blog.newskysecurity.com Open in urlscan Pro
52.4.145.119 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
Effective URL:
https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
Submission: On November 24 via api (November 24th 2019, 10:20:48 pm UTC) from US

Summary HTTP 71 Redirects Links 43 Behaviour Indicators

Summary

This website contacted 13 IPs in 3 countries across 9 domains to perform 71 HTTP transactions. The main IP is 52.4.145.119, located in Ashburn, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is blog.newskysecurity.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 30th 2019. Valid for: a year.

This is the only time blog.newskysecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 7	52.4.145.119 52.4.145.119	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 1	2606:4700::68... 2606:4700::6810:797f	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2a02:26f0:6c0... 2a02:26f0:6c00:196::13b8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
13	2606:4700::68... 2606:4700::6810:7591	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
28	2606:4700::68... 2606:4700::6810:7691	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	13.225.84.38 13.225.84.38	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	143.204.101.37 143.204.101.37	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2600:9000:21f... 2600:9000:21f3:c800:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	3.214.164.119 3.214.164.119	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
3	2600:9000:204... 2600:9000:2043:ee00:11:f728:3040:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	3.225.17.244 3.225.17.244	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
10	34.192.124.59 34.192.124.59	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
71	13

7 52.4.145.119 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-4-145-119.compute-1.amazonaws.com

blog.newskysecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:797f (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:196::13b8 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2606:4700::6810:7591 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

glyph.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn-client.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 2606:4700::6810:7691 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

miro.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.84.38 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-225-84-38.fra2.r.cloudfront.net

d1z2jf7jlzjs58.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.101.37 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-101-37.fra50.r.cloudfront.net

cdn.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:c800:19:9934:6a80:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.214.164.119 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-3-214-164-119.compute-1.amazonaws.com

srv-2019-11-24-22.pixel.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2043:ee00:11:f728:3040:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

api2.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.225.17.244 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-3-225-17-244.compute-1.amazonaws.com

errors.client.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 34.192.124.59 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-192-124-59.compute-1.amazonaws.com

collector-medium.lightstep.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
42	medium.com 1 redirects medium.com glyph.medium.com miro.medium.com cdn-client.medium.com	1 MB
10	lightstep.com collector-medium.lightstep.com	2 KB
7	newskysecurity.com 1 redirects blog.newskysecurity.com	31 KB
4	branch.io cdn.branch.io api2.branch.io	23 KB
3	google-analytics.com www.google-analytics.com	18 KB
3	optimizely.com cdn.optimizely.com errors.client.optimizely.com	81 KB
2	parsely.com srv-2019-11-24-22.pixel.parsely.com	765 B
1	app.link app.link	728 B
1	cloudfront.net d1z2jf7jlzjs58.cloudfront.net	17 KB
71	9

	Domain	Requested by
28	miro.medium.com	blog.newskysecurity.com
10	collector-medium.lightstep.com	cdn-client.medium.com
10	cdn-client.medium.com	blog.newskysecurity.com cdn-client.medium.com
7	blog.newskysecurity.com	1 redirects cdn-client.medium.com
3	api2.branch.io	cdn-client.medium.com
3	www.google-analytics.com	blog.newskysecurity.com
3	glyph.medium.com	blog.newskysecurity.com
2	errors.client.optimizely.com	cdn-client.medium.com
2	srv-2019-11-24-22.pixel.parsely.com	d1z2jf7jlzjs58.cloudfront.net
1	app.link	cdn.branch.io
1	cdn.branch.io	blog.newskysecurity.com
1	d1z2jf7jlzjs58.cloudfront.net	cdn-client.medium.com
1	cdn.optimizely.com	blog.newskysecurity.com
1	medium.com	1 redirects
71	14

This site contains links to these domains. Also see Links.

Domain
medium.com
newskysecurity.us16.list-manage.com
sixtysearch.com
www.showboxapp2016.com
wikipedia.org
www.usb.org
blogs.mcafee.com
www.0xid.com
www.virustotal.com
www.newskysecurity.com
psiloveyou.xyz
help.medium.com

Subject Issuer	Validity	Valid
blog.newskysecurity.com Sectigo RSA Domain Validation Secure Server CA	`2019-04-30` - `2020-04-29`	a year	crt.sh
cdn.optimizely.com DigiCert ECC Secure Server CA	`2018-11-24` - `2020-02-23`	a year	crt.sh
*.medium.com DigiCert SHA2 Secure Server CA	`2018-07-31` - `2020-09-09`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2019-07-17` - `2020-07-05`	a year	crt.sh
*.branch.io DigiCert SHA2 Secure Server CA	`2018-12-05` - `2020-12-08`	2 years	crt.sh
appipv4.link Amazon	`2019-08-19` - `2020-09-19`	a year	crt.sh
*.pixel.parsely.com Let's Encrypt Authority X3	`2019-10-01` - `2019-12-30`	3 months	crt.sh
errors.client.optimizely.com DigiCert SHA2 High Assurance Server CA	`2018-09-24` - `2020-09-28`	2 years	crt.sh
*.lightstep.com Let's Encrypt Authority X3	`2019-09-24` - `2019-12-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
Frame ID: 11B078123CF29E67C288103AD13212CF
Requests: 75 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed HTTP 302
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-an... HTTP 302
https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421 Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

71
Requests

100 %
HTTPS

54 %
IPv6

9
Domains

14
Subdomains

13
IPs

3
Countries

1234 kB
Transfer

2899 kB
Size

11
Cookies

43 Outgoing links

These are links going to different origins than the main page.

URL: https://medium.com/?source=post_page-----eff485c665ed----------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&source=post_page-----eff485c665ed---------------------nav_reg-
Title: Sign in

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&source=post_page-----eff485c665ed---------------------nav_reg-
Title: Get started

Search URL Search Domain Scan URL

URL: https://newskysecurity.us16.list-manage.com/subscribe/post?u=4ae225235ee480922d944b995&id=5cd323f143&source=post_page-----eff485c665ed----------------------
Title: Subscribe to newsletters👈

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&source=-6fd955ea0e6c-------------------------follow_byline-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/p/eff485c665ed/share/twitter?source=post_actions_header---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/p/eff485c665ed/share/facebook?source=post_actions_header---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&source=post_actions_header--------------------------bookmark_sidebar-

Search URL Search Domain Scan URL

URL: https://sixtysearch.com/
Title: lucie started new website

Search URL Search Domain Scan URL

URL: https://www.showboxapp2016.com/showbox-apk/
Title: Showbox Android security

Search URL Search Domain Scan URL

URL: https://wikipedia.org/wiki/IPTV
Title: IPTV

Search URL Search Domain Scan URL

URL: http://www.usb.org/developers/onthego/
Title: USB OTG

Search URL Search Domain Scan URL

URL: https://blogs.mcafee.com/executive-perspectives/franchising-ransomware
Title: Franchising Ransomware

Search URL Search Domain Scan URL

URL: http://www.0xid.com/
Title: 0XID

Search URL Search Domain Scan URL

URL: http://www.virustotal.com/
Title: VirusTotal

Search URL Search Domain Scan URL

URL: https://newskysecurity.us16.list-manage.com/subscribe/post?u=4ae225235ee480922d944b995&id=5cd323f143

Search URL Search Domain Scan URL

URL: https://www.newskysecurity.com/get-a-quote

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&source=post_sidebar--------------------------follow_sidebar-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&source=post_sidebar-----eff485c665ed---------------------clap_sidebar-

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&source=post_actions_footer-----eff485c665ed---------------------clap_footer-

Search URL Search Domain Scan URL

URL: https://medium.com/p/eff485c665ed/share/twitter?source=post_actions_footer---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/p/eff485c665ed/share/facebook?source=post_actions_footer---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&source=post_actions_footer--------------------------bookmark_sidebar-

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&source=follow_footer-6fd955ea0e6c-------------------------follow_footer-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&source=follow_footer--------------------------follow_footer-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/p/eff485c665ed/responses/show?source=follow_footer--------------------------follow_footer-
Title: Write the first response

Search URL Search Domain Scan URL

URL: https://medium.com/kaizen-habits/psychologists-explain-how-to-stop-overthinking-everything-e527962a393?source=post_recirc---------0------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&source=post_recirc-----e527962a393----0-----------------clap_preview-

Search URL Search Domain Scan URL

URL: https://medium.com/better-marketing/how-my-friend-made-400k-from-selling-an-insanely-simple-ebook-3c40ad6a5bb8?source=post_recirc---------1------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&source=post_recirc-----3c40ad6a5bb8----1-----------------clap_preview-

