2022 07:40:06 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 23 Sep 2022 07:40:05 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/html; charset=UTF-8
location
https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=75279720.1663918806&jid=1364898699&_v=5.7.2dc&z=850287863&slf_rd=1&random=1358904062
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.nl/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=2&utmn=217141345&utmhn=www.sophos.com&utme=8(4!CampaignID)9(4!0)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&...
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-18&cid=75279720.1663918806&jid=250827226&_v=5.7.2dc&z=217141345
  • https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-18&cid=75279720.1663918806&jid=250827226&_v=5.7.2dc&z=217141345&slf_rd=1&random=2366833531
42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-18&cid=75279720.1663918806&jid=250827226&_v=5.7.2dc&z=217141345&slf_rd=1&random=2366833531
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Sep 2022 07:40:06 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 23 Sep 2022 07:40:05 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/html; charset=UTF-8
location
https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-18&cid=75279720.1663918806&jid=250827226&_v=5.7.2dc&z=217141345&slf_rd=1&random=2366833531
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/ 		9 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
63b693778274923011281f0c339ac4116f8a31b9d186d0657849380cd5bd34b7

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		157 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
80d54533f80e8233621f965ae0a7713928bdb4d491ed0eb5e90434550f1894cb

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type
image/png
Searchbox.js
www.sophos.com/medialibrary/Scripts/ 		69 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.sophos.com/medialibrary/Scripts/Searchbox.js
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/medialibrary/Scripts/CoveoJsSearchLazymin.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a04c0733de7586e4f40c17b0f84b63ecf1da88afe01cac3067ca16fefa7b95d9
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security
max-age=10886400
content-encoding
gzip
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 25 Jan 2021 13:16:22 GMT
date
Fri, 23 Sep 2022 07:40:05 GMT
x-frame-options
SAMEORIGIN
content-type
application/x-javascript
x-ua-compatible
IE=edge
cache-control
private, max-age=132
x-content-type-options
nosniff
server-timing
cdn-cache; desc=HIT, edge; dur=1
vary
Accept-Encoding
content-length
16278
x-xss-protection
1; mode=block
expires
Fri, 23 Sep 2022 07:42:17 GMT
geoiphandler.axd
www.sophos.com/ 		88 B
847 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.sophos.com/geoiphandler.axd
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/scripts/bundles/global.js?v=8
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
cfc4f822d01eacaaf9f46146626e7222e4cc138902661637977f3ec9e2623218
Security Headers
Name Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400
referrer-policy
strict-origin-when-cross-origin
date
Fri, 23 Sep 2022 07:40:06 GMT
x-frame-options
SAMEORIGIN
content-type
text/plain; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
x-content-type-options
nosniff
server-timing
cdn-cache; desc=MISS, edge; dur=35, origin; dur=84
x-ua-compatible
IE=edge
content-length
88
x-xss-protection
1; mode=block
expires
Fri, 23 Sep 2022 07:40:06 GMT
en.json
cdn.cookielaw.org/consent/2e456f46-6b86-42c8-be0a-01efd4471533/510e2780-b948-41ab-b357-9310f1a72152/ 		88 KB
17 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/2e456f46-6b86-42c8-be0a-01efd4471533/510e2780-b948-41ab-b357-9310f1a72152/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.16.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
316138538017b92f1bdda635a62a34ffcece5e0655a3e5387076c353b5b6f8e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Sep 2022 07:40:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
l/bACSA9mFrJu858BtSkxw==
age
3608
vary
Accept-Encoding
content-length
17099
x-ms-lease-status
unlocked
last-modified
Mon, 03 May 2021 14:34:04 GMT
server
cloudflare
etag
0x8D90E4080913B74
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
fb18589e-b01e-0029-753e-caaea4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
74f1a1595b92b972-AMS
expires
Fri, 23 Sep 2022 11:40:05 GMT
ytc.js
s.yimg.com/wi/ 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.yimg.com/wi/ytc.js
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Fri, 23 Sep 2022 07:39:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
8
x-amz-server-side-encryption
AES256
vary
Origin, Accept-Encoding
x-amz-request-id
BFVVDZXHH3JTVQAG
x-amz-id-2
mC05TQWcnePwrQ0HchrJxlGXTx3qn/XVhVwMmVYOTqerHwiHdXdQXpL208X9qDBN4+YXaWgNULI=
referrer-policy
no-referrer-when-downgrade
x-amz-expiration
expiry-date="Thu, 20 Jul 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified
Tue, 14 Jun 2022 12:21:31 GMT
server
ATS
etag
"6a624022b5d271dcefb070b0b6670abc-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
x-amz-version-id
.QD3nDfK79S8_ikLSJXTL23Tdis9tg0C
x-xss-protection
1; mode=block
cache-control
public,max-age=3600
accept-ranges
bytes
content-type
application/javascript
activityi;dc_pre=CLfyhcu0qvoCFRTaGwod75QBcQ;src=9570324;type=sopapj;cat=sopho00;ord=5300808499916;gtm=2wg9l0;auiddc=2002450161.1663918806;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Ft...
