Submitted URL: https://www.nomoreransom.org/zht_Hant/decryption-tools.html#Lockbit30
Effective URL: https://www.nomoreransom.org/zht_Hant/decryption-tools.html
Submission: On February 29 via manual from HK — Scanned from JP

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 27 HTTP transactions. The main IP is 18.172.52.117, located in United States and belongs to AMAZON-02, US. The main domain is www.nomoreransom.org.
TLS certificate: Issued by GlobalSign RSA OV SSL CA 2018 on December 6th 2023. Valid for: a year.
This is the only time www.nomoreransom.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

Apex Domain
Subdomains
Transfer
11 gstatic.com
fonts.gstatic.com
701 KB
10 nomoreransom.org
www.nomoreransom.org
80 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 31
21 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 40
85 KB
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 85
350 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 32
165 KB
27 6
Domain Requested by
11 fonts.gstatic.com fonts.googleapis.com
10 www.nomoreransom.org www.nomoreransom.org
3 www.google-analytics.com www.nomoreransom.org
www.google-analytics.com
www.googletagmanager.com
1 www.googletagmanager.com www.google-analytics.com
1 stats.g.doubleclick.net www.google-analytics.com
1 fonts.googleapis.com www.nomoreransom.org
27 6
Subject Issuer Validity Valid
*.nomoreransom.org
GlobalSign RSA OV SSL CA 2018
2023-12-06 -
2025-01-06
a year crt.sh
upload.video.google.com
GTS CA 1C3
2024-02-05 -
2024-04-29
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2024-02-05 -
2024-04-29
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2024-02-05 -
2024-04-29
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2024-02-05 -
2024-04-29
3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.nomoreransom.org/zht_Hant/decryption-tools.html
Frame ID: 08DAF05AC8F91330E6B7F0242DF6E8F5
Requests: 27 HTTP requests in this frame

Screenshot

Page Title

解鎖工具 | The No More Ransom Project

Detected technologies

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

27
Requests

100 %
HTTPS

83 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

1052 kB
Transfer

2034 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

27 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request decryption-tools.html
www.nomoreransom.org/zht_Hant/
266 KB
20 KB
Document
General
Full URL
https://www.nomoreransom.org/zht_Hant/decryption-tools.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.172.52.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-172-52-117.nrt20.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1b35b60808defaa63652c34fd91e3ded285dd8ed18073fe2f7cb99f62a879080

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

age
12714
content-encoding
gzip
content-type
text/html
date
Thu, 29 Feb 2024 01:07:25 GMT
etag
W/"9d06666f61badbc16d4461995d7bf85b"
last-modified
Fri, 23 Feb 2024 13:44:36 GMT
server
AmazonS3
vary
Accept-Encoding
via
1.1 bb1084139629d83977ea8b21c49ea966.cloudfront.net (CloudFront)
x-amz-cf-id
lKihEePu5Z9dS9_8W86sZPLBH0KWxEpTZdXIpkeQU-aXdQDonAhunQ==
x-amz-cf-pop
NRT20-P2
x-amz-server-side-encryption
AES256
x-amz-version-id
8vccKZCxshwJl3ADPsW5bMc2LhvpOWyu
x-cache
Hit from cloudfront
css2
fonts.googleapis.com/
592 KB
165 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Noto+Sans+TC:wght@300;400;500;700;900&display=swap
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/zht_Hant/decryption-tools.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:825::200a , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
72219ff211fca2b09c3310d15cef0dd9e3ee79a9a8a84a7aeeeb90e4f767c823
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.nomoreransom.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 29 Feb 2024 04:39:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 29 Feb 2024 04:39:18 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 29 Feb 2024 04:39:18 GMT
no-more-ransom.css
www.nomoreransom.org/assets/css/
76 KB
11 KB
Stylesheet
General
Full URL
https://www.nomoreransom.org/assets/css/no-more-ransom.css
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/zht_Hant/decryption-tools.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.172.52.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-172-52-117.nrt20.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
9948904482d7360bca57c45d56600f94fef548260e9dddf030b4d80dc72a3c56