Search URL Search Domain Scan URL

URL: https://psiloveyou.xyz/my-husband-didnt-come-home-one-night-ee2c9f88a87d?source=post_recirc---------2------------------

Search URL Search Domain Scan URL

URL: https://psiloveyou.xyz/?source=post_recirc---------2------------------
Title: P.S. I Love You

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&source=post_recirc-----ee2c9f88a87d----2-----------------clap_preview-

Search URL Search Domain Scan URL

URL: https://medium.com/about?autoplay=1&source=post_page-----eff485c665ed----------------------
Title: Discover Medium

Search URL Search Domain Scan URL

URL: https://medium.com/topics?source=post_page-----eff485c665ed----------------------
Title: Make Medium yours

Search URL Search Domain Scan URL

URL: https://medium.com/membership?source=post_page-----eff485c665ed----------------------
Title: Become a member

Search URL Search Domain Scan URL

URL: https://help.medium.com/?source=post_page-----eff485c665ed----------------------
Title: Help

Search URL Search Domain Scan URL

URL: https://medium.com/policy/9db0094a1e0f?source=post_page-----eff485c665ed----------------------
Title: Legal

Search URL Search Domain Scan URL

URL: https://medium.com/policy/f03bf92035c9
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed HTTP 302
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed HTTP 302
https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

71 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request how-android-ransomware-bricked-my-tv-eff485c665ed Show response
blog.newskysecurity.com/
Redirect Chain

https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed
https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

131 KB
27 KB

673ms
673ms

Document
text/html

52.4.145.119
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.145.119 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-4-145-119.compute-1.amazonaws.com

Software

nginx /

Resource Hash

fa6aeeecda11c89e63d13913a45dc7792a345cf8cf7cc882a0689eed5411b136

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

:method: GET
:authority: blog.newskysecurity.com
:scheme: https
:path: /how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User: ?1

Response headers

status: 200
server: nginx
date: Sun, 24 Nov 2019 22:20:28 GMT
content-type: text/html; charset=utf-8
set-cookie: optimizelyEndUserId=lo_gRp9Q3nDxQkb; path=/; expires=Mon, 23 Nov 2020 22:20:27 GMT; secure uid=lo_gRp9Q3nDxQkb; path=/; expires=Mon, 23 Nov 2020 22:20:27 GMT; secure; httponly sid=1:i2k5MqNP4VfW0wNB90ji6+0dx49EL9rNzy8XUI4RGXFSoeZAux+OeTT82KY3JZDsbaEF3Ssi7naiS+EC1I28Gw==; path=/; expires=Mon, 23 Nov 2020 22:20:27 GMT; secure; httponly puid=; path=/; expires=Sun, 24 Nov 2019 22:20:26 GMT; domain=blog.newskysecurity.com; secure; httponly puid=; path=/; expires=Sun, 24 Nov 2019 22:20:26 GMT; domain=.blog.newskysecurity.com; secure; httponly puid=; path=/; expires=Sun, 24 Nov 2019 22:20:26 GMT; secure; httponly puid=; path=/; expires=Sun, 24 Nov 2019 22:20:26 GMT; domain=blog.newskysecurity.com; secure; httponly, puid=; path=/; expires=Sun, 24 Nov 2019 22:20:26 GMT; domain=.blog.newskysecurity.com; secure; httponly, puid=; path=/; expires=Sun, 24 Nov 2019 22:20:26 GMT; secure; httponly
sepia-upstream: production
x-frame-options: allow-from medium.com
medium-fulfilled-by: lite/master-20191121-172537-39186d1762, rito/master-20191121-195510-83abb6152d, tutu/medium-39343
etag: W/"20ba2-nnmDXxT+iqaoF8A9BmIhc3kMNmQ"
vary: Accept-Encoding
content-encoding: gzip
x-envoy-upstream-service-time: 401

Redirect headers

status: 302
date: Sun, 24 Nov 2019 22:20:27 GMT
content-type: application/octet-stream
set-cookie: __cfduid=df7ac052ef62ecfee546207be53ba14161574634027; expires=Tue, 24-Dec-19 22:20:27 GMT; path=/; domain=.medium.com; HttpOnly uid=lo_gRp9Q3nDxQkb; Expires=Mon, 23-Nov-20 22:20:27 GMT; Domain=.medium.com; Path=/; Secure; HttpOnly optimizelyEndUserId=lo_gRp9Q3nDxQkb; path=/; expires=Mon, 23 Nov 2020 22:20:27 GMT; domain=.medium.com; secure sid=1:lcJbl3HvEvYiRzFtHsptTeMbuWjkOVk1Kzst5IkDYOhvdl+Sg+9elfqe0JMwR7/r; path=/; expires=Mon, 23 Nov 2020 22:20:27 GMT; domain=.medium.com; secure; httponly puid=; path=/; expires=Sun, 24 Nov 2019 22:20:26 GMT; domain=medium.com; secure; httponly puid=; path=/; expires=Sun, 24 Nov 2019 22:20:26 GMT; domain=.medium.com; secure; httponly puid=; path=/; expires=Sun, 24 Nov 2019 22:20:26 GMT; secure; httponly puid=; path=/; expires=Sun, 24 Nov 2019 22:20:26 GMT; domain=.medium.com; secure; httponly __cfruid=72d3729cb5cb0724f92416b40dc9468a68bf454b-1574634027; path=/; domain=.medium.com; HttpOnly
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://medium.com https://*.medium.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-frame-options: sameorigin
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
x-powered-by: Medium
x-obvious-tid: 1574634027441:b34f2ec4f1ae
x-obvious-info: 39356-90650d8,90650d8d46c
link: <https://medium.com/humans.txt>; rel="humans"
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Thu, 09 Sep 1999 09:09:09 GMT
pragma: no-cache
location: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: DYNAMIC
alt-svc: h3-23=":443"; ma=86400
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 53aec52f0bf7cbb8-VIE

GET
H2 200 16180790160.js Show response
cdn.optimizely.com/js/ 262 KB
81 KB 37ms
18ms Script
text/javascript 2a02:26f0:6c00:196::13b8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.optimizely.com/js/16180790160.js

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:196::13b8 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

5dbe1e0a5c960eedcec434d7064aca36286e0e421d5eed38d64ceaaf45ba9360

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-meta-pci_enabled: False
x-amz-version-id: a_S.xRj9ObfJSNm8WY2.Dy2bMWPk.zL_
content-encoding: gzip
x-amz-request-id: 1CBCEFD7DA7C150C
status: 200
access-control-max-age: 86400
date: Sun, 24 Nov 2019 22:20:28 GMT
x-amz-replication-status: COMPLETED
server-timing: cdn;desc="AkamaiION";dur=0,rtt;desc="4";dur=0,cdnip;desc="2a02:26f0:6c00:196::13b8";dur=0,cdnmap;desc="";dur=0,proto;desc="h2";dur=0
strict-transport-security: max-age=15768000
content-length: 81836
x-amz-id-2: xVQpzrXS+H/Zd2HGIpB1ose0gHQQm+/JXuGGKTLdVpLMuyGbNvmAQ62qwS936aLDsdHKZcP+FRQ=
last-modified: Fri, 22 Nov 2019 00:00:28 GMT
server: AmazonS3
etag: "252c1f5e4e7b4a81f706912f94f78562"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-revision
cache-control: max-age=120
x-amz-meta-revision: 585
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 m2.css
glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/ 44 KB
29 KB 63ms
29ms Stylesheet
text/css 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

087a4c7aa118304c5ce85d5917d95a49b3c93204ef3500752dfde52595e4eac6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2141
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: text/css
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=14400, must-revalidate
access-control-allow-credentials: true
cf-ray: 53aec534ac958c98-VIE
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Sun, 24 Nov 2019 22:08:24 GMT

GET
H2 200 1*2OTOl_P7Uy_rM2jJNohW4g.png
miro.medium.com/max/458/ 20 KB
20 KB 71ms
40ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/458/1*2OTOl_P7Uy_rM2jJNohW4g.png

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

1b2611a82c2fe481a4f2ee2211a85e9ec5611c158b84a48969cfdededc141230

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11952
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3203-7aaf868
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 20654
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec534acd4cba4-VIE
expires: Fri, 11 Oct 2019 17:42:22 GMT