9570324.fls.doubleclick.net/ Frame 7768
Redirect Chain
  • https://9570324.fls.doubleclick.net/activityi;src=9570324;type=sopapj;cat=sopho00;ord=5300808499916;gtm=2wg9l0;auiddc=2002450161.1663918806;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2...
  • https://9570324.fls.doubleclick.net/activityi;dc_pre=CLfyhcu0qvoCFRTaGwod75QBcQ;src=9570324;type=sopapj;cat=sopho00;ord=5300808499916;gtm=2wg9l0;auiddc=2002450161.1663918806;u1=https%3A%2F%2Fwww.so...
705 B
469 B 		Document
General
Check archive.org
Download Go to
Full URL
https://9570324.fls.doubleclick.net/activityi;dc_pre=CLfyhcu0qvoCFRTaGwod75QBcQ;src=9570324;type=sopapj;cat=sopho00;ord=5300808499916;gtm=2wg9l0;auiddc=2002450161.1663918806;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis;~oref=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-556N8KS
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.102 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f6.1e100.net
Software
cafe /
Resource Hash
e7ea23060088138b2dadef69f495ddf0f498923ee99c1e22b6dfbb70a749b80c
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.sophos.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-encoding
gzip
content-length
444
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 23 Sep 2022 07:40:06 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 23 Sep 2022 07:40:06 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://9570324.fls.doubleclick.net/activityi;dc_pre=CLfyhcu0qvoCFRTaGwod75QBcQ;src=9570324;type=sopapj;cat=sopho00;ord=5300808499916;gtm=2wg9l0;auiddc=2002450161.1663918806;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis;~oref=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
WuEFNglz.min.js
scripts.demandbase.com/ 		61 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://scripts.demandbase.com/WuEFNglz.min.js
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.27.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-27-124.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
821c1dba392245eac9a9d8709348b2e3dc9245eaeb40233a2f0d608060df20e0
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-amz-version-id
LCueR8U3D7lJgwCfemj1Slg2LluSXKrc
content-encoding
gzip
etag
W/"b068f44152e87ccb66f40491a735aad0"
age
2037
x-cache
Hit from cloudfront
vary
Accept-Encoding
last-modified
Thu, 17 Jun 2021 19:46:43 GMT
server
AmazonS3
date
Fri, 23 Sep 2022 07:06:26 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
via
1.1 8fd360cd20d33fa1400394ae41746f66.cloudfront.net (CloudFront)
cache-control
public, max-age=3600
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop
FRA56-C2
x-amz-cf-id
nS6IRpXTf6uFBOcxF-HprQrKorGDS15wa7nC5DFloMtebJetNhzQgw==
settings.js
dev.visualwebsiteoptimizer.com/ 		19 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/settings.js?a=25349&settings_type=1&vn=7.0
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/7.0/va-3a8c03cc83fd9c554b5af6e1cc1ffa80.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gams1 /
Resource Hash
690e52a143acf5803237fc8045032f55d0fbac25294c22d7f1853b747c4efc42

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Fri, 23 Sep 2022 07:40:06 GMT
via
1.1 google
server
gams1
etag
W/"1663853629"
content-type
application/javascript; charset=UTF-8
cache-control
no-cache,max-age=0
content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
otFlat.json
cdn.cookielaw.org/scripttemplates/6.16.0/assets/ 		12 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.16.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.16.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb1fa7363d6e4772f7c49d67f031d68f209e66de6c3c05aade6fdc57a02505c1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Sep 2022 07:40:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
DKM3/i+7h7Fs8cEMor3s2A==
age
4148
vary
Accept-Encoding
content-length
2938
x-ms-lease-status
unlocked
last-modified
Thu, 06 May 2021 19:30:47 GMT
server
cloudflare
etag
0x8D910C572DA86E8
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
d8a7632c-f01e-00e9-0c99-4f24e0000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
74f1a15a1d0fb972-AMS
otPcTab.json
cdn.cookielaw.org/scripttemplates/6.16.0/assets/v2/ 		46 KB
12 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.16.0/assets/v2/otPcTab.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.16.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4a02b434edb84f078f67ae040f565f6258b91dfa3f16ad8e305392cfe5d18e8c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 23 Sep 2022 07:40:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