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.nomoreransom.org/zht_Hant/decryption-tools.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-amz-version-id
2dxqqrSzKde6mwTcEFoJtqDr_EPbTgRY
content-encoding
gzip
via
1.1 bb1084139629d83977ea8b21c49ea966.cloudfront.net (CloudFront)
date
Wed, 28 Feb 2024 19:47:33 GMT
last-modified
Fri, 23 Feb 2024 13:44:25 GMT
server
AmazonS3
x-amz-cf-pop
NRT20-P2
age
31906
x-amz-server-side-encryption
AES256
etag
W/"fa71812fa03c480e3f808a405ae7c323"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
x-amz-cf-id
10FSYeUnEPsA-_nEzB4ZgdUl6BhVr0bvM9LsmzwoWadJe40gmuyVqA==
focus-visible-5.2.0.min.js
www.nomoreransom.org/assets/js/
3 KB
1 KB
Script
General
Full URL
https://www.nomoreransom.org/assets/js/focus-visible-5.2.0.min.js
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/zht_Hant/decryption-tools.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.172.52.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-172-52-117.nrt20.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6abe5b4a45660d2e1c1a6f439d996d8a69a7a1a472be169c3121ade517b7ab05

Request headers

Referer
https://www.nomoreransom.org/zht_Hant/decryption-tools.html
Origin
https://www.nomoreransom.org
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-amz-version-id
gflfjSzj0JFqoC3mSI5aYZUdb0q2t4vB
content-encoding
gzip
via
1.1 bb1084139629d83977ea8b21c49ea966.cloudfront.net (CloudFront)
date
Wed, 28 Feb 2024 05:52:53 GMT
last-modified
Fri, 23 Feb 2024 13:44:27 GMT
server
AmazonS3
x-amz-cf-pop
NRT20-P2
age
81986
x-amz-server-side-encryption
AES256
etag
W/"f10e5d925e2f612d248d47afc12408ce"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
yHkxHNqTlt92gloFltwAxA6e80njb_NtSltyg7WrapIuVd119Ot2KQ==
jquery-3.6.0.min.js
www.nomoreransom.org/assets/js/
87 KB
30 KB
Script
General
Full URL
https://www.nomoreransom.org/assets/js/jquery-3.6.0.min.js
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/zht_Hant/decryption-tools.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.172.52.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-172-52-117.nrt20.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer
https://www.nomoreransom.org/zht_Hant/decryption-tools.html
Origin
https://www.nomoreransom.org
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 28 Feb 2024 22:34:57 GMT
x-amz-version-id
fxmBxi2lwieDh8RC8oauiAGX6ReFlcMy
content-encoding
br
last-modified
Fri, 23 Feb 2024 13:44:27 GMT
server
AmazonS3
via
1.1 bb1084139629d83977ea8b21c49ea966.cloudfront.net (CloudFront)
x-amz-cf-pop
NRT20-P2
etag
W/"8fb8fee4fcc3cc86ff6c724154c49c42"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
age
21862
x-amz-cf-id
jRzF4xgGf4yEkmkQH3PEsAFMkF2MmKzUHp8s_LF5smW9dkdppA0JsQ==
common.js
www.nomoreransom.org/assets/js/
7 KB
3 KB
Script
General
Full URL
https://www.nomoreransom.org/assets/js/common.js
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/zht_Hant/decryption-tools.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.172.52.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-172-52-117.nrt20.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ca02cfb58d830fe9efb23f0c518f46103d6dd70b61115891055b8775531c4e92