GET
H2 200 1*PQ-9Sp8tzyYriZ3cRPj97w.png
miro.medium.com/fit/c/96/96/ 2 KB
3 KB 67ms
36ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/96/96/1*PQ-9Sp8tzyYriZ3cRPj97w.png

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

9115a84ca8088a1a212f698bf61b75ad550b2ff55c6fe236364023875a939188

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11952
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3209-f49543a
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 2413
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec534acd7cba4-VIE
expires: Fri, 22 Nov 2019 23:08:48 GMT

GET
H2 200 0*xyQoevy-xkOVpNdC.jpg
miro.medium.com/max/60/ 752 B
820 B 130ms
128ms Image
image/jpeg 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/0*xyQoevy-xkOVpNdC.jpg?q=20

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

cb4d96376bbfaec73c2a56bb6a2a0c5286c6084b499cdf647e8af5ab76bd4f28

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3212-d7ac590
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 752
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec534dd76cba4-VIE
expires: Tue, 24 Dec 2019 19:44:39 GMT

GET
H2 200 0*WcbZgZRPxw3f2nt9.jpg
miro.medium.com/max/60/ 825 B
893 B 145ms
144ms Image
image/jpeg 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/0*WcbZgZRPxw3f2nt9.jpg?q=20

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

99e410c524c48211e6f6f093b820c1f6d67f6f477dac905d3b6845e8ad4d62b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3212-d7ac590
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 825
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec534dd77cba4-VIE
expires: Tue, 24 Dec 2019 19:44:39 GMT

GET
H2 200 0*7wlReCJJPesmThJt.jpg
miro.medium.com/max/60/ 754 B
869 B 127ms
125ms Image
image/jpeg 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/0*7wlReCJJPesmThJt.jpg?q=20

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

a47a925f013530c2242f6c15005110dfa4683381e9d0b95f8ee41377899a49fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3212-d7ac590
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 754
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec534dd78cba4-VIE
expires: Tue, 24 Dec 2019 19:44:39 GMT

GET
H2 422 0*VJe_tbSkYFuOgfTs.jpg
miro.medium.com/proxy/ 0
0 265ms
264ms Image
text/plain 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://miro.medium.com/proxy/0*VJe_tbSkYFuOgfTs.jpg
Requested by: Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

access-control-allow-origin: *

GET
H2 422 0*UCuLsOASvB7a7am9.jpg
miro.medium.com/proxy/ 0
0 169ms
168ms Image
text/plain 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://miro.medium.com/proxy/0*UCuLsOASvB7a7am9.jpg
Requested by: Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

access-control-allow-origin: *

GET
H2 200 1*szJmuvuUEcooa5U1qDS4mQ.png
miro.medium.com/max/60/ 1 KB
1 KB 127ms
126ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*szJmuvuUEcooa5U1qDS4mQ.png?q=20

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

9f043393f4dc0c75b93408fdd9fa366f80b1164f0f0083dc9e565aa70638e48b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 1049
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec534ed7dcba4-VIE
expires: Sun, 11 Aug 2019 18:57:19 UTC

GET
H2 200 1*qMdiEOoFlZudZRoRogjiNA.png
miro.medium.com/max/60/ 540 B
646 B 131ms
129ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*qMdiEOoFlZudZRoRogjiNA.png?q=20

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

dc4c3db334b59d535c34cdc7550801b4bca67f800a70432a9a248f7fac0e84ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3202-b3dbcc5
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 540
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec534ed7ecba4-VIE
expires: Thu, 10 Oct 2019 10:52:33 UTC

GET
H2 200 1*srtcom2Vj74SFFJ2MCtaNg.png
miro.medium.com/max/60/ 1 KB
1 KB 130ms
129ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*srtcom2Vj74SFFJ2MCtaNg.png?q=20

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

34b37e0f859b982708ccb00c0b323f2ca13bb3cb39ec13d9b357560691e37339

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3203-7aaf868
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 1143
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec534ed7fcba4-VIE
expires: Wed, 16 Oct 2019 13:10:40 UTC

GET
H2 200 1*PQ-9Sp8tzyYriZ3cRPj97w.png
miro.medium.com/fit/c/160/160/ 4 KB
4 KB 25ms
23ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/160/160/1*PQ-9Sp8tzyYriZ3cRPj97w.png

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

59b2a8e5fc8513f64a07e951983cc598161ff6b40a0e87263e4ea98d869d9865

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11952
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 4310
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec534ed82cba4-VIE
expires: Tue, 30 Jul 2019 04:58:06 GMT

GET
H2 200 manifest.2e49f3a9.js Show response
cdn-client.medium.com/lite/static/js/ 4 KB
2 KB 41ms
27ms Script
application/javascript 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/manifest.2e49f3a9.js

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

15fe136a1efa833398804110b2dfcfc355b09307d11ba0595065be750643d485

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 275610
cf-ray: 53aec534fcc18c98-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: 5F283DE5D3CE71C6
x-amz-id-2: f+T95Q3hA6CuWrw/T9BsUMQEgXvaN4OYlfG4d/Z/xMabkt1LHUMRmpYAm26LNs7E/k1pcmT8Uto=
last-modified: Thu, 21 Nov 2019 17:32:16 GMT
server: cloudflare
etag: W/"d3e0069887c488a678da9f00c86ed6fa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: Udd_YmefFMcpBGz6frD3K8zY5yze1T5E
vary: Accept-Encoding
cache-control: max-age=31536000
content-type: application/javascript

GET
H2 200 vendors~main.8289b224.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 756 KB
197 KB 52ms
38ms Script
application/javascript 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~main.8289b224.chunk.js

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c897464fbe688db9f6bc935e02e1984f66da5e0408121437015b2c8b453fdda

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 434450
cf-ray: 53aec534fcc38c98-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: 32944BD036D13D02
x-amz-id-2: nt3JoTSQ0NlvIbiMDh8qOLehhuHYK72SQq8DHk8zDo4baLHP0a8jL1CTAWe3RQW9W6WCJQakyzM=
last-modified: Tue, 19 Nov 2019 21:30:17 GMT
server: cloudflare
etag: W/"9365c66e707cef85fc2028e4bc2f4ef8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: AbT6aPWdfov5vhkh.ng.081qNcYfAzb3
vary: Accept-Encoding
cache-control: max-age=31536000
content-type: application/javascript

GET
H2 200 main.6045f352.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 411 KB
95 KB 40ms
26ms Script
application/javascript 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/main.6045f352.chunk.js

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2eb4106035210c77653a76bef9ff9759733b91fd1fde38acf2bec8679b392f2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 275610
cf-ray: 53aec534fcc88c98-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: 374A03D513780645
x-amz-id-2: vQ0rxJ3AEQyYDkdU9oWXUCwRT7k3LOpAb7Ux16BglBvNes+l0AH7LWqe462L/8ic+6iH6Q/mE2E=
last-modified: Thu, 21 Nov 2019 17:32:15 GMT
server: cloudflare
etag: W/"c8daad695f35f73bed350c2d37af9344"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: 0B.4OIPObppkc7Apy9IRnK9EWeJtF_td
vary: Accept-Encoding
cache-control: max-age=31536000
content-type: application/javascript

GET
H2 200 vendors~screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~scre~3e410f11.6e718f1d.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 34 KB
15 KB 51ms
37ms Script
application/javascript 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~scre~3e410f11.6e718f1d.chunk.js

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe8d2885e087ad5084fbf1ffb099334d9237ca321826c32453faaac1db174883

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1136452
cf-ray: 53aec534fcc78c98-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: FBC9F61AFB06C804
x-amz-id-2: ZFeFAiQpwnlsl0GPMp9ihF9/SuM/WDeMN0vBSdOK48Xb3BCpkVGvBPC52v4SQc85F2D+y5lIJNY=
last-modified: Mon, 28 Oct 2019 18:36:52 GMT
server: cloudflare
etag: W/"d8bc59018324ced37b32587074df59a2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: 7Rk7JBCnd4gxXreF2HH_vTNi7zNQVCDl
vary: Accept-Encoding
cache-control: max-age=31536000
content-type: application/javascript

GET
H2 200 screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~73c4bb05.09146537.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 134 KB
35 KB 43ms
30ms Script
application/javascript 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~73c4bb05.09146537.chunk.js

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d6957efe0d7f1be6602c8635ec059ec3d40b5d9dd9b0743a19f3045a6312c52