2Zi7TemSsXHh6hY5sI0Yeg==
age
4148
vary
Accept-Encoding
content-length
11890
x-ms-lease-status
unlocked
last-modified
Thu, 06 May 2021 19:30:50 GMT
server
cloudflare
etag
0x8D910C574C4FC1A
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
a53f4b44-001e-00f7-7342-cafe0d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
74f1a15a1d11b972-AMS
config.json
c.go-mpulse.net/api/ Frame 7CB4 		51 B
323 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.go-mpulse.net/api/config.json?key=98YDQ-4R7DD-Y3XRM-CVBHP-WX4A4&d=www.sophos.com&t=5546396&v=1.632.0&if=&sl=0&si=i2nlqueqtio-rinjyu&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,LOGN&acao=&ak.ai=173635
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/98YDQ-4R7DD-Y3XRM-CVBHP-WX4A4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:3500:991::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
c9e20a9299e5fe9eee4ed45fe1b83ad907ac361e0d7c6c3df89ee396fdc19108

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 23 Sep 2022 07:40:06 GMT
Cache-Control
private, max-age=120, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
51
Content-Type
application/json
10150886.json
s.yimg.com/wi/config/ 		46 B
683 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://s.yimg.com/wi/config/10150886.json
Requested by
Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
b2a1b0d77cb3505f23f6ca96316687b95376336a00822166c18c2808ced160eb
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Fri, 23 Sep 2022 07:36:52 GMT
x-content-type-options
nosniff
age
196
x-amz-server-side-encryption
AES256
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id
CNW50HMKBQA78CZG
x-amz-id-2
P3+BezRhTkZZBkoFdPuqORcQwYKeSmIYHMe56gCLovXbiwSJdXEDefsfuT/qUktvrVvgmBtH6t8=
accept-ranges
bytes
referrer-policy
no-referrer-when-downgrade
x-amz-expiration
expiry-date="Fri, 20 Jan 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified
Wed, 15 Dec 2021 05:54:05 GMT
server
ATS
etag
"3769bd8c10be070cf8c85c08517a8fdc"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
access-control-allow-methods
GET
x-amz-version-id
VO4i6Xctkzo3gjHc0HLprUqd6v7sNIpd
access-control-allow-origin
*
x-xss-protection
1; mode=block
content-length
46
content-type
application/octet-stream
ip.json
api.company-target.com/api/v2/ 		441 B
945 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis&page_title=Detailed%20Analysis%20-%20Troj%2FSage-G%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&src=tag&key=f2514e2223f271de300b1908c2c90c911bed78d7
Requested by
Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/WuEFNglz.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-77.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
c55336a9ce2f67e9fcb480534d339b00051cf95c2f0b8ddd402357caa61de36c

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Fri, 23 Sep 2022 07:40:06 GMT
identification-source
CENTRAL
vary
Accept-Encoding, Origin
x-amz-cf-pop
FRA53-C1
x-cache
Miss from cloudfront
request-id
2c965fa0-8746-4a82-b5bb-37c65fd49c53
content-encoding
gzip
pragma
no-cache
access-control-allow-origin
https://www.sophos.com
server
nginx
access-control-max-age
7200
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json;charset=utf-8
via
1.1 a4a46c5a6cdf81ec1d08cf6e63389764.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
api-version
v2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
-YzVYpi3U7aJRzBHNsXz7JkRl93fGxChmkgHqY3gsu9AHGZNS4mKDA==
expires
Thu, 22 Sep 2022 07:40:06 GMT
validateCookie
segments.company-target.com/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/demandbase
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
  • https://segments.company-target.com/log?vendor=choca&user_id=AAEZ0E7GWsYAAB6OE3We4w
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAEZ0E7GWsYAAB6OE3We4w&verifyHash=801daa5507d0ab6914f5ea86bf24da56f2f98717
26 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAEZ0E7GWsYAAB6OE3We4w&verifyHash=801daa5507d0ab6914f5ea86bf24da56f2f98717
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
HTTP/1.1
Server
143.204.215.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-100.fra53.r.cloudfront.net
Software
/
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Fri, 23 Sep 2022 07:40:06 GMT