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.nomoreransom.org/zht_Hant/decryption-tools.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-amz-version-id
u3SHiPgNHsO_pkIi9qLpMZiR5k1J9Rpy
content-encoding
gzip
via
1.1 bb1084139629d83977ea8b21c49ea966.cloudfront.net (CloudFront)
date
Wed, 28 Feb 2024 14:49:55 GMT
last-modified
Fri, 23 Feb 2024 13:44:27 GMT
server
AmazonS3
x-amz-cf-pop
NRT20-P2
age
49764
x-amz-server-side-encryption
AES256
etag
W/"375646dc61c8349e0947d618a493559b"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
vH2V1lBtA1I5mnmoOEkEn-pQ4if3T3ETrs4X76aUFI3PErRqhtz6AQ==
logo-decoration.svg
www.nomoreransom.org/assets/img/
376 B
782 B
Image
General
Full URL
https://www.nomoreransom.org/assets/img/logo-decoration.svg
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/assets/css/no-more-ransom.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.172.52.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-172-52-117.nrt20.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0c69757d7851e69197ccae0aa6833cb7e5aebe67c2218912a57fae12a950ae7e

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.nomoreransom.org/assets/css/no-more-ransom.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-amz-version-id
cF1eTAmZ.U66Z.h.fu2U9sfk1.bt3td7
date
Wed, 28 Feb 2024 07:17:25 GMT
via
1.1 bb1084139629d83977ea8b21c49ea966.cloudfront.net (CloudFront)
last-modified
Fri, 23 Feb 2024 13:44:25 GMT
server
AmazonS3
x-amz-cf-pop
NRT20-P2
age
76914
x-amz-server-side-encryption
AES256
etag
"5204e3a1eaf2b826bea32c656036c086"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
accept-ranges
bytes
content-length
376
x-amz-cf-id
-89kVcvn31rYt23mvshUPf6pRAjX6cmBaDqh8BW6PZDBYr89mGXMWA==
triangle-blue.svg
www.nomoreransom.org/assets/img/polygons/
231 B
647 B
Image
General
Full URL
https://www.nomoreransom.org/assets/img/polygons/triangle-blue.svg
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/assets/css/no-more-ransom.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.172.52.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-172-52-117.nrt20.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3c5aea3a4593b577f1028ba16238bc9e5292c3229a7ae4ab3938f8d5752f6e82

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.nomoreransom.org/assets/css/no-more-ransom.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-amz-version-id
uQF5q1o1_LtBGP4TRoztxleAEST37suV
date
Thu, 29 Feb 2024 00:50:18 GMT
via
1.1 bb1084139629d83977ea8b21c49ea966.cloudfront.net (CloudFront)
last-modified
Fri, 23 Feb 2024 13:44:27 GMT
server
AmazonS3
x-amz-cf-pop
NRT20-P2
age
48454
x-amz-server-side-encryption
AES256
etag
"0e07992fcf5cd0cce2cb284fc8ddfea1"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
accept-ranges
bytes
content-length
231
x-amz-cf-id
V527C-dKfcSxLCAX9Geyn8NsNp_UQsJdZy_mwROwnNz7XAwP-W5ozA==
triangle-footer.svg
www.nomoreransom.org/assets/img/polygons/
205 B
595 B
Image
General
Full URL
https://www.nomoreransom.org/assets/img/polygons/triangle-footer.svg
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/assets/css/no-more-ransom.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.172.52.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-172-52-117.nrt20.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
be2f116625fa05783c5e3711e8fe64fce2e6612f2366d8a4d8f8e5a14d484e9e