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 278764
cf-ray: 53aec534fcc68c98-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: 202CCF575BEF08A2
x-amz-id-2: NC7m4Eb2muFHFDgd7PtVM3mIw6j/gV9pUN9RVAHEitqHnlP9vlzEx1kuh8eox6kpr1WJe3LD6p0=
last-modified: Thu, 21 Nov 2019 16:44:28 GMT
server: cloudflare
etag: W/"d49dc5594ec4457d4fb5151f2d8057df"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: u9sKSEdhJa5RPyrySvUSP9g_ehla.4zl
vary: Accept-Encoding
cache-control: max-age=31536000
content-type: application/javascript

GET
H2 200 screen.post~screen.post.amp~screen.post.series~screen.profile~screen.sequence.library~screen.sequenc~036c6b37.5b1f9621.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 49 KB
14 KB 42ms
29ms Script
application/javascript 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.post~screen.post.amp~screen.post.series~screen.profile~screen.sequence.library~screen.sequenc~036c6b37.5b1f9621.chunk.js

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f14d4838dddcbaa52775086da3171b0415acfbde9ab55d023a39e438fb0228a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 278764
cf-ray: 53aec534fcc48c98-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: CD4D124F1FB9787E
x-amz-id-2: omSoBmz9HotsJR6EMX1UPoatAx3nXG31g47CXGDJveaihXMxXCiKjw2OfrTy5L6LgvFvtmyTg/k=
last-modified: Thu, 21 Nov 2019 16:44:31 GMT
server: cloudflare
etag: W/"c7ae9e898abeb6a0eadc11ba6552137b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: TTgegePN41K451GCOlngZCChhKLhFwr_
vary: Accept-Encoding
cache-control: max-age=31536000
content-type: application/javascript

GET
H2 200 screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tick~screen.landingp~ed90ee39.40edb6c7.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 18 KB
5 KB 22ms
21ms Script
application/javascript 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tick~screen.landingp~ed90ee39.40edb6c7.chunk.js

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

30824c7fc6eeb6dce4a0bdb4f99dd3dc748f84e82bb0e1a61c46ac0c45495785

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 275610
cf-ray: 53aec5351ce28c98-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: CC6E651CBCAFB777
x-amz-id-2: k+sRZGYCt5Xad2UxbjOQe6QzMkqne9uAcospPINo6QZWmf+ro3OWdiw5ReS49rtFhamGWG3r96g=
last-modified: Thu, 21 Nov 2019 17:32:18 GMT
server: cloudflare
etag: W/"546d38a4c8d65dfe442526278071c655"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: 6lQOMFmRQEOv.OBnvJWn_jOyS9XOTIxF
vary: Accept-Encoding
cache-control: max-age=31536000
content-type: application/javascript

GET
H2 200 screen.post.2745e55e.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 228 KB
54 KB 25ms
25ms Script
application/javascript 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.post.2745e55e.chunk.js

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8d260a7ba17ff91ea4dec83e8e044c4dd0121e037b791370b552022b42e59dc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 275610
cf-ray: 53aec5352ce58c98-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: 9E55714F26019FB3
x-amz-id-2: HGNZbiIJrdarlqAIR5JLKjR+H2RJWKnSgJaZ/KkrmQ1xIZtqMTkNSMQFNjFX9zTiyhpyopr7o7M=
last-modified: Thu, 21 Nov 2019 17:32:20 GMT
server: cloudflare
etag: W/"c089b36279c0053995165f7e0ff6459e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: Lt2XZryWrwsIC.58O.wP873rVtAyYTIo
vary: Accept-Encoding
cache-control: max-age=31536000
content-type: application/javascript

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 6411
date: Sun, 24 Nov 2019 20:33:37 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Sun, 24 Nov 2019 22:33:37 GMT

GET
DATA 200
OK truncated
/ 156 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4c0cc04185396c9a83cfda3644c23327d7d8ff9247157c438575b83713894173

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 9 KB
9 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99c5448d6c84fc71d6805e2485727db250113edcaea123a064f8c26ce95947d8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin: https://blog.newskysecurity.com

Response headers

Content-Type: font/opentype

GET
H2 200 fell-400-normal.woff
glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 14 KB
14 KB 61ms
32ms Font
application/font-woff 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/fell-400-normal.woff

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://blog.newskysecurity.com

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11952
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000, must-revalidate
access-control-allow-credentials: true
cf-ray: 53aec53519968cc2-VIE
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 15 Sep 2020 10:51:42 GMT

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin: https://blog.newskysecurity.com

Response headers

Content-Type: font/opentype

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1ed6a034a5055a869c7c25765ee1f2844a27a54e83e8a857d77b3f1cd83dd3

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin: https://blog.newskysecurity.com

Response headers

Content-Type: font/opentype

GET
H2 200 marat-sans-400-normal.woff
glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 14 KB
15 KB 48ms
26ms Font
application/font-woff 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/marat-sans-400-normal.woff

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://blog.newskysecurity.com

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 75710
status: 200
strict-transport-security: max-age=15552000; includeSubDomains; preload
alt-svc: h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000, must-revalidate
access-control-allow-credentials: true
cf-ray: 53aec53519978cc2-VIE
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Fri, 31 Jul 2020 13:12:07 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
101 B 13ms
13ms Image
image/gif 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=143171731&t=pageview&_s=1&dl=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed%3Fgi%3D213586328421&ul=en-us&de=UTF-8&dt=How%20Android%20ransomware%20bricked%20my%20TV%20-%20NewSky%20Security&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=1358656665&gjid=335297687&cid=1366721373.1574634028&tid=UA-24232453-2&_gid=272447364.1574634028&_r=1&z=1750397531

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Nov 2019 22:20:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 client-ready Show response
blog.newskysecurity.com/_/lite/performance/ 2 B
244 B 91ms
91ms Fetch
text/plain 52.4.145.119
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.newskysecurity.com/_/lite/performance/client-ready

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.6045f352.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.145.119 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-4-145-119.compute-1.amazonaws.com

Software

nginx /

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
Origin: https://blog.newskysecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
sepia-upstream: production
server: nginx
x-frame-options: allow-from medium.com
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
status: 200
medium-fulfilled-by: lite/master-20191121-172537-39186d1762
x-envoy-upstream-service-time: 1
content-length: 2

GET
H2 200 vendors~tracing.28033849.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 62 KB
16 KB 24ms
24ms Script
application/javascript 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~tracing.28033849.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.2e49f3a9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c9e2c034706eef3ebf43d927f9219126e167a78c4d86b4994a06243800734056

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 779142
cf-ray: 53aec5369da98c98-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: 19FBDD52FC2B1B71
x-amz-id-2: 6Lmk4l15XY3Q6wH8U9IM6/r6WDVBEFBSESCMeSD3rf+jx02kBdNfn7QLB48/uIeOXP2J8xG2LLc=
last-modified: Fri, 08 Nov 2019 07:05:09 GMT
server: cloudflare
etag: W/"902dcde18806a1e2b120b8bfe25956dd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: uf_5rP058D6ePXUmqt1hAY3KIVOcMw0H
vary: Accept-Encoding
cache-control: max-age=31536000
content-type: application/javascript

GET
H2 200 tracing.a9025c45.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 2 KB
1 KB 22ms
21ms Script
application/javascript 2606:4700::6810:7591
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/tracing.a9025c45.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.2e49f3a9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

efcb4fd67352b26e679f0657831686822630c2b9ef81031b1979dd3da8af76b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 779142
cf-ray: 53aec5369daa8c98-VIE
status: 200
alt-svc: h3-23=":443"; ma=86400
x-amz-request-id: 235FCFA356E8D201
x-amz-id-2: Mx4flrYXzEsTrvoYqLQH/U0y/hJp/ktm4hxNgsHak20Z0/kHTbvt/wdrty3asbVxSYh2kcC7fAk=
last-modified: Fri, 01 Nov 2019 21:45:25 GMT
server: cloudflare
etag: W/"7331a559d848298f31b75d6d2ac6a533"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: _zQqAJLuZIJOmMTEGNCl2ltzatNWz..c
vary: Accept-Encoding
cache-control: max-age=31536000
content-type: application/javascript

POST
H2 200 graphql Show response
blog.newskysecurity.com/_/ 94 B
648 B 788ms
788ms Fetch
application/json 52.4.145.119
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.newskysecurity.com/_/graphql
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.8289b224.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.4.145.119 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-4-145-119.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1e38dcee0f7899544d8532a1246648974a0a2aa112a5d6673ef4f55d7f2418b4