Via
1.1 a3c2566f9e36ad3cdf79fc6307fcf566.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA53-C1
Vary
Origin
X-Cache
Miss from cloudfront
Content-Type
image/gif
Transfer-Encoding
chunked
Connection
keep-alive
trace-id
da6a498263413469
X-Amz-Cf-Id
S04kXcbRuWMA2wzihvuWbXg-Gis-eEOe6clM2mnIpfF9kCFHO_b0iw==

Redirect headers

Date
Fri, 23 Sep 2022 07:40:06 GMT
Via
1.1 a3c2566f9e36ad3cdf79fc6307fcf566.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA53-C1
Vary
Origin
X-Cache
Miss from cloudfront
Location
/validateCookie?vendor=choca&user_id=AAEZ0E7GWsYAAB6OE3We4w&verifyHash=801daa5507d0ab6914f5ea86bf24da56f2f98717
Connection
keep-alive
trace-id
7c715cfe79aeb11c
Content-Length
0
X-Amz-Cf-Id
PDdp033ohujXDKC65I-_E1ERfB-UAO3Jbc_NxmN08y5eS2KKTKkjcA==
464526.gif
id.rlcdn.com/ 		0
98 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/464526.gif
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Fri, 23 Sep 2022 07:40:06 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sp.pl
sp.analytics.yahoo.com/ 		43 B
633 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2023%20Sep%202022%2007%3A40%3A06%20GMT&n=0&b=Detailed%20Analysis%20-%20Troj%2FSage-G%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&.yp=10150886&f=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis&enc=UTF-8&yv=1.13.0&tagmgr=gtm
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
spdc.pbp.vip.ir2.yahoo.com
Software
ATS /
Resource Hash
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Sep 2022 07:40:06 GMT
x-content-type-options
nosniff
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
cache-control
no-cache, private, must-revalidate
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
43
referrer-policy
strict-origin-when-cross-origin
expires
Fri, 23 Sep 2022 07:40:06 GMT
sp.pl
sp.analytics.yahoo.com/ 		43 B
247 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sp.analytics.yahoo.com/sp.pl?a=10000&b=Detailed%20Analysis%20-%20Troj%2FSage-G%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&.yp=10150886&f=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis&enc=UTF-8&yv=1.13.0&tagmgr=gtm
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
spdc.pbp.vip.ir2.yahoo.com
Software
ATS /
Resource Hash
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Sep 2022 07:40:06 GMT
x-content-type-options
nosniff
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
cache-control
no-cache, private, must-revalidate
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
43
referrer-policy
strict-origin-when-cross-origin
expires
Fri, 23 Sep 2022 07:40:06 GMT
pixel_3a62e8a0
www.sophos.com/akam/13/ 		0
629 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.sophos.com/akam/13/pixel_3a62e8a0
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/akam/13/3a62e8a0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.221 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-221.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Fri, 23 Sep 2022 07:40:06 GMT
cache-control
max-age=0, no-cache
expires
Fri, 23 Sep 2022 07:40:06 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=6
content-length
0
content-type
text/html
dc_pre=CLfyhcu0qvoCFRTaGwod75QBcQ;src=9570324;type=sopapj;cat=sopho00;ord=5300808499916;gtm=2wg9l0;auiddc=2002450161.1663918806;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-anal...
adservice.google.com/ddm/fls/i/ Frame 2405 		704 B
913 B 		Document
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/ddm/fls/i/dc_pre=CLfyhcu0qvoCFRTaGwod75QBcQ;src=9570324;type=sopapj;cat=sopho00;ord=5300808499916;gtm=2wg9l0;auiddc=2002450161.1663918806;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis;~oref=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis
Requested by
Host: 9570324.fls.doubleclick.net
URL: https://9570324.fls.doubleclick.net/activityi;dc_pre=CLfyhcu0qvoCFRTaGwod75QBcQ;src=9570324;type=sopapj;cat=sopho00;ord=5300808499916;gtm=2wg9l0;auiddc=2002450161.1663918806;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis;~oref=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b187ae5c511c9c5224ee426c4c695525d732c8e8cfaf7f524390c8e74aa1b196
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://9570324.fls.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-encoding
gzip
content-length
444
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 23 Sep 2022 07:40:06 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma
