urlscan.io logo urlscan.io
SecurityTrails logo

www.nomoreransom.org Open in urlscan Pro
18.164.52.94  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.nomoreransom.org/crypto-sheriff.php?lang=es
Submission: On July 21 via manual from ES — Scanned from ES
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 3 countries across 6 domains to perform 21 HTTP transactions. The main IP is 18.164.52.94, located in United States and belongs to AMAZON-02, US. The main domain is www.nomoreransom.org.
TLS certificate: Issued by GlobalSign RSA OV SSL CA 2018 on November 18th 2022. Valid for: a year.
This is the only time www.nomoreransom.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

14    18.164.52.94 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-52-94.cdg50.r.cloudfront.net
www.nomoreransom.org
1    2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:400c:c02::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:81c::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
Apex Domain
Subdomains		 Transfer
14 nomoreransom.org
www.nomoreransom.org
85 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 56
region1.google-analytics.com — Cisco Umbrella Rank: 1771
21 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 69
79 KB
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 116
350 B
1 gstatic.com
fonts.gstatic.com
36 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 74
1 KB
21 6
Domain Requested by
14 www.nomoreransom.org www.nomoreransom.org
2 www.google-analytics.com www.nomoreransom.org
www.google-analytics.com
1 region1.google-analytics.com www.googletagmanager.com
1 www.googletagmanager.com www.google-analytics.com
1 stats.g.doubleclick.net www.google-analytics.com
1 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com www.nomoreransom.org
21 7

This site contains links to these domains. Also see Links.

Domain
www.europol.europa.eu
www.politie.nl
aws.amazon.com
www.barracuda.com
Subject Issuer Validity Valid
*.nomoreransom.org
GlobalSign RSA OV SSL CA 2018		 2022-11-18 -
2023-12-20		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-07-03 -
2023-09-25		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-07-03 -
2023-09-25		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-07-03 -
2023-09-25		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-07-03 -
2023-09-25		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.nomoreransom.org/crypto-sheriff.php?lang=es
Frame ID: B0EBDD0FE05030473FE6B66E2B89E33B
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Crypto Sheriff | The No More Ransom Project

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

21
Requests

100 %
HTTPS

86 %
IPv6

6
Domains

7
Subdomains

7
IPs

3
Countries

223 kB
Transfer

536 kB
Size

5
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request crypto-sheriff.php
www.nomoreransom.org/ 		18 KB
19 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.nomoreransom.org/crypto-sheriff.php?lang=es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.52.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-52-94.cdg50.r.cloudfront.net
Software
Apache /
Resource Hash
eb2ae537227129e2973c5ebdfa1f18e7c9c68e71fc116327559d3a547badacca

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36
accept-language
es-ES,es;q=0.9

Response headers

content-type
text/html; charset=UTF-8
date
Fri, 21 Jul 2023 12:25:58 GMT
server
Apache
via
1.1 62c19c8529da15502cb35329ecc9b474.cloudfront.net (CloudFront)
x-amz-cf-id
0dMILdRGFGR7Rs4N0w0TTPDLZQaKgtjZBd65Z2paeZmGbACJss16cw==
x-amz-cf-pop
CDG50-P4
x-cache
Miss from cloudfront
css2
fonts.googleapis.com/ 		17 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Commissioner:wght@100;300;400;500;600;700;800&display=swap
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/crypto-sheriff.php?lang=es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
f1ce64ff9ffd6fa3dd9668d39a36232a2248a8b8602d527f2a1d204112e63177
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://www.nomoreransom.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 21 Jul 2023 12:25:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 21 Jul 2023 12:25:58 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 21 Jul 2023 12:25:58 GMT
no-more-ransom.css
www.nomoreransom.org/assets/css/ 		76 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.nomoreransom.org/assets/css/no-more-ransom.css
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/crypto-sheriff.php?lang=es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.52.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-52-94.cdg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
9948904482d7360bca57c45d56600f94fef548260e9dddf030b4d80dc72a3c56