Request headers

apollographql-client-name: lite
Medium-Frontend-Route: post
Origin: https://blog.newskysecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Graphql-Operation: InteractivePostBodyQuery
content-type: application/json
accept: */*
Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
Medium-Frontend-App: lite/master-20191121-172537-39186d1762
apollographql-client-version: master-20191121-172537-39186d1762

Response headers

date: Sun, 24 Nov 2019 22:20:29 GMT
sepia-upstream: production
server: nginx
etag: W/"5e-aLeKvHigLrfbJ5RvVnTUV3T3lvQ"
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: rito/master-20191121-195510-83abb6152d, tutu/medium-39343
x-envoy-upstream-service-time: 699
content-length: 94
x-request-received-at: 1574634028753

POST
H2 200 graphql Show response
blog.newskysecurity.com/_/ 4 KB
2 KB 1484ms
1484ms Fetch
application/json 52.4.145.119
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.newskysecurity.com/_/graphql
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.8289b224.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.4.145.119 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-4-145-119.compute-1.amazonaws.com
Software: nginx /
Resource Hash: f513d21f19099036ea828f63da75ca33aa298bd996a115a0951cae5c3b93ffcf

Request headers

apollographql-client-name: lite
Medium-Frontend-Route: post
Origin: https://blog.newskysecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Graphql-Operation: PostRecircQuery
content-type: application/json
accept: */*
Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
Medium-Frontend-App: lite/master-20191121-172537-39186d1762
apollographql-client-version: master-20191121-172537-39186d1762

Response headers

date: Sun, 24 Nov 2019 22:20:30 GMT
content-encoding: gzip
sepia-upstream: production
server: nginx
etag: W/"fc9-sJg353esQSG9MDFpDtoUen/v9sI"
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: rito/master-20191121-195510-83abb6152d, tutu/medium-39343
x-envoy-upstream-service-time: 1392
x-request-received-at: 1574634028843

GET
H/1.1 200
OK p.js Show response
d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/ 41 KB
17 KB 21ms
7ms Script
application/x-javascript 13.225.84.38
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.6045f352.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.84.38 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-225-84-38.fra2.r.cloudfront.net
Software: nginx /
Resource Hash: 58711bafae315df048e1bc0c36ae1dfd017810b34fd9b4b021f774694397baad

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 24 Nov 2019 18:19:24 GMT
Content-Encoding: gzip
Age: 14483
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Pragma: public
Last-Modified: Mon, 07 Oct 2019 18:17:48 GMT
Server: nginx
ETag: "5d9b814c-a469"
Content-Type: application/x-javascript
Via: 1.1 04ce5a607a98db6d08257633417b84d7.cloudfront.net (CloudFront)
Cache-Control: max-age=86400, public
X-Amz-Cf-Pop: FRA2-C2
X-Amz-Cf-Id: aBd4rd5hCLrAB4Cj8Qu2-DKBGFbtpo6jSs2U44iF8UOm7-6WcxORbA==
Expires: Mon, 25 Nov 2019 18:19:04 GMT

GET
H2 200 1*2OTOl_P7Uy_rM2jJNohW4g.png
miro.medium.com/max/229/ 7 KB
7 KB 210ms
209ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/229/1*2OTOl_P7Uy_rM2jJNohW4g.png

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

ec9ec3e6efb3c46386c3aea007961218fd90c5d04b65969f90db72330fc3a496

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:29 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3210-6a9380d
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 7134
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec5388e70cba4-VIE
expires: Sat, 14 Dec 2019 04:31:03 GMT

GET
H2 200 1*PQ-9Sp8tzyYriZ3cRPj97w.png
miro.medium.com/fit/c/48/48/ 1 KB
1 KB 124ms
122ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/48/48/1*PQ-9Sp8tzyYriZ3cRPj97w.png

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

5d9a40a2f5f0ad34463171c4e28b1ce6bc3d757754c48080b310cbc77b7a427a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 1188
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec5388e72cba4-VIE
expires: Sun, 11 Aug 2019 18:29:09 UTC

GET
H2 200 0*xyQoevy-xkOVpNdC.jpg
miro.medium.com/max/30/ 635 B
703 B 187ms
186ms Image
image/jpeg 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/0*xyQoevy-xkOVpNdC.jpg?q=20

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

73f8773990dc895d5dff6d640d9694f441544885704ffbe69c93e53b83e48829

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:29 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3212-d7ac590
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 635
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec5388e75cba4-VIE
expires: Tue, 24 Dec 2019 22:20:28 UTC

GET
H2 200 0*WcbZgZRPxw3f2nt9.jpg
miro.medium.com/max/30/ 693 B
761 B 184ms
183ms Image
image/jpeg 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/0*WcbZgZRPxw3f2nt9.jpg?q=20

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

e4b1c4e363400111e6bfbd2a8a8277b37e26ca4d945e5eee5ec06b7bc519b6af

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:29 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3212-d7ac590
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 693
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec5388e77cba4-VIE
expires: Tue, 24 Dec 2019 22:20:28 UTC

GET
H2 200 0*7wlReCJJPesmThJt.jpg
miro.medium.com/max/30/ 642 B
742 B 160ms
159ms Image
image/jpeg 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/0*7wlReCJJPesmThJt.jpg?q=20

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

1c34bdda7680836139ae21f9936df0b556b415190a675e484431ae683b68eaa8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:29 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3212-d7ac590
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 642
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec5388e78cba4-VIE
expires: Tue, 24 Dec 2019 22:20:28 UTC

GET
H2 200 1*szJmuvuUEcooa5U1qDS4mQ.png
miro.medium.com/max/30/ 428 B
519 B 128ms
127ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/1*szJmuvuUEcooa5U1qDS4mQ.png?q=20

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

b6a3f3500e1ec3ff7ea99c3e0213e95e116cb63cb253735889a86282614731bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3202-b3dbcc5
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 428
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec5388e79cba4-VIE
expires: Fri, 27 Sep 2019 18:01:54 UTC

GET
H2 200 1*qMdiEOoFlZudZRoRogjiNA.png
miro.medium.com/max/30/ 264 B
393 B 132ms
131ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/1*qMdiEOoFlZudZRoRogjiNA.png?q=20

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

92431bcfa6a4c1f515f445625607d7e770ca581ce7e48b15e8da99413305eb1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:29 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3211-b7baa0c
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 264
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec5388e7bcba4-VIE
expires: Fri, 20 Dec 2019 01:45:27 GMT

GET
H2 200 1*srtcom2Vj74SFFJ2MCtaNg.png
miro.medium.com/max/30/ 503 B
594 B 129ms
128ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/1*srtcom2Vj74SFFJ2MCtaNg.png?q=20

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

fad6cb58380bf8cc8491322e6ad936057ad520aabc9b06149f343c38f07bb9da

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3212-d7ac590
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 503
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec5388e7ccba4-VIE
expires: Sun, 22 Dec 2019 22:12:23 GMT

GET
H2 200 1*PQ-9Sp8tzyYriZ3cRPj97w.png
miro.medium.com/fit/c/80/80/ 2 KB
2 KB 126ms
126ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/80/80/1*PQ-9Sp8tzyYriZ3cRPj97w.png

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

572866309262ab9b9169dfa16aa511a8698028d1bc339425bb101d708454cf4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:28 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3209-f49543a
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 2016
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec5388e7dcba4-VIE
expires: Sat, 30 Nov 2019 06:39:14 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
101 B 14ms
14ms Image
image/gif 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=143171731&t=pageview&_s=1&dl=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&ul=en-us&de=UTF-8&dt=How%20Android%20ransomware%20bricked%20my%20TV%20-%20NewSky%20Security&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=KEDAAEAB~&jid=1556565905&gjid=1300094915&cid=1366721373.1574634028&tid=UA-86413490-1&_gid=272447364.1574634028&_r=1&z=84704186

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 24 Nov 2019 22:20:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK branch-latest.min.js Show response
cdn.branch.io/ 72 KB
22 KB 22ms
7ms Script
text/javascript 143.204.101.37
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.branch.io/branch-latest.min.js
Requested by: Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.101.37 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-101-37.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9e013976876f923b5d747b79501cd38255f1876399c5e9b5a8f995dec0291ab7