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.nomoreransom.org/assets/css/no-more-ransom.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 28 Feb 2024 05:45:01 GMT
x-amz-version-id
zuZf1dfamS5QPfR1XTJEWacdMBGojia_
via
1.1 bb1084139629d83977ea8b21c49ea966.cloudfront.net (CloudFront)
last-modified
Fri, 23 Feb 2024 13:44:27 GMT
server
AmazonS3
x-amz-cf-pop
NRT20-P2
age
82458
etag
"bee761c24d457c8271856c43120fb381"
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
image/svg+xml
accept-ranges
bytes
content-length
205
x-amz-cf-id
z6E28lVSCnKZRPxa-HGlpZqk4npazsCG8Cu6LfGpHfKHpJkLlIqYYg==
-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.118.woff2
fonts.gstatic.com/s/notosanstc/v35/
59 KB
59 KB
Font
General
Full URL
https://fonts.gstatic.com/s/notosanstc/v35/-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.118.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+TC:wght@300;400;500;700;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
21d2dfb24132e98b78a83ec9975aea8598b2091a78eab5fe66501873f655cec2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.nomoreransom.org
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 22 Feb 2024 21:47:44 GMT
x-content-type-options
nosniff
age
543094
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
60376
x-xss-protection
0
last-modified
Tue, 15 Aug 2023 18:29:20 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 21 Feb 2025 21:47:44 GMT
-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.117.woff2
fonts.gstatic.com/s/notosanstc/v35/
65 KB
65 KB
Font
General
Full URL
https://fonts.gstatic.com/s/notosanstc/v35/-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.117.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+TC:wght@300;400;500;700;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b15044b2aa1c432c24c3fa34152e20013ee17a71ecb75381380faf177d8c99d2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.nomoreransom.org
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 28 Feb 2024 12:08:34 GMT
x-content-type-options
nosniff
age
59444
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
66600
x-xss-protection
0
last-modified
Tue, 15 Aug 2023 18:29:21 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 27 Feb 2025 12:08:34 GMT
-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.119.woff2
fonts.gstatic.com/s/notosanstc/v35/
35 KB
35 KB
Font
General
Full URL
https://fonts.gstatic.com/s/notosanstc/v35/-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.119.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+TC:wght@300;400;500;700;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7d1c673ab93e90b90035f39e95c2248f683c873b87fbd62fc710fd52beb83800
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.nomoreransom.org
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 03:26:45 GMT
x-content-type-options
nosniff
age
4353
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35752
x-xss-protection
0
last-modified
Tue, 15 Aug 2023 18:31:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 28 Feb 2025 03:26:45 GMT
no-more-ransom-icons.woff2
www.nomoreransom.org/assets/fonts/icons/
11 KB
11 KB
Font
General
Full URL
https://www.nomoreransom.org/assets/fonts/icons/no-more-ransom-icons.woff2
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/assets/css/no-more-ransom.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.172.52.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-172-52-117.nrt20.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b4112d80e8348927d315ecb2c7c01b1295e90e609880b10675698458730ea50c