no-cache
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
dc_pre=CLfyhcu0qvoCFRTaGwod75QBcQ;src=9570324;type=sopapj;cat=sopho00;ord=5300808499916;gtm=2wg9l0;auiddc=2002450161.1663918806;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-anal...
adservice.google.nl/ddm/fls/i/ Frame 4E00 		194 B
870 B 		Document
General
Check archive.org
Download Go to
Full URL
https://adservice.google.nl/ddm/fls/i/dc_pre=CLfyhcu0qvoCFRTaGwod75QBcQ;src=9570324;type=sopapj;cat=sopho00;ord=5300808499916;gtm=2wg9l0;auiddc=2002450161.1663918806;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis;~oref=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis
Requested by
Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CLfyhcu0qvoCFRTaGwod75QBcQ;src=9570324;type=sopapj;cat=sopho00;ord=5300808499916;gtm=2wg9l0;auiddc=2002450161.1663918806;u1=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis;~oref=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://adservice.google.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=0
content-encoding
gzip
content-length
177
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 23 Sep 2022 07:40:06 GMT
expires
Fri, 23 Sep 2022 07:40:06 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
sp.pl
sp.analytics.yahoo.com/ 		43 B
78 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sp.analytics.yahoo.com/sp.pl?a=10000&b=Detailed%20Analysis%20-%20Troj%2FSage-G%20-%20Viruses%20and%20Spyware%20-%20Advanced%20Network%20Threat%20Protection%20%7C%20ATP%20from%20Targeted%20Malware%20Attacks%20and%20Persistent%20Threats%20%7C%20sophos.com%20-%20Threat%20Center&.yp=10150886&f=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis&enc=UTF-8&yv=1.13.0&tagmgr=gtm
Requested by
Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
spdc.pbp.vip.ir2.yahoo.com
Software
ATS /
Resource Hash
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 23 Sep 2022 07:40:06 GMT
x-content-type-options
nosniff
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
cache-control
no-cache, private, must-revalidate
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
43
referrer-policy
strict-origin-when-cross-origin
expires
Fri, 23 Sep 2022 07:40:06 GMT
ytc.js
s.yimg.com/wi/ 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.yimg.com/wi/ytc.js
Requested by
Host: www.sophos.com
URL: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sage-G/detailed-analysis
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://www.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date
Fri, 23 Sep 2022 07:39:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
8
x-amz-server-side-encryption
AES256
vary
Origin, Accept-Encoding
x-amz-request-id
BFVVDZXHH3JTVQAG
x-amz-id-2
mC05TQWcnePwrQ0HchrJxlGXTx3qn/XVhVwMmVYOTqerHwiHdXdQXpL208X9qDBN4+YXaWgNULI=
referrer-policy
no-referrer-when-downgrade
x-amz-expiration
expiry-date="Thu, 20 Jul 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified
Tue, 14 Jun 2022 12:21:31 GMT
server
ATS
etag
"6a624022b5d271dcefb070b0b6670abc-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
x-amz-version-id
.QD3nDfK79S8_ikLSJXTL23Tdis9tg0C
x-xss-protection
1; mode=block
cache-control
public,max-age=3600
accept-ranges
bytes
content-type
application/javascript

Verdicts & Comments Add Verdict or Comment

236 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| OneTrustStub function| OptanonWrapper object| dataLayer function| initialiseCoveoSearchEndpoint function| initialiseCoveoSearch function| setPressReleaseArchiveDropDownColour function| FillThreatTrendTable function| FillThreatLineGraph function| PopulateThreatGraphData function| PlotThreatGraph function| ThreatGraphTooltipEvent function| ShowSelectedContactDetails function| showHeaderCookieControl function| TabbedWidget function| getCurrentScreenSize function| repositionHeaderAndFooter function| closeAllNavigationTabs function| toggleHeaderNavigationPanel function| openHeaderNavigationPanel function| closeHeaderNavigationPanel function| openMenu function| closeMenu function| MM_findObj function| ImageSwap function| ClearTextBox function| ClearInitialValueTextBox function| ResetTextBox function| ClearPasswordTextBox function| ResetPasswordTextBox function| searchreset function| searchclear function| trapEnter_IE function| trapEnter_FF function| Sophos_SearchText function| Sophos_SearchText2 