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: z8HvpISR3mptTBbKeuNdWa0yABs8A72w
Content-Encoding: gzip
Last-Modified: Tue, 29 Oct 2019 00:06:03 GMT
Server: AmazonS3
Age: 165
ETag: "18c281260fef78c97f0b9613cfd9df40"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 6ea9fcffa719a56ee2be748a73d37974.cloudfront.net (CloudFront)
Cache-Control: max-age=300
Date: Sun, 24 Nov 2019 22:17:43 GMT
X-Amz-Cf-Pop: FRA50-C1
Connection: keep-alive
Content-Length: 21884
X-Amz-Cf-Id: yNiEcFy_bMSTDeaeCgOFQOZbcTzHgf4SIA0axNeeHI_nEh2AJ4o_Kg==

GET
H2 200 0*xyQoevy-xkOVpNdC.jpg
miro.medium.com/max/1620/ 167 KB
167 KB 172ms
172ms Image
image/jpeg 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/1620/0*xyQoevy-xkOVpNdC.jpg

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

f93efdea8f2745958579dbe1c8479b25440d1732a250cb9623b05170f729eadf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:29 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3212-d7ac590
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 170605
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec538bee0cba4-VIE
expires: Tue, 24 Dec 2019 16:04:55 GMT

GET
H2 200 0*WcbZgZRPxw3f2nt9.jpg
miro.medium.com/max/1620/ 236 KB
237 KB 136ms
136ms Image
image/jpeg 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/1620/0*WcbZgZRPxw3f2nt9.jpg

Requested by

Host: blog.newskysecurity.com
URL: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

3abc93519a1879fbd49bccc6a16286b350e24d9e826b006ebaa1f83578683788

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:29 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3212-d7ac590
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 241580
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec538bee2cba4-VIE
expires: Tue, 24 Dec 2019 16:05:10 GMT

GET
H/1.1 200
OK _r Show response
app.link/ 90 B
728 B 179ms
157ms Script
text/javascript 2600:9000:21f3:c800:19:9934:6a80:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://app.link/_r?sdk=web2.52.2&branch_key=key_live_ofxXr2qTrrU9NqURK8ZwEhknBxiI6KBm&callback=branch_callback__0

Requested by

Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:21f3:c800:19:9934:6a80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

openresty/1.13.6.2 / Express

Resource Hash

5f753d81efb8d7bd5bd28327d7ca113ea4ef2c6ded99b2d408d6b4876c0bd96b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 24 Nov 2019 22:20:29 GMT
Via: 1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Server: openresty/1.13.6.2
X-Amz-Cf-Pop: FRA2-C2
X-Powered-By: Express
X-Cache: Miss from cloudfront
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
Content-Length: 90
ETag: W/"5a-i7625HsAaj3nKK54NPNld85qVmY"
X-Amz-Cf-Id: K2oNZdUlvAulxLSSc8zoq9gaCrlC3Zz6RPODn7vQiClbnUxoo_82bw==

GET
H/1.1 200
OK / Show response
srv-2019-11-24-22.pixel.parsely.com/start/ 77 B
380 B 357ms
87ms Script
application/json 3.214.164.119
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://srv-2019-11-24-22.pixel.parsely.com/start/?rand=1574634028926&plid=36111358&idsite=medium.com&url=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22viewerStatus%22%3A%22visitor%22%7D&sid=1&surl=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&sref=&sts=1574634028920&slts=0&title=How+Android+ransomware+bricked+my+TV+-+NewSky+Security&date=Sun+Nov+24+2019+23%3A20%3A28+GMT%2B0100+(Central+European+Standard+Time)&action=pageview&js=1&pvid=60183672&callback=parselyStartCallback
Requested by: Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.164.119 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-214-164-119.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 15dc5b38ec7a6acf2d5b72ee3dff925c3093234c3aecd1d17bee4c303def67dd

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 24 Nov 2019 22:20:29 GMT
Server: nginx
Connection: keep-alive
Content-Type: application/json
Content-Length: 77
P3P: CP="CUR ADM OUR NOR STA NID"

POST
H2 200 open Show response
api2.branch.io/v1/ 312 B
598 B 299ms
170ms XHR
application/json 2600:9000:2043:ee00:11:f728:3040:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/open
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.8289b224.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2043:ee00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: openresty/1.13.6.2 /
Resource Hash: df0aed57cbe1f70d5a729c33e9fc58f1649b3b477c280983af8e5e6af9922651

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
Origin: https://blog.newskysecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sun, 24 Nov 2019 22:20:29 GMT
via: 1.1 d79148f01e44f5598c15bdd5ce1c1997.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA54
status: 200
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache
content-length: 312
x-amz-cf-id: Po_pvgKUM-yTanSuxLmekxnkV6DkNTx2BP4XgvSOuU1I7kDq02_ADA==

OPTIONS
H/1.1 200
OK log Show response
errors.client.optimizely.com/ 13 B
415 B 371ms
87ms XHR
text/plain 3.225.17.244
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://errors.client.optimizely.com/log
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.8289b224.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.225.17.244 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-225-17-244.compute-1.amazonaws.com
Software: /
Resource Hash: 16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.newskysecurity.com
Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

Date: Sun, 24 Nov 2019 22:20:29 GMT
Allow: POST,OPTIONS
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://blog.newskysecurity.com
Access-Control-Max-Age: 1800
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Accept,Origin
Content-Length: 13

POST
H2 200 render Show response
blog.newskysecurity.com/_/lite/performance/ 2 B
244 B 91ms
90ms Fetch
text/plain 52.4.145.119
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.newskysecurity.com/_/lite/performance/render

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.6045f352.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.145.119 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-4-145-119.compute-1.amazonaws.com

Software

nginx /

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
Origin: https://blog.newskysecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 24 Nov 2019 22:20:29 GMT
sepia-upstream: production
server: nginx
x-frame-options: allow-from medium.com
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
status: 200
medium-fulfilled-by: lite/master-20191121-172537-39186d1762
x-envoy-upstream-service-time: 1
content-length: 2

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
359 B 314ms
314ms XHR
application/json 2600:9000:2043:ee00:11:f728:3040:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.8289b224.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2043:ee00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
Origin: https://blog.newskysecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sun, 24 Nov 2019 22:20:29 GMT
via: 1.1 d79148f01e44f5598c15bdd5ce1c1997.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA54
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: yL4aX-dQzncjAuZTUYVziT6s2vszBZPHdA41X4_FWn7U2qjnZ--smw==

POST
H/1.1 204
No Content log Show response
errors.client.optimizely.com/ 0
249 B 87ms
87ms XHR
text/plain 3.225.17.244
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://errors.client.optimizely.com/log
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.225.17.244 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-225-17-244.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
Origin: https://blog.newskysecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

Access-Control-Allow-Origin: https://blog.newskysecurity.com
Access-Control-Expose-Headers
Access-Control-Allow-Credentials: true
Connection: keep-alive
Date: Sun, 24 Nov 2019 22:20:29 GMT
Content-Type: text/plain

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
360 B 170ms
170ms XHR
application/json 2600:9000:2043:ee00:11:f728:3040:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.8289b224.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2043:ee00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
Origin: https://blog.newskysecurity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sun, 24 Nov 2019 22:20:29 GMT
via: 1.1 d79148f01e44f5598c15bdd5ce1c1997.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA54
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: AQ-vHNDeU3_LoEbG8lW-uQr9bVy3KmOwJjgZSKpkTk-hUuX8Ir5b7Q==

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 275ms
87ms XHR
text/plain 34.192.124.59
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.8289b224.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.124.59 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-192-124-59.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.newskysecurity.com
Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Sun, 24 Nov 2019 22:20:30 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

GET
H2 200 1*Vj_Xuu3XPiFE5CkH2sEo5Q.png
miro.medium.com/fit/c/40/40/ 3 KB
3 KB 26ms
26ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/40/40/1*Vj_Xuu3XPiFE5CkH2sEo5Q.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

e3ca6ca0a4ecc33b42d48d490350cacc7d1c1d3d57b75cd46417300551dd0945

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:30 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 804579
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 3110
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec541ac5ecba4-VIE
expires: Sat, 20 Apr 2019 07:28:43 GMT

GET
H2 200 2*D4KAER7h6bCkTU-m7Aw9DA.jpeg
miro.medium.com/fit/c/40/40/ 2 KB
2 KB 26ms
26ms Image
image/jpeg 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/40/40/2*D4KAER7h6bCkTU-m7Aw9DA.jpeg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

5d794957e7ad5110160e8964aca8d60c2b8d6a7b0729da0167d523eca7623245

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:30 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 578195
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3197-fb89d63
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 1899
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec541ac60cba4-VIE
expires: Thu, 10 Oct 2019 07:56:51 GMT