Request headers

Referer
https://www.nomoreransom.org/assets/css/no-more-ransom.css
Origin
https://www.nomoreransom.org
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 28 Feb 2024 05:45:01 GMT
x-amz-version-id
BZeaBrVALIl0aH35SPx1PycOljJEVuAc
via
1.1 bb1084139629d83977ea8b21c49ea966.cloudfront.net (CloudFront)
last-modified
Fri, 23 Feb 2024 13:44:25 GMT
server
AmazonS3
x-amz-cf-pop
NRT20-P2
age
82458
etag
"31a9362b179356d50e4b2c6c6d4a49ea"
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
binary/octet-stream
accept-ranges
bytes
content-length
10884
x-amz-cf-id
KFsVBEe0_h3a3p7NFyGQtM5aw9y8CsGruMCxWLtbPJgfm7wrfWcfDg==
-nF7OG829Oofr2wohFbTp9i1OCEK.woff2
fonts.gstatic.com/s/notosanstc/v35/
24 KB
24 KB
Font
General
Full URL
https://fonts.gstatic.com/s/notosanstc/v35/-nF7OG829Oofr2wohFbTp9i1OCEK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+TC:wght@300;400;500;700;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c06498a30c738b01e8b9bd63af7b835ef8a00c6443499c1f1a2d1389da8ad932
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.nomoreransom.org
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 03:30:10 GMT
x-content-type-options
nosniff
age
4148
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24952
x-xss-protection
0
last-modified
Tue, 15 Aug 2023 18:28:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 28 Feb 2025 03:30:10 GMT
-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.114.woff2
fonts.gstatic.com/s/notosanstc/v35/
70 KB
70 KB
Font
General
Full URL
https://fonts.gstatic.com/s/notosanstc/v35/-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.114.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+TC:wght@300;400;500;700;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ae46d0e503a3dfd8446d129bfeb58e8b64f7aced05bfc73c9fba2a3c3e7be498
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.nomoreransom.org
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 28 Feb 2024 14:11:38 GMT
x-content-type-options
nosniff
age
52060
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
71816
x-xss-protection
0
last-modified
Tue, 15 Aug 2023 18:29:05 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 27 Feb 2025 14:11:38 GMT
-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.112.woff2
fonts.gstatic.com/s/notosanstc/v35/
73 KB
73 KB
Font
General
Full URL
https://fonts.gstatic.com/s/notosanstc/v35/-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.112.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+TC:wght@300;400;500;700;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5e5082a5d7520b50ba4668208f4862576ec02c7d7518e083204aa1d766ca8145
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.nomoreransom.org
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 03:16:50 GMT
x-content-type-options
nosniff
age
4948
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
74364
x-xss-protection
0
last-modified
Tue, 15 Aug 2023 18:39:56 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 28 Feb 2025 03:16:50 GMT
-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.116.woff2
fonts.gstatic.com/s/notosanstc/v35/
70 KB
70 KB
Font
General
Full URL
https://fonts.gstatic.com/s/notosanstc/v35/-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.116.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+TC:wght@300;400;500;700;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ccace50325bedf72cb77bf3c7ce2fa650d1dfe9bed8f7f4f2750a50000171e34
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.nomoreransom.org
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 03:29:50 GMT
x-content-type-options
nosniff
age
4168
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
71744
x-xss-protection
0
last-modified
Tue, 15 Aug 2023 18:39:17 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 28 Feb 2025 03:29:50 GMT
-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.115.woff2
fonts.gstatic.com/s/notosanstc/v35/
72 KB
72 KB
Font
General
Full URL
https://fonts.gstatic.com/s/notosanstc/v35/-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.115.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+TC:wght@300;400;500;700;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e3bec718404d0d9849ef9dd57d6b965a6127ac4b63ecc18aed217637c7aca7a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.nomoreransom.org
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 03:15:12 GMT
x-content-type-options
nosniff
age
5046
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
74048
x-xss-protection
0
last-modified
Tue, 15 Aug 2023 18:39:18 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 28 Feb 2025 03:15:12 GMT
-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.110.woff2
fonts.gstatic.com/s/notosanstc/v35/
76 KB
76 KB
Font
General
Full URL
https://fonts.gstatic.com/s/notosanstc/v35/-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.110.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+TC:wght@300;400;500;700;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
eb97e306d2ac2a5f35fe77491a776f3bd6c9d37a12c391aa194480dd472651bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.nomoreransom.org
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 03:19:38 GMT
x-content-type-options
nosniff
age
4780
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
77648
x-xss-protection
0
last-modified
Tue, 15 Aug 2023 18:24:13 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 28 Feb 2025 03:19:38 GMT
-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.113.woff2
fonts.gstatic.com/s/notosanstc/v35/
71 KB
71 KB
Font
General
Full URL
https://fonts.gstatic.com/s/notosanstc/v35/-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.113.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+TC:wght@300;400;500;700;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5ab1b4e11c3444c617d1ed6dd1a1061076de3264accf92e711ec703db7e460fc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.nomoreransom.org
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 03:15:21 GMT
x-content-type-options
nosniff
age
5037
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
72940
x-xss-protection
0
last-modified
Tue, 15 Aug 2023 18:57:35 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 28 Feb 2025 03:15:21 GMT
-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.111.woff2
fonts.gstatic.com/s/notosanstc/v35/
84 KB
84 KB
Font
General
Full URL
https://fonts.gstatic.com/s/notosanstc/v35/-nF7OG829Oofr2wohFbTp9iFOkMQAewlpbGXhhyYs0QF3kPVyLylzU95vTq1Ltj5xQez1g.111.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Noto+Sans+TC:wght@300;400;500;700;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5e1b3af246bd610bc9059561a386543537d7a6abe424bd8715df6772aeb27bce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.nomoreransom.org
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 03:23:30 GMT
x-content-type-options
nosniff
age
4548
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
85828
x-xss-protection
0
last-modified
Tue, 15 Aug 2023 18:25:44 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 28 Feb 2025 03:23:30 GMT
logo.svg
www.nomoreransom.org/assets/img/
2 KB
1 KB
Image
General
Full URL
https://www.nomoreransom.org/assets/img/logo.svg
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/zht_Hant/decryption-tools.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.172.52.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-172-52-117.nrt20.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ee8467ad84a6c64d23720adfbebde00b143d7972d47adc4923f7b4f2b368a539