function| Sophos_Search function| RefreshPage function| RefreshParentPage function| RedirectParentPage number| localeTestNumber boolean| cannotLocale function| FormatNumberWithCommas function| setCampaignId function| readCampaignAndWriteToCookie object| l10n_r string| l10n_url number| l10n_timeout function| RmClass function| createXMLHttpRequest function| JSONCookie function| localize function| getIpParameterFromQueryString function| loadHeaderCookieControl function| showLocalContent function| _createFunctionSearchElements function| $jq function| $j function| isFunction object| EasyAutocomplete function| setInterchangeQuery function| resizeResponsiveSubmitASampleIframe function| setResponsiveTabsHeight function| StoreGoogleAdsInCookie function| mobileFooter function| $ function| jQuery function| jQueryBridget function| EvEmitter function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Masonry function| getParameterByName function| readReferralAndWriteToCookie function| Tether function| Drop object| toastr object| Foundation object| _elqQ function| GetCookie string| campaignId object| _gaq number| settings_timer number| _vwo_settings_timer object| _vwo_code function| getSitecoreCurrentLocale object| BOOMR_mq string| BOOMR_API_key object| BOOMR number| BOOMR_lstart string| bazadebezolkohpepadr object| theForm function| __doPostBack function| WebForm_PostBackOptions function| WebForm_DoPostBackWithOptions object| __pendingCallbacks number| __synchronousCallBackIndex function| WebForm_DoCallback function| WebForm_CallbackComplete function| WebForm_ExecuteCallback function| WebForm_FillFirstAvailableSlot boolean| __nonMSDOMBrowser string| __theFormPostData object| __theFormPostCollection object| __callbackTextTypes function| WebForm_InitCallback function| WebForm_InitCallbackAddField function| WebForm_EncodeCallback object| __disabledControlArray function| WebForm_ReEnableControls function| WebForm_ReDisableControls function| WebForm_SimulateClick function| WebForm_FireDefaultButton function| WebForm_GetScrollX function| WebForm_GetScrollY function| WebForm_SaveScrollPositionSubmit function| WebForm_SaveScrollPositionOnSubmit function| WebForm_RestoreScrollPosition function| WebForm_TextBoxKeyHandler function| WebForm_TrimString function| WebForm_AppendToClassName function| WebForm_RemoveClassName function| WebForm_GetElementById function| WebForm_GetElementByTagName function| WebForm_GetElementsByTagName function| WebForm_GetElementDir function| WebForm_GetElementPosition function| WebForm_GetParentByTagName function| WebForm_SetElementHeight function| WebForm_SetElementWidth function| WebForm_SetElementX function| WebForm_SetElementY function| externalLinks function| Sys$Enum$parse function| Sys$Enum$toString function| Sys$Component$_setProperties function| Sys$Component$_setReferences function| $create function| $addHandler function| $addHandlers function| $clearHandlers function| $removeHandler function| $get function| $find function| Type object| Sys object| _events function| webpackJsonpCoveo__temporary object| Coveo function| _ function| Globalize function| __extends object| Coveo__temporary string| domain object| sophosCookiePolicyCompliantCountries string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData number| _vwo_acc_id object| vwoCode object| _vwo_style string| _vwo_css function| commonWrapper function| pushBasedCommonWrapper string| _vwo_cookieDomain string| _vwo_uuid string| _vis_opt_file number| _vwo_library_timer string| _vis_opt_lib undefined| b number| _vwo_j_e string| _vwo_mt string| _vwo_tm object| VWO object| vwo_iehack_queue object| _vwo_exp_ids object| _vwo_exp object| VWOOmni object| _elq object| _gat object| gaGlobal string| urhehlevkedkilrobacf function| postscribe object| google_tag_manager_external object| google_tag_manager object| google_tag_data function| vwo_$ string| _vwo_server_url object| _vis_opt_queue object| _vis_opt_check_segment object| _vwo_evq function| _vwo_ev boolean| DISABLE_NATIVE_CONSTANTS object| _vwo_t object| _vwo_editorOperationTracker function| _vwo_handleMutations object| _vwo_api_section_callback object| _vis_opt_comb_name function| _vwo_s object| _vwo_campaignData function| _vis_opt_top_initialize function| _vis_opt_bottom_initialize function| _vis_opt_goal_conversion function| _vis_opt_revenue_conversion function| _vis_opt_pause function| _vis_opt_readCookie function| _vis_opt_createCookie function| _vis_opt_element_loaded function| _vis_opt_GA_track function| _vis_opt_register_conversion function| _vis_opt_get_campaign_xPath number| _vis_opt_experiment_id boolean| _vwo_settings_timed_out object| dotq object| Optanon object| OneTrust object| YAHOO number| BOOMR_configt object| Demandbase object| __db function| DBSegment function| ga number| BOOMR_onload