GET
H2 200 1*nIU0Xxx3OVRlJ0yxBN9zYA.jpeg
miro.medium.com/fit/c/40/40/ 1 KB
2 KB 25ms
25ms Image
image/jpeg 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/40/40/1*nIU0Xxx3OVRlJ0yxBN9zYA.jpeg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

9f7459fc88eff85487b8c94b9d39501c919c16d138d3a372e422e597e03f1a4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:30 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1523487
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3192-d9ea9bb
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 1480
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec541ac63cba4-VIE
expires: Wed, 16 Oct 2019 09:06:57 GMT

GET
H2 200 1*PwZsd2suQER-gRfM0g5w0w.png
miro.medium.com/max/328/ 25 KB
25 KB 24ms
23ms Image
image/png 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/328/1*PwZsd2suQER-gRfM0g5w0w.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

31fb4941e4b177813cbd6114d07c26d979098bde19b9f25c340a773c5d4eb452

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:30 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 529316
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3210-6a9380d
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 25663
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec541ac6bcba4-VIE
expires: Wed, 18 Dec 2019 16:00:02 GMT

GET
H2 200 1*ZvfNQBL7fIZ2e8azlDh2IA.jpeg
miro.medium.com/max/328/ 29 KB
29 KB 24ms
24ms Image
image/jpeg 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/328/1*ZvfNQBL7fIZ2e8azlDh2IA.jpeg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

332eed0b73c2667d8b8125007d412e8a32bdeab5ad55bbadc70a3d1e9e1306c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:30 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 232883
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3212-d7ac590
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 29686
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000, must-revalidate
accept-ranges: bytes
cf-ray: 53aec541ac6dcba4-VIE
expires: Sat, 21 Dec 2019 18:08:33 GMT

GET
H2 200 0*wZepB5I0F2uTIZ6D
miro.medium.com/max/328/ 28 KB
28 KB 145ms
145ms Image
image/jpeg 2606:4700::6810:7691
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/328/0*wZepB5I0F2uTIZ6D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

a342fa598720095ce23df10f067a3018b78bb2adf303b041e181c0ce08630daa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed?gi=213586328421
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 24 Nov 2019 22:20:30 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3212-d7ac590
status: 200
alt-svc: h3-23=":443"; ma=86400
content-length: 28651
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 53aec541ac6ecba4-VIE
expires: Tue, 24 Dec 2019 22:20:30 UTC

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 88ms
87ms XHR
application/json 34.192.124.59
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.124.59 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-192-124-59.compute-1.amazonaws.com
Software: /
Resource Hash: 876abfa02324fa163045b98d8461c9b7f21a8430231f3c86463373f09bda543e

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
Origin: https://blog.newskysecurity.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Sun, 24 Nov 2019 22:20:30 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 99ms
99ms XHR
text/plain 34.192.124.59
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.8289b224.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.124.59 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-192-124-59.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.newskysecurity.com
Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Sun, 24 Nov 2019 22:20:30 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 87ms
87ms XHR
application/json 34.192.124.59
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.124.59 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-192-124-59.compute-1.amazonaws.com
Software: /
Resource Hash: 200a1110634c75fba64b8951b5e5e37d4205b12ea63eaaece1f097a9d8ebabcc

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
Origin: https://blog.newskysecurity.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Sun, 24 Nov 2019 22:20:30 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 87ms
87ms XHR
text/plain 34.192.124.59
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.8289b224.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.124.59 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-192-124-59.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.newskysecurity.com
Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Sun, 24 Nov 2019 22:20:31 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 87ms
87ms XHR
application/json 34.192.124.59
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.124.59 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-192-124-59.compute-1.amazonaws.com
Software: /
Resource Hash: ce1984380883d201feb7df1ac6464b3a7aa780f271107645d932e984ac131408

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
Origin: https://blog.newskysecurity.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Sun, 24 Nov 2019 22:20:31 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 88ms
87ms XHR
text/plain 34.192.124.59
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.8289b224.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.124.59 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-192-124-59.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.newskysecurity.com
Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Sun, 24 Nov 2019 22:20:31 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 93ms
93ms XHR
application/json 34.192.124.59
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.124.59 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-192-124-59.compute-1.amazonaws.com
Software: /
Resource Hash: a5f267fc508b4156c5dd84139b7627f10cce7b434ec4d933d580deec8ccc8b81

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
Origin: https://blog.newskysecurity.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Sun, 24 Nov 2019 22:20:31 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

POST
H2 409 batch
blog.newskysecurity.com/_/ 10 KB
0 1523ms
1523ms Fetch
text/html 52.4.145.119
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.newskysecurity.com/_/batch

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.6045f352.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.145.119 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-4-145-119.compute-1.amazonaws.com

Software

nginx / Medium

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src https://localhost https://.instapaper.com https://.stripe.com https://glyph.medium.com https://.paypal.com https://getpocket.com https://blog.newskysecurity.com https://.blog.newskysecurity.com https://.medium.com https://medium.com https://.medium.com https://.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://.lightstep.com https://.branch.io 'self'; font-src data: https://.amazonaws.com https://.medium.com https://glyph.medium.com https://medium.com https://.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
X-Content-Type-Options	nosniff
X-Frame-Options
X-Xss-Protection	1; mode=block

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
Origin: https://blog.newskysecurity.com
x-xsrf-token: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
content-type: application/json

Response headers

content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://blog.newskysecurity.com https://*.blog.newskysecurity.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 39356-90650d8,90650d8d46c
status: 409
content-length: 10152
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
pragma: no-cache
x-obvious-tid: 1574634034824:25914d5eb7f4
server: nginx
date: Sun, 24 Nov 2019 22:20:35 GMT
x-frame-options
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
link: <https://medium.com/humans.txt>; rel="humans"
expires: Thu, 09 Sep 1999 09:09:09 GMT

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 89ms
88ms XHR
text/plain 34.192.124.59
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.8289b224.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.124.59 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-192-124-59.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://blog.newskysecurity.com
Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Sun, 24 Nov 2019 22:20:34 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 88ms
87ms XHR
application/json 34.192.124.59
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.124.59 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-192-124-59.compute-1.amazonaws.com
Software: /
Resource Hash: 2cbcd5463e4a2f5a359297b9ffa65eab53fc48f8b46bbe01ad4dd05b6f64b09b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
Origin: https://blog.newskysecurity.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Sun, 24 Nov 2019 22:20:34 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

GET
H/1.1 200
OK /
srv-2019-11-24-22.pixel.parsely.com/event/ 43 B
385 B 87ms
87ms Image
image/gif 3.214.164.119
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://srv-2019-11-24-22.pixel.parsely.com/event/?rand=1574634039423&plid=36111358&idsite=medium.com&url=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fblog.newskysecurity.com%2Fhow-android-ransomware-bricked-my-tv-eff485c665ed&sref=&sts=1574634039423&slts=0&date=Sun+Nov+24+2019+23%3A20%3A39+GMT%2B0100+(Central+European+Standard+Time)&action=heartbeat&inc=5&tt=4900&pvid=60183672&u=pid%3D4529aa20ad438275ef80a39aa0c1b230
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.164.119 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-214-164-119.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sun, 24 Nov 2019 22:20:39 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="CUR ADM OUR NOR STA NID"

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
blog.newskysecurity.com/	1970-01-19 05:33:58	Name: lightstep_guid/lite-web Value: 1ebad83b40cf5e5f
.newskysecurity.com/	1970-01-19 05:23:54	Name: _gat_tracker0 Value: 1
blog.newskysecurity.com/	1970-01-19 05:33:58	Name: lightstep_session_id Value: 48390bd524c1965a
.newskysecurity.com/	1970-01-19 05:23:54	Name: _gat Value: 1
blog.newskysecurity.com/	1970-01-19 14:09:30	Name: sid Value: 1:i2k5MqNP4VfW0wNB90ji6+0dx49EL9rNzy8XUI4RGXFSoeZAux+OeTT82KY3JZDsbaEF3Ssi7naiS+EC1I28Gw==
.newskysecurity.com/	1970-01-19 05:25:20	Name: _gid Value: GA1.2.272447364.1574634028
.newskysecurity.com/	1970-01-19 14:53:18	Name: _parsely_visitor Value: {%22id%22:%22pid=4529aa20ad438275ef80a39aa0c1b230%22%2C%22session_count%22:1%2C%22last_session_ts%22:1574634028920}
.newskysecurity.com/	1970-01-19 22:55:06	Name: _ga Value: GA1.2.1366721373.1574634028
.newskysecurity.com/	1970-01-19 05:23:55	Name: _parsely_session Value: {%22sid%22:1%2C%22surl%22:%22https://blog.newskysecurity.com/how-android-ransomware-bricked-my-tv-eff485c665ed%22%2C%22sref%22:%22%22%2C%22sts%22:1574634028920%2C%22slts%22:0}
blog.newskysecurity.com/	1970-01-19 14:09:30	Name: uid Value: lo_gRp9Q3nDxQkb
blog.newskysecurity.com/	1970-01-19 14:09:30	Name: optimizelyEndUserId Value: lo_gRp9Q3nDxQkb