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.nomoreransom.org/zht_Hant/decryption-tools.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 28 Feb 2024 23:03:25 GMT
x-amz-version-id
S50ZX01qUv9CfSDmzQ8AEECTvAR2QK45
content-encoding
br
last-modified
Fri, 23 Feb 2024 13:44:25 GMT
server
AmazonS3
via
1.1 bb1084139629d83977ea8b21c49ea966.cloudfront.net (CloudFront)
x-amz-cf-pop
NRT20-P2
etag
W/"71bcc8a426da74bf60abb493c18d4e93"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
age
20154
x-amz-cf-id
7b8WaQAluttTMaCWCZfYFzz6mKcKvm3WK4dc2HTQ08pW6At5gUEv6g==
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/zht_Hant/decryption-tools.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:812::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.nomoreransom.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 29 Feb 2024 03:24:25 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
server
Golfe2
age
4493
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Thu, 29 Feb 2024 05:24:25 GMT
collect
www.google-analytics.com/j/
16 B
226 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=756739833&t=pageview&_s=1&dl=https%3A%2F%2Fwww.nomoreransom.org%2Fzht_Hant%2Fdecryption-tools.html&ul=en-us&de=UTF-8&dt=%E8%A7%A3%E9%8E%96%E5%B7%A5%E5%85%B7%20%7C%20The%20No%20More%20Ransom%20Project&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=924041245&gjid=1467735962&cid=1234779801.1709181558&tid=UA-61587331-39&_gid=405100854.1709181558&_r=1&_slc=1&z=739377135
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:812::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
ebe25ca5798a17940153c47e1cfd235823491b7b5c4f2d4539f24b86fdc096c1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.nomoreransom.org/
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 29 Feb 2024 04:39:18 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.nomoreransom.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
16
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
1 B
350 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-61587331-39&cid=1234779801.1709181558&jid=924041245&gjid=1467735962&_gid=405100854.1709181558&_u=IEBAAEAAAAAAACAAI~&z=1807089431
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4008:c00::9c Taipei, Taiwan, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.nomoreransom.org/
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Thu, 29 Feb 2024 04:39:18 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.nomoreransom.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/
237 KB
85 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-V07YT61P6E&cx=c&_slc=1
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:80b::2008 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e15938e2c9169bae101ca81cfa99a2f8fe6e3fd8d91375dd8ede724f46d0ffd3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.nomoreransom.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 04:39:18 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
86427
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 29 Feb 2024 04:39:18 GMT
collect
www.google-analytics.com/g/
0
17 B
Ping
General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-V07YT61P6E&gtm=45je42q1v9125846083za220&_p=1709181558514&gcd=13l3l3l3l2&npa=0&dma=0&ul=en-us&sr=1600x1200&cid=1234779801.1709181558&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fwww.nomoreransom.org%2Fzht_Hant%2Fdecryption-tools.html&dt=%E8%A7%A3%E9%8E%96%E5%B7%A5%E5%85%B7%20%7C%20The%20No%20More%20Ransom%20Project&sid=1709181558&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=840
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-V07YT61P6E&cx=c&_slc=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2404:6800:4004:812::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.nomoreransom.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 29 Feb 2024 04:39:18 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.nomoreransom.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| applyFocusVisiblePolyfill function| $ function| jQuery object| languages function| ransomFilter function| setCookie function| getCookie function| eraseCookie string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| dataLayer object| google_tag_manager