35 Cookies

Domain/Path Name / Value
.sophos.com/ Name: websiteaklang
Value: en-us
.sophos.com/ Name: AKA_A2
Value: A
www.sophos.com/ Name: akacd_pr01
Value: 3841371602~rv=19~id=7788ca0e2de634741032b236b63c8c95
.sophos.com/ Name: website#lang
Value: en
.sophos.com/ Name: _sphs_uuid
Value: 2b61cecf-3b88-4e63-b363-3d071993e545
.sophos.com/ Name: __SophosNextDeviceEnabled
Value: true
.sophos.com/ Name: ASP.NET_SessionId
Value: scsvwhrciwwf2ubbp0abooe2
.sophos.com/ Name: bm_mi
Value: C4EFB938904BCE09CCEB77D15BE1C619~YAAQHrsQAi8/31aDAQAAFxBKaRFb08oRFU5X3C/UE/GNuZwFfBkR7xwM6mWDRhTwb1rlHQktDyuKrcEKwLClhMhHti7AYmUr5OnVzrq9EvO2EXcx2FdGcUPSojP74fqUYWaLT3opRtclUyEhSv8MhjGKMvv7fxmATuSEysq1KVzZLlJYOBEUVGQeFjmcW0S+iiR7x5ZrHusD/Zi2VwC7zeSCB186wV/tqifODJPm4U95tBVeR1ed1m0DAideklpo/S3DE19LgN1rDxqovF5mu9lTmxMoI3zncKazaXIJtTjc4g85QYYFNpt+UDlAd1/AwjAbvBZgUNqr2MLFvLjnYZhqqmGGzj7jZBzcEif1AtRxYXM2dsQORuU68WXyIneJ73aYfof7vibQbhaWftbZXdRC3oIxc6rwRUcJtKCH6rtFuA==~1
.sophos.com/ Name: CampaignID
Value: 0
.sophos.com/ Name: _vwo_uuid_v2
Value: D07C60A8063822FC505ABFD355704641C|32e7d4e5d8a0e719cdfa8741ea22005b
.sophos.com/ Name: __utma
Value: 1.75279720.1663918806.1663918806.1663918806.1
.sophos.com/ Name: __utmc
Value: 1
.sophos.com/ Name: __utmz
Value: 1.1663918806.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.sophos.com/ Name: __utmt
Value: 1
.sophos.com/ Name: __utmt_o
Value: 1
.sophos.com/ Name: __utmb
Value: 1.2.10.1663918806
.sophos.com/ Name: RT
Value: "z=1&dm=sophos.com&si=i2nlqueqtio&ss=l8e6an8p&sl=0&tt=0"
.eloqua.com/ Name: ELOQUA
Value: GUID=E4D088612FE343CA90A88B50CE2C8F6C
.eloqua.com/ Name: ELQSTATUS
Value: OK
.sophos.com/ Name: _vis_opt_s
Value: 1%7C
.sophos.com/ Name: _vis_opt_test_cookie
Value: 1
.sophos.com/ Name: _gcl_au
Value: 1.1.2002450161.1663918806
.sophos.com/ Name: _vwo_uuid
Value: D07C60A8063822FC505ABFD355704641C
.sophos.com/ Name: _vwo_ds
Value: 3%241663918804%3A49.62272377%3A%3A
.sophos.com/ Name: _vwo_sn
Value: 0%3A1
.sophos.com/ Name: bm_sv
Value: B2673095F608FEB9B7D2B1A2BD535312~YAAQHrsQAlY/31aDAQAAaRRKaRHCrDFYwcnXOFtwGx4MfYsYEXzuE/S6yq/jbC4amf3KYGVTiwaZ6IwZaJtscf8Kx/Qh91y+YV8umjUn1dRak+HZiFmXAxzrJHcc9InoJXcdlGYTQW5HqxMKs7YIC9qubNUDV4gxd/c2NXtg2TBgcPflb4idU2CxNR2E0gVFuRaqDt7b1Wa7w26eYD2bN3Rt7pz2LSsy99/fPR2AL45vFzr9HkP0PX2alkT6M/Eq~1
.sophos.com/ Name: OptanonConsent
Value: isIABGlobal=false&datestamp=Fri+Sep+23+2022+07%3A40%3A06+GMT%2B0000+(GMT)&version=6.16.0&hosts=&consentId=a4722da5-2ea7-4504-8c34-91b4549f877c&interactionCount=0&landingPath=https%3A%2F%2Fwww.sophos.com%2Fen-us%2Fthreat-center%2Fthreat-analyses%2Fviruses-and-spyware%2FTroj~Sage-G%2Fdetailed-analysis&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0
.sophos.com/ Name: __L10N
Value: %7B%22longitude%22%3A%224.8995%22%2C%22zoom%22%3A%226%22%2C%22latitude%22%3A%2252.3824%22%2C%22name%22%3A%22Netherlands%22%2C%22code%22%3A%22NL%22%7D
.sophos.com/ Name: ak_bmsc
Value: A51275568E08CE001E04E31E74ACCE97~000000000000000000000000000000~YAAQHrsQAlk/31aDAQAApxVKaREkZA74QjXXuKbTQlmIgO/RAT79A3YvJy6UZZLEruOYVZVG+FFKvWucLxw6LCwcn6BfNhqEgMd5Tk3WWfGJbks5B+geTAN3q7JpnNFhUu4TF/IqkFITJpAi+2dTjfBiwHlsxIjrI2fpAperr0LAVAafCMkbmJRFOlV0DY9B6SvfCDU9EDWkAMIYjCSr8RTVL6z3HItp5DDC1+9icCdbstraK2n1RFbTiJ+eeIhJed4bOvy0UufcdgOFN5atg+w6r6oQ1vdVkaNomPP3bN3nDkj7KCKhsbIeTC9SgSR+EmkWB7OrbZMdNaPjpWUT8U706i1TOfKAQfZi+JpvqGuuwS0N+ChOIgEQ6T5aYo8NcHAioagi3l3bDJmcL22c9/LLY4ANs7Y=
.yahoo.com/ Name: A3
Value: d=AQABBNZiLWMCELgrOW6GUkuJkzNLKllSSpMFEgEBAQG0LmM3YwAAAAAA_eMAAA&S=AQAAApFtCUwDLdD6unHzF_VIyhk
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.bidr.io/ Name: bito
Value: AAEZ0E7GWsYAAB6OE3We4w
.bidr.io/ Name: bitoIsSecure
Value: ok
.company-target.com/ Name: tuuid
Value: 64ca40f3-f1bc-4a8b-bc36-8295e1708bab
.company-target.com/ Name: tuuid_lu
Value: 1663918806

1 Console Messages

Source Level URL
Text
network error URL: https://id.rlcdn.com/464526.gif
Message:
Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=10886400