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cdn-client.medium.com/lite/static/js/main.6045f352.chunk.js(Line 1) Message: -+++++= .+++++= .+@@@@@+ #@@@@: .@@@@@= @@@@@ @+@@@@- =#@@@@@ @ +@@@@: :% @@@@@ @ @@@@-%: @@@@@ @ @@@@- @@@@@ -@- #@@+ :@@@@@: -#@@@#- ## =@@@@@@@= ....... .........
console-api	log	URL: https://cdn-client.medium.com/lite/static/js/main.6045f352.chunk.js(Line 1) Message: We're hiring! https://medium.com/jobs-at-medium/work-at-medium-959d1a85284e

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	allow-from medium.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api2.branch.io
app.link
blog.newskysecurity.com
cdn-client.medium.com
cdn.branch.io
cdn.optimizely.com
collector-medium.lightstep.com
d1z2jf7jlzjs58.cloudfront.net
errors.client.optimizely.com
glyph.medium.com
medium.com
miro.medium.com
srv-2019-11-24-22.pixel.parsely.com
www.google-analytics.com
13.225.84.38
143.204.101.37
2600:9000:2043:ee00:11:f728:3040:93a1
2600:9000:21f3:c800:19:9934:6a80:93a1
2606:4700::6810:7591
2606:4700::6810:7691
2606:4700::6810:797f
2a00:1450:4001:808::200e
2a02:26f0:6c00:196::13b8
3.214.164.119
3.225.17.244
34.192.124.59
52.4.145.119
087a4c7aa118304c5ce85d5917d95a49b3c93204ef3500752dfde52595e4eac6
12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192
15dc5b38ec7a6acf2d5b72ee3dff925c3093234c3aecd1d17bee4c303def67dd
15fe136a1efa833398804110b2dfcfc355b09307d11ba0595065be750643d485
16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12
1b2611a82c2fe481a4f2ee2211a85e9ec5611c158b84a48969cfdededc141230
1c34bdda7680836139ae21f9936df0b556b415190a675e484431ae683b68eaa8
1e38dcee0f7899544d8532a1246648974a0a2aa112a5d6673ef4f55d7f2418b4
200a1110634c75fba64b8951b5e5e37d4205b12ea63eaaece1f097a9d8ebabcc
2cbcd5463e4a2f5a359297b9ffa65eab53fc48f8b46bbe01ad4dd05b6f64b09b
2d6957efe0d7f1be6602c8635ec059ec3d40b5d9dd9b0743a19f3045a6312c52
2eb4106035210c77653a76bef9ff9759733b91fd1fde38acf2bec8679b392f2e
30824c7fc6eeb6dce4a0bdb4f99dd3dc748f84e82bb0e1a61c46ac0c45495785
31fb4941e4b177813cbd6114d07c26d979098bde19b9f25c340a773c5d4eb452
332eed0b73c2667d8b8125007d412e8a32bdeab5ad55bbadc70a3d1e9e1306c8
34b37e0f859b982708ccb00c0b323f2ca13bb3cb39ec13d9b357560691e37339
3abc93519a1879fbd49bccc6a16286b350e24d9e826b006ebaa1f83578683788
4c0cc04185396c9a83cfda3644c23327d7d8ff9247157c438575b83713894173
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
572866309262ab9b9169dfa16aa511a8698028d1bc339425bb101d708454cf4d
58711bafae315df048e1bc0c36ae1dfd017810b34fd9b4b021f774694397baad
59b2a8e5fc8513f64a07e951983cc598161ff6b40a0e87263e4ea98d869d9865
5d794957e7ad5110160e8964aca8d60c2b8d6a7b0729da0167d523eca7623245
5d9a40a2f5f0ad34463171c4e28b1ce6bc3d757754c48080b310cbc77b7a427a
5dbe1e0a5c960eedcec434d7064aca36286e0e421d5eed38d64ceaaf45ba9360
5f753d81efb8d7bd5bd28327d7ca113ea4ef2c6ded99b2d408d6b4876c0bd96b
73f8773990dc895d5dff6d640d9694f441544885704ffbe69c93e53b83e48829
7c897464fbe688db9f6bc935e02e1984f66da5e0408121437015b2c8b453fdda
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
876abfa02324fa163045b98d8461c9b7f21a8430231f3c86463373f09bda543e
8d260a7ba17ff91ea4dec83e8e044c4dd0121e037b791370b552022b42e59dc1
9115a84ca8088a1a212f698bf61b75ad550b2ff55c6fe236364023875a939188
92431bcfa6a4c1f515f445625607d7e770ca581ce7e48b15e8da99413305eb1e
99c5448d6c84fc71d6805e2485727db250113edcaea123a064f8c26ce95947d8
99e410c524c48211e6f6f093b820c1f6d67f6f477dac905d3b6845e8ad4d62b8
9e013976876f923b5d747b79501cd38255f1876399c5e9b5a8f995dec0291ab7
9f043393f4dc0c75b93408fdd9fa366f80b1164f0f0083dc9e565aa70638e48b
9f7459fc88eff85487b8c94b9d39501c919c16d138d3a372e422e597e03f1a4a
a342fa598720095ce23df10f067a3018b78bb2adf303b041e181c0ce08630daa
a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8
a47a925f013530c2242f6c15005110dfa4683381e9d0b95f8ee41377899a49fb
a5f267fc508b4156c5dd84139b7627f10cce7b434ec4d933d580deec8ccc8b81
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb
b6a3f3500e1ec3ff7ea99c3e0213e95e116cb63cb253735889a86282614731bd
c9e2c034706eef3ebf43d927f9219126e167a78c4d86b4994a06243800734056
cb4d96376bbfaec73c2a56bb6a2a0c5286c6084b499cdf647e8af5ab76bd4f28
ce1984380883d201feb7df1ac6464b3a7aa780f271107645d932e984ac131408
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dc4c3db334b59d535c34cdc7550801b4bca67f800a70432a9a248f7fac0e84ed
df0aed57cbe1f70d5a729c33e9fc58f1649b3b477c280983af8e5e6af9922651
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3ca6ca0a4ecc33b42d48d490350cacc7d1c1d3d57b75cd46417300551dd0945
e4b1c4e363400111e6bfbd2a8a8277b37e26ca4d945e5eee5ec06b7bc519b6af
ec9ec3e6efb3c46386c3aea007961218fd90c5d04b65969f90db72330fc3a496
ef1ed6a034a5055a869c7c25765ee1f2844a27a54e83e8a857d77b3f1cd83dd3
efcb4fd67352b26e679f0657831686822630c2b9ef81031b1979dd3da8af76b3
f14d4838dddcbaa52775086da3171b0415acfbde9ab55d023a39e438fb0228a2
f513d21f19099036ea828f63da75ca33aa298bd996a115a0951cae5c3b93ffcf
f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08
f93efdea8f2745958579dbe1c8479b25440d1732a250cb9623b05170f729eadf
fa6aeeecda11c89e63d13913a45dc7792a345cf8cf7cc882a0689eed5411b136
fad6cb58380bf8cc8491322e6ad936057ad520aabc9b06149f343c38f07bb9da
fe8d2885e087ad5084fbf1ffb099334d9237ca321826c32453faaac1db174883

blog.newskysecurity.com Open in urlscan Pro 52.4.145.119 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

71 Requests

100 %HTTPS

54 %IPv6

9 Domains

14 Subdomains

13 IPs

3 Countries

1234 kBTransfer

2899 kBSize

11 Cookies

43 Outgoing links

Page URL History

Redirected requests

71 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

blog.newskysecurity.com Open in urlscan Pro
52.4.145.119 Public Scan

Screenshot
Live screenshot

Full Image

71
Requests

100 %
HTTPS

54 %
IPv6

9
Domains

14
Subdomains

13
IPs

3
Countries

1234 kB
Transfer

2899 kB
Size

11
Cookies

71 HTTP transactions
4 data transactions