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://www.nomoreransom.org/crypto-sheriff.php?lang=es
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

x-amz-version-id
hyMW0Yg2dbLu3iXXmvrENVTgpBd.dCk1
content-encoding
br
via
1.1 62c19c8529da15502cb35329ecc9b474.cloudfront.net (CloudFront)
date
Fri, 21 Jul 2023 03:03:27 GMT
last-modified
Thu, 29 Jun 2023 14:58:47 GMT
server
AmazonS3
x-amz-cf-pop
CDG50-P4
age
33752
x-amz-server-side-encryption
AES256
etag
W/"fa71812fa03c480e3f808a405ae7c323"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
x-amz-cf-id
cqXv6oy_C-1q1klF73VdFUXSR5S22dz44ue65ybdg0TuvY0UV_mbZA==
focus-visible-5.2.0.min.js
www.nomoreransom.org/assets/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.nomoreransom.org/assets/js/focus-visible-5.2.0.min.js
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/crypto-sheriff.php?lang=es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.52.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-52-94.cdg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6abe5b4a45660d2e1c1a6f439d996d8a69a7a1a472be169c3121ade517b7ab05

Request headers

Referer
https://www.nomoreransom.org/crypto-sheriff.php?lang=es
Origin
https://www.nomoreransom.org
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

x-amz-version-id
8nLaHn33f6sX756iPep_6TmGbRJ3E9jn
content-encoding
br
via
1.1 62c19c8529da15502cb35329ecc9b474.cloudfront.net (CloudFront)
date
Fri, 21 Jul 2023 02:04:20 GMT
last-modified
Thu, 29 Jun 2023 14:58:49 GMT
server
AmazonS3
x-amz-cf-pop
CDG50-P4
age
37299
x-amz-server-side-encryption
AES256
etag
W/"f10e5d925e2f612d248d47afc12408ce"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
ksiXVaVXk2VU3ABDqp_8Yqnbzu1CDbXHqcXXq4yq0d_tF2XmKb4VjQ==
jquery-3.6.0.min.js
www.nomoreransom.org/assets/js/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.nomoreransom.org/assets/js/jquery-3.6.0.min.js
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/crypto-sheriff.php?lang=es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.52.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-52-94.cdg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer
https://www.nomoreransom.org/crypto-sheriff.php?lang=es
Origin
https://www.nomoreransom.org
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

x-amz-version-id
YYhDzeCl3GG9HdkfZTllWpPasuYvLtGb
content-encoding
br
via
1.1 62c19c8529da15502cb35329ecc9b474.cloudfront.net (CloudFront)
date
Fri, 21 Jul 2023 02:04:20 GMT
last-modified
Thu, 29 Jun 2023 14:58:49 GMT
server
AmazonS3
x-amz-cf-pop
CDG50-P4
age
37299
x-amz-server-side-encryption
AES256
etag
W/"8fb8fee4fcc3cc86ff6c724154c49c42"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
XRNKsMlGS2mP0wcdEwlsRbg2xacUCYOvAOTkIt1wJOZSCh5b2mCiJQ==
common.js
www.nomoreransom.org/assets/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.nomoreransom.org/assets/js/common.js
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/crypto-sheriff.php?lang=es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.52.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-52-94.cdg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ca02cfb58d830fe9efb23f0c518f46103d6dd70b61115891055b8775531c4e92

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://www.nomoreransom.org/crypto-sheriff.php?lang=es
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

x-amz-version-id
1ZNwp.ggB3YA4.1Z9sUzRiL0Y27Rzglq
content-encoding
gzip
via
1.1 62c19c8529da15502cb35329ecc9b474.cloudfront.net (CloudFront)
date
Thu, 20 Jul 2023 22:02:00 GMT
last-modified
Thu, 29 Jun 2023 14:58:49 GMT
server
AmazonS3
x-amz-cf-pop
CDG50-P4
age
51839
x-amz-server-side-encryption
AES256
etag
W/"375646dc61c8349e0947d618a493559b"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
SRRgKmCYyMlQXAXW1oVKE_83s0KSNwVUbQUwlPT-lfFZjzlm2G2zKQ==
logo-decoration.svg
www.nomoreransom.org/assets/img/ 		376 B
792 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nomoreransom.org/assets/img/logo-decoration.svg
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/assets/css/no-more-ransom.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.52.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-52-94.cdg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0c69757d7851e69197ccae0aa6833cb7e5aebe67c2218912a57fae12a950ae7e