4 Cookies

Domain/Path Name / Value
.nomoreransom.org/ Name: _ga
Value: GA1.2.1234779801.1709181558
.nomoreransom.org/ Name: _gid
Value: GA1.2.405100854.1709181558
.nomoreransom.org/ Name: _gat
Value: 1
.nomoreransom.org/ Name: _ga_V07YT61P6E
Value: GS1.2.1709181558.1.0.1709181558.0.0.0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
stats.g.doubleclick.net
www.google-analytics.com
www.googletagmanager.com
www.nomoreransom.org
18.172.52.117
2404:6800:4004:80b::2008
2404:6800:4004:812::200e
2404:6800:4004:823::2003
2404:6800:4004:825::200a
2404:6800:4008:c00::9c
0c69757d7851e69197ccae0aa6833cb7e5aebe67c2218912a57fae12a950ae7e
1b35b60808defaa63652c34fd91e3ded285dd8ed18073fe2f7cb99f62a879080
21d2dfb24132e98b78a83ec9975aea8598b2091a78eab5fe66501873f655cec2
3c5aea3a4593b577f1028ba16238bc9e5292c3229a7ae4ab3938f8d5752f6e82
5ab1b4e11c3444c617d1ed6dd1a1061076de3264accf92e711ec703db7e460fc
5e1b3af246bd610bc9059561a386543537d7a6abe424bd8715df6772aeb27bce
5e5082a5d7520b50ba4668208f4862576ec02c7d7518e083204aa1d766ca8145
6abe5b4a45660d2e1c1a6f439d996d8a69a7a1a472be169c3121ade517b7ab05
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
72219ff211fca2b09c3310d15cef0dd9e3ee79a9a8a84a7aeeeb90e4f767c823
7d1c673ab93e90b90035f39e95c2248f683c873b87fbd62fc710fd52beb83800
9948904482d7360bca57c45d56600f94fef548260e9dddf030b4d80dc72a3c56
ae46d0e503a3dfd8446d129bfeb58e8b64f7aced05bfc73c9fba2a3c3e7be498
b15044b2aa1c432c24c3fa34152e20013ee17a71ecb75381380faf177d8c99d2
b4112d80e8348927d315ecb2c7c01b1295e90e609880b10675698458730ea50c
be2f116625fa05783c5e3711e8fe64fce2e6612f2366d8a4d8f8e5a14d484e9e
c06498a30c738b01e8b9bd63af7b835ef8a00c6443499c1f1a2d1389da8ad932
ca02cfb58d830fe9efb23f0c518f46103d6dd70b61115891055b8775531c4e92
ccace50325bedf72cb77bf3c7ce2fa650d1dfe9bed8f7f4f2750a50000171e34
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e15938e2c9169bae101ca81cfa99a2f8fe6e3fd8d91375dd8ede724f46d0ffd3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3bec718404d0d9849ef9dd57d6b965a6127ac4b63ecc18aed217637c7aca7a2
eb97e306d2ac2a5f35fe77491a776f3bd6c9d37a12c391aa194480dd472651bc
ebe25ca5798a17940153c47e1cfd235823491b7b5c4f2d4539f24b86fdc096c1
ee8467ad84a6c64d23720adfbebde00b143d7972d47adc4923f7b4f2b368a539
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e