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9570324.fls.doubleclick.net
adservice.google.com
adservice.google.nl
api.company-target.com
c.go-mpulse.net
cdn.cookielaw.org
dev.visualwebsiteoptimizer.com
geolocation.onetrust.com
id.rlcdn.com
img03.en25.com
match.prod.bidr.io
s.go-mpulse.net
s.yimg.com
s1777052651.t.eloqua.com
scripts.demandbase.com
segments.company-target.com
sp.analytics.yahoo.com
stats.g.doubleclick.net
www.google.com
www.google.nl
www.googletagmanager.com
www.sophos.com
104.111.233.221
13.32.27.124
142.250.186.102
143.204.215.100
143.204.215.77
192.29.202.14
212.82.100.181
2606:4700:4400::6812:2962
2606:4700::6810:9540
2a00:1288:80:807::1
2a00:1450:4001:800::2002
2a00:1450:4001:80b::2003
2a00:1450:4001:812::2008
2a00:1450:4001:82b::2002
2a00:1450:400c:c08::9c
2a00:1450:400d:80d::2004
2a02:26f0:3500:592::11a6
2a02:26f0:3500:991::11a6
34.96.102.137
35.244.174.68
52.30.152.75
96.16.149.96
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
095cef01d97174531cc4396240f52e552aac3aaaf9c7e80aafa955c132e10037
0c4272265b7ddaa6577a2287ce5c13be78cf6d89928dda95284527224a387b0c
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
0ffe46125c2a270822a1c04a7f3d80cfff046267e4a42ed1f4cd25383429d483
189a7158414e4fab1d24249e6eef0b73fcf61dc28c070fb90da996ca9936f111
1fd7dd180ba5bff6e2fc533346f450838c1f05aea5bc95b009f73d2b10ad989e
249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f
2a42c163168d9461b0bc20b3e9a1a10181ecb9f7c3d1b738903a7ee03ec36aa0
31037d926621b0758c70fb400f05cd1bf962bceddd00aae8f9c9d3551858f65c
316138538017b92f1bdda635a62a34ffcece5e0655a3e5387076c353b5b6f8e0
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
353bcd41d11cc5a2bcb6763c269e41ac785c06ace29ac10053bb7c0fa3bf1ecf
398cdf1b27ef247e5bc77805f266bb441e60355463fc3d1776f41aae58b08cf1
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db
42fe42ff953beca97d239dd6fb4549d2e2e179cbde0f8341e2aa1137a191208b
4a02b434edb84f078f67ae040f565f6258b91dfa3f16ad8e305392cfe5d18e8c
517a16fedc3c2f5ba86a4c4c9567552088e1572016fc835ba0bd79e83bdd1c6e
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
632c55966e23462867a7804060857901969e5613adfde633e91e5557d4539956
63b693778274923011281f0c339ac4116f8a31b9d186d0657849380cd5bd34b7
66b804e7a96a87c11e1dd74ea04ac2285df5ad9043f48046c3e5000114d39b1c
68ff399833b0eff8b79aa63ee942f9fc324148047e7bb0db23c2880a8e4004a0
690e52a143acf5803237fc8045032f55d0fbac25294c22d7f1853b747c4efc42
70b2c85c2a1e64a8bf5a7080944b925350eac2df76e3115bca01ff0d7e903db4
80d54533f80e8233621f965ae0a7713928bdb4d491ed0eb5e90434550f1894cb
821c1dba392245eac9a9d8709348b2e3dc9245eaeb40233a2f0d608060df20e0
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8b58995549c9e4b5feeb7851b9901647b98be600971ecf743c931a61385cb9b4
8ca76658afe65a55a56d4b0819cd3749888d68b7e8a8994f2a32f8d80166e37c
95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54
9bebf16bfa9710edb204ea20eabab3b3f736f357d23107a4270c3389e91f58ea
9f3c45aae8d14cee7c2fa3bcd7604c6936a4886ff864fb743e11dc61705cd516
a04c0733de7586e4f40c17b0f84b63ecf1da88afe01cac3067ca16fefa7b95d9
a325d69859df35ccdd1cd6a5b071bb9ef737b2775552c6c319f372a51f6fadd9
a55150a4cc33c9d0e381368e1b4d6170a7fde72ecba6de0ab043b3dc43dfad73
b187ae5c511c9c5224ee426c4c695525d732c8e8cfaf7f524390c8e74aa1b196
b2a1b0d77cb3505f23f6ca96316687b95376336a00822166c18c2808ced160eb
b44e5840b6e2ab08c546c72d7af918fe0569f87da535e06dfdf9c10b49373dec
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
c348ab6de15c26b0acbf73117cc957127b32b670ea39528c659c137c35ca9b99
c55336a9ce2f67e9fcb480534d339b00051cf95c2f0b8ddd402357caa61de36c
c6e79c02c276ce7b505c898813dcc571d7ed91db3ccc1a8d4b4bae0b926ae523
c9e20a9299e5fe9eee4ed45fe1b83ad907ac361e0d7c6c3df89ee396fdc19108
cfc4f822d01eacaaf9f46146626e7222e4cc138902661637977f3ec9e2623218
d1fabd20a67738775bb84fda3b230d2f007a2c3a6629d327bc8ab4312cb5c0fe
d3b52faf5be7daa1313c027b7ec9fbc17c723afd68206ce75769ad86d12ab31a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7ea23060088138b2dadef69f495ddf0f498923ee99c1e22b6dfbb70a749b80c
eb1fa7363d6e4772f7c49d67f031d68f209e66de6c3c05aade6fdc57a02505c1
eb75190c0b45dd7c1bfbf62ac7b6c1912ef72a53e104ca22130c06f4d6312ae4
eea1b7873151984ab07645f9dfa06237e3080de0726a4319dd628ba370eb9afa
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab
f4a2fb1bd486b246823cfb9750f25a4323a8f74c23968d4a6fcdd96a65511631
f4d2ded74dc0c44de5d0f39f567cd0576d011f9924150530b4cb8c459c3c9f55