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://www.nomoreransom.org/assets/css/no-more-ransom.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

x-amz-version-id
WWLOANWFcTwXjf4c_ipKu0tgORuitQ8L
date
Fri, 21 Jul 2023 05:18:32 GMT
via
1.1 62c19c8529da15502cb35329ecc9b474.cloudfront.net (CloudFront)
last-modified
Fri, 26 May 2023 13:38:24 GMT
server
AmazonS3
x-amz-cf-pop
CDG50-P4
age
25647
x-amz-server-side-encryption
AES256
etag
"5204e3a1eaf2b826bea32c656036c086"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
accept-ranges
bytes
content-length
376
x-amz-cf-id
ReS8UTU_Ba-drVTiSPVakyC1ArnlmpIq_k7mhqtwLs89r5ujyujKAA==
triangle-blue.svg
www.nomoreransom.org/assets/img/polygons/ 		231 B
649 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nomoreransom.org/assets/img/polygons/triangle-blue.svg
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/assets/css/no-more-ransom.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.52.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-52-94.cdg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3c5aea3a4593b577f1028ba16238bc9e5292c3229a7ae4ab3938f8d5752f6e82

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://www.nomoreransom.org/assets/css/no-more-ransom.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

x-amz-version-id
yNbXj5vYNFZQpUyfYJvqpj.BkF9Dq4kc
date
Fri, 21 Jul 2023 12:25:58 GMT
via
1.1 62c19c8529da15502cb35329ecc9b474.cloudfront.net (CloudFront)
last-modified
Fri, 26 May 2023 13:38:27 GMT
server
AmazonS3
x-amz-cf-pop
CDG50-P4
age
430
x-amz-server-side-encryption
AES256
etag
"0e07992fcf5cd0cce2cb284fc8ddfea1"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
accept-ranges
bytes
content-length
231
x-amz-cf-id
OOdIFzOHEjqbQ-LDO6yNThgxRUIqIxoCxhxULepru1qDnZzf8XIbpg==
triangle-footer.svg
www.nomoreransom.org/assets/img/polygons/ 		205 B
621 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nomoreransom.org/assets/img/polygons/triangle-footer.svg
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/assets/css/no-more-ransom.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.52.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-52-94.cdg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
be2f116625fa05783c5e3711e8fe64fce2e6612f2366d8a4d8f8e5a14d484e9e

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://www.nomoreransom.org/assets/css/no-more-ransom.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

x-amz-version-id
wXlrQQUxvJ1I_8h3mZRXHUS4k.s0iCzD
date
Fri, 21 Jul 2023 08:43:31 GMT
via
1.1 62c19c8529da15502cb35329ecc9b474.cloudfront.net (CloudFront)
last-modified
Fri, 26 May 2023 13:38:27 GMT
server
AmazonS3
x-amz-cf-pop
CDG50-P4
age
13348
x-amz-server-side-encryption
AES256
etag
"bee761c24d457c8271856c43120fb381"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
accept-ranges
bytes
content-length
205
x-amz-cf-id
KihJ1gL1V3UfEFuG7rfqbP8PfGvoOyuPk1r1fTQ3k2PoXi0srrbLjA==
tDbw2o2WnlgI0FNDgduEk4jAhwgumbU1SVfU5BD8OuRL8OstC6KOhgvBYWSFJ-Mgdrgiju6fF8m0akXa.woff2
fonts.gstatic.com/s/commissioner/v20/ 		36 KB
36 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/commissioner/v20/tDbw2o2WnlgI0FNDgduEk4jAhwgumbU1SVfU5BD8OuRL8OstC6KOhgvBYWSFJ-Mgdrgiju6fF8m0akXa.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Commissioner:wght@100;300;400;500;600;700;800&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
956dca77253398f43beb32d902244b66e87536916e245fab92f9cd34a0863596
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.nomoreransom.org
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date
Tue, 18 Jul 2023 11:44:12 GMT
x-content-type-options
nosniff
age
261706
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
36620
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:09:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 17 Jul 2024 11:44:12 GMT
no-more-ransom-icons.woff2
www.nomoreransom.org/assets/fonts/icons/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.nomoreransom.org/assets/fonts/icons/no-more-ransom-icons.woff2
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/assets/css/no-more-ransom.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.52.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-52-94.cdg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b4112d80e8348927d315ecb2c7c01b1295e90e609880b10675698458730ea50c

Request headers

Referer
https://www.nomoreransom.org/assets/css/no-more-ransom.css
Origin
https://www.nomoreransom.org
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

x-amz-version-id
AdcUK_6OT3Df3jxbWHlvpDdYmXc5zLr2
date
Fri, 21 Jul 2023 07:47:22 GMT
via
1.1 62c19c8529da15502cb35329ecc9b474.cloudfront.net (CloudFront)
last-modified
Fri, 26 May 2023 13:38:22 GMT
server
AmazonS3
x-amz-cf-pop
CDG50-P4
age
16717
x-amz-server-side-encryption
AES256
etag
"31a9362b179356d50e4b2c6c6d4a49ea"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
font/woff2
accept-ranges
bytes
content-length
10884
x-amz-cf-id
jbOuTOijOiIva9bB-HWBL_9Srz4LEdE-MFYMrCypEIp2KCS7pztXyA==
logo.svg
www.nomoreransom.org/assets/img/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nomoreransom.org/assets/img/logo.svg
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/crypto-sheriff.php?lang=es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.52.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-52-94.cdg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ee8467ad84a6c64d23720adfbebde00b143d7972d47adc4923f7b4f2b368a539

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://www.nomoreransom.org/crypto-sheriff.php?lang=es
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

x-amz-version-id
pcFKjnPaaG0DaJebidw3uHKYozLlDg_R
content-encoding
gzip
via
1.1 62c19c8529da15502cb35329ecc9b474.cloudfront.net (CloudFront)
date
Fri, 21 Jul 2023 06:34:54 GMT
last-modified
Thu, 29 Jun 2023 14:58:47 GMT
server
AmazonS3
x-amz-cf-pop
CDG50-P4
age
21064
x-amz-server-side-encryption
AES256
etag
W/"71bcc8a426da74bf60abb493c18d4e93"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
x-amz-cf-id
1NXfY5myFyn7ahuT7SgO3vaF0sNQ9wADtkzSCtzBsXvmjn1Et8iLxA==
europol-logo.png
www.nomoreransom.org/assets/img/footer/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nomoreransom.org/assets/img/footer/europol-logo.png
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/crypto-sheriff.php?lang=es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.52.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-52-94.cdg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f24390f89caeb137c491283cdc7b052b172f0d699bf70a563e8a6710406b0dbd

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://www.nomoreransom.org/crypto-sheriff.php?lang=es
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

x-amz-version-id
klsYv4vbx2y_O9OrAoEIy0vuzuBZfL8P
date
Fri, 21 Jul 2023 08:42:56 GMT
via
1.1 62c19c8529da15502cb35329ecc9b474.cloudfront.net (CloudFront)
last-modified
Thu, 29 Jun 2023 14:58:47 GMT
server
AmazonS3
x-amz-cf-pop
CDG50-P4
age
13383
x-amz-server-side-encryption
AES256
etag
"b61080f43aee5655717a4780a56b1826"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
1158
x-amz-cf-id
zsqH1qkXUfHWa6txFfbr8h-urujm5AcXdF_-kHioWzzK-XUghSVuDw==
politie-logo.png
www.nomoreransom.org/assets/img/footer/ 		804 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nomoreransom.org/assets/img/footer/politie-logo.png
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/crypto-sheriff.php?lang=es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.52.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-52-94.cdg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
cd9c5c4115c3fd12ce0a3593702ddfe7cad19586b6b858f318cbf05f3508e2f7

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://www.nomoreransom.org/crypto-sheriff.php?lang=es
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

x-amz-version-id
1Yrh81XxCwTNAgL2jbUjzGxuIlQlO0.7
date
Fri, 21 Jul 2023 07:05:07 GMT
via
1.1 62c19c8529da15502cb35329ecc9b474.cloudfront.net (CloudFront)
last-modified
Thu, 29 Jun 2023 14:58:47 GMT
server
AmazonS3
x-amz-cf-pop
CDG50-P4
age
19252
x-amz-server-side-encryption
AES256
etag
"c351e216164809c8fb7277b3e2699d5e"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
804
x-amz-cf-id
FIyrROvH_r_VP0ogx4w0zBccNuj4IxXfcHDv1Aa5Sp8Wp6KEIeoOaA==
amazon-web-services-logo.png
www.nomoreransom.org/assets/img/footer/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nomoreransom.org/assets/img/footer/amazon-web-services-logo.png
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/crypto-sheriff.php?lang=es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.52.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-52-94.cdg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0fbc09a047799e085be3887dbc64dd34db7437f2777af69de12d7003a8071124

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://www.nomoreransom.org/crypto-sheriff.php?lang=es
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

x-amz-version-id
KY85h1wQI6gKae8boQ9ZP.BI8njGYZYC
date
Thu, 20 Jul 2023 18:46:56 GMT
via
1.1 62c19c8529da15502cb35329ecc9b474.cloudfront.net (CloudFront)
last-modified
Thu, 29 Jun 2023 14:58:47 GMT
server
AmazonS3
x-amz-cf-pop
CDG50-P4
age
63543
x-amz-server-side-encryption
AES256
etag
"26acb7a1d6e2fe1c86b94680e745b8a8"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
1964
x-amz-cf-id
doE71rHoKB1-LKiuX-KD1wC7i7sUr5-xJ4D8LfPnpGAIVk1p6UASkg==
barracuda-logo.png
www.nomoreransom.org/assets/img/footer/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.nomoreransom.org/assets/img/footer/barracuda-logo.png
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/crypto-sheriff.php?lang=es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.52.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-52-94.cdg50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3bb2f0eab2fecdcc31f63598b92611e982a6e44010b0bc29f90d977f680009d6

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://www.nomoreransom.org/crypto-sheriff.php?lang=es
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

x-amz-version-id
TQmvq3Psad70hgKKzYrz9qFF8UA6R6uA
date
Fri, 21 Jul 2023 12:16:44 GMT
via
1.1 62c19c8529da15502cb35329ecc9b474.cloudfront.net (CloudFront)
last-modified
Thu, 29 Jun 2023 14:58:47 GMT
server
AmazonS3
x-amz-cf-pop
CDG50-P4
age
9514
x-amz-server-side-encryption
AES256
etag
"ec09d4c961dbe1f0a0dd1fd46c763e8c"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
1271
x-amz-cf-id
gejXHNvsDy1_LGfz_UqSPeJ6DYE747UF0UzubfiD4xbIs0XOPIA5Ag==
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.nomoreransom.org
URL: https://www.nomoreransom.org/crypto-sheriff.php?lang=es
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://www.nomoreransom.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 21 Jul 2023 10:35:19 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
6640
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Fri, 21 Jul 2023 12:35:19 GMT
collect
www.google-analytics.com/j/ 		16 B
226 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1554090301&t=pageview&_s=1&dl=https%3A%2F%2Fwww.nomoreransom.org%2Fcrypto-sheriff.php%3Flang%3Des&ul=en-us&de=UTF-8&dt=Crypto%20Sheriff%20%7C%20The%20No%20More%20Ransom%20Project&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=852231325&gjid=1859419649&cid=1624575929.1689942359&tid=UA-61587331-39&_gid=579003589.1689942359&_r=1&_slc=1&z=1158878936
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
ebe25ca5798a17940153c47e1cfd235823491b7b5c4f2d4539f24b86fdc096c1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.nomoreransom.org/
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 21 Jul 2023 12:25:59 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.nomoreransom.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
16
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		1 B
350 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-61587331-39&cid=1624575929.1689942359&jid=852231325&gjid=1859419649&_gid=579003589.1689942359&_u=IEBAAEAAAAAAACAAI~&z=744029408
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c02::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.nomoreransom.org/
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Fri, 21 Jul 2023 12:25:59 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.nomoreransom.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		222 KB
79 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-V07YT61P6E&cx=c&_slc=1
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
c1555bdefaf6b99408eb57c6b948263256c587f0ec53a0f4bcdbc6741b3b4795
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://www.nomoreransom.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date
Fri, 21 Jul 2023 12:25:59 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
80257
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 21 Jul 2023 12:25:59 GMT
collect
region1.google-analytics.com/g/ 		0
258 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-V07YT61P6E&gtm=45je37j0&_p=1554090301&ul=en-us&sr=1600x1200&cid=1624575929.1689942359&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EBAI&_s=1&dl=https%3A%2F%2Fwww.nomoreransom.org%2Fcrypto-sheriff.php%3Flang%3Des&dt=Crypto%20Sheriff%20%7C%20The%20No%20More%20Ransom%20Project&sid=1689942359&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-V07YT61P6E&cx=c&_slc=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://www.nomoreransom.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 21 Jul 2023 12:25:59 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.nomoreransom.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| applyFocusVisiblePolyfill function| $ function| jQuery object| languages function| ransomFilter function| setCookie function| getCookie function| eraseCookie string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| dataLayer object| google_tag_manager

5 Cookies

Domain/Path Name / Value
www.nomoreransom.org/ Name: AWSALB
Value: GvEBe4I4pqzenabnXX5FTJPkczxfFyXoIK4oMiXSdYaxfX6KZCGPzrS96QstzFC6NxM1OnTZmBBw7ZV8SkIivaR+5Kn33kO/tMRx4RxdA+f9/ygA+vKnlZWcsUyY
.nomoreransom.org/ Name: _ga
Value: GA1.2.1624575929.1689942359
.nomoreransom.org/ Name: _gid
Value: GA1.2.579003589.1689942359
.nomoreransom.org/ Name: _gat
Value: 1
.nomoreransom.org/ Name: _ga_V07YT61P6E
Value: GS1.2.1689942359.1.0.1689942359.0.0.0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
region1.google-analytics.com
stats.g.doubleclick.net
www.google-analytics.com
www.googletagmanager.com
www.nomoreransom.org
18.164.52.94
2001:4860:4802:34::36
2a00:1450:4001:801::200e
2a00:1450:4001:810::2003
2a00:1450:4001:81c::2008
2a00:1450:4001:82a::200a
2a00:1450:400c:c02::9c
0c69757d7851e69197ccae0aa6833cb7e5aebe67c2218912a57fae12a950ae7e
0fbc09a047799e085be3887dbc64dd34db7437f2777af69de12d7003a8071124
3bb2f0eab2fecdcc31f63598b92611e982a6e44010b0bc29f90d977f680009d6
3c5aea3a4593b577f1028ba16238bc9e5292c3229a7ae4ab3938f8d5752f6e82
6abe5b4a45660d2e1c1a6f439d996d8a69a7a1a472be169c3121ade517b7ab05
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
956dca77253398f43beb32d902244b66e87536916e245fab92f9cd34a0863596
9948904482d7360bca57c45d56600f94fef548260e9dddf030b4d80dc72a3c56
b4112d80e8348927d315ecb2c7c01b1295e90e609880b10675698458730ea50c
be2f116625fa05783c5e3711e8fe64fce2e6612f2366d8a4d8f8e5a14d484e9e
c1555bdefaf6b99408eb57c6b948263256c587f0ec53a0f4bcdbc6741b3b4795
ca02cfb58d830fe9efb23f0c518f46103d6dd70b61115891055b8775531c4e92
cd9c5c4115c3fd12ce0a3593702ddfe7cad19586b6b858f318cbf05f3508e2f7
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb2ae537227129e2973c5ebdfa1f18e7c9c68e71fc116327559d3a547badacca
ebe25ca5798a17940153c47e1cfd235823491b7b5c4f2d4539f24b86fdc096c1
ee8467ad84a6c64d23720adfbebde00b143d7972d47adc4923f7b4f2b368a539
f1ce64ff9ffd6fa3dd9668d39a36232a2248a8b8602d527f2a1d204112e63177
f24390f89caeb137c491283cdc7b052b172f0d699bf70a563e8a6710406b0dbd
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e