urlscan.io logo urlscan.io
SecurityTrails logo

t.co Open in urlscan Pro
104.244.42.133  Public Scan

Go To Rescan Add Verdict Report
URL: https://t.co/JR3qBR2def
Submission: On August 28 via manual from IL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 2 countries across 6 domains to perform 74 HTTP transactions. The main IP is 104.244.42.133, located in San Francisco, United States and belongs to TWITTER - Twitter Inc., US. The main domain is t.co.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on July 25th 2017. Valid for: a year.
This is the only time t.co was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 104.244.42.133 13414 (TWITTER)
54 199.168.117.22 32181 (ASN-GIGENET)
1 2a00:1450:400... 15169 (GOOGLE)
3 2400:cb00:204... 13335 (CLOUDFLAR...)
5 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
74 9
1    104.244.42.133 (San Francisco, United States)

ASN13414 (TWITTER - Twitter Inc., US)
t.co
54    199.168.117.22 (Arlington Heights, United States)

ASN32181 (ASN-GIGENET - GigeNET, US)
PTR: 22.117.168.199.hosted.by.thegcloud.com
www.helpnetsecurity.com
1    2a00:1450:4001:824::200a (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
fonts.googleapis.com
3    2400:cb00:2048:1::6813:c066 (United States)

ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US)
cdnjs.cloudflare.com
5    2a00:1450:4001:81e::200a (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
maps.googleapis.com
2    2a00:1450:4001:824::200e (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
www.google-analytics.com
6    2a00:1450:4001:824::2003 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
fonts.gstatic.com
1    2a00:1450:4009:815::2003 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
csi.gstatic.com
Domain Requested by
54 www.helpnetsecurity.com www.helpnetsecurity.com
6 fonts.gstatic.com www.helpnetsecurity.com
5 maps.googleapis.com www.helpnetsecurity.com
maps.googleapis.com
3 cdnjs.cloudflare.com www.helpnetsecurity.com
2 www.google-analytics.com www.helpnetsecurity.com
1 csi.gstatic.com www.helpnetsecurity.com
1 fonts.googleapis.com www.helpnetsecurity.com
1 t.co
74 8
Subject Issuer Validity Valid
t.co
DigiCert SHA2 Extended Validation Server CA		 2017-07-25 -
2018-11-05		 a year crt.sh
www.helpnetsecurity.com
DigiCert SHA2 Secure Server CA		 2015-12-28 -
2019-03-06		 3 years crt.sh
*.googleapis.com
Google Internet Authority G2		 2017-08-15 -
2017-11-07		 3 months crt.sh
ssl412106.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2017-05-27 -
2017-12-03		 6 months crt.sh
*.google-analytics.com
Google Internet Authority G2		 2017-08-15 -
2017-11-07		 3 months crt.sh
*.google.com
Google Internet Authority G2		 2017-08-15 -
2017-11-07		 3 months crt.sh

This page contains 2 frames:

Frame: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Frame ID: 28450.1
Requests: 2 HTTP requests in this frame

Frame: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Frame ID: 28477.1
Requests: 73 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

74
Requests

99 %
HTTPS

75 %
IPv6

6
Domains

8
Subdomains

9
IPs

2
Countries

1151 kB
Transfer

1800 kB
Size

5
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request 0
  • http://bit.ly/2whwviN
  • https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/

74 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request JR3qBR2def
t.co/ 		257 B
200 B 		Document
General
Check archive.org
Download Go to
Full URL
https://t.co/JR3qBR2def
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.133 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software
tsa_o /
Resource Hash
94838949780a839b8daf9b6300cfa75d06487a49f3e21d442491e633947ec51a
Security Headers
Name Value
Content-Security-Policy referrer always;
Strict-Transport-Security max-age=0
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

x-response-time
117
content-security-policy
referrer always;
content-encoding
gzip
referrer-policy
unsafe-url
server
tsa_o
date
Mon, 28 Aug 2017 11:54:48 GMT
strict-transport-security
max-age=0
content-type
text/html; charset=utf-8
status
200
cache-control
private,max-age=300
x-connection-hash
d0c9150220c415e5ae2bc010840ab2e4
content-length
191
x-xss-protection
1; mode=block
expires
Mon, 28 Aug 2017 11:59:48 GMT
/
www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Redirect Chain
  • http://bit.ly/2whwviN
  • https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
 		0
0
/
www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/ Frame 2847 		116 KB
19 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) / PHP/5.6.31
Resource Hash
316f9ad70b1da06cfd9e8c644c6b67f6105454f581cbb0337cf5fa65d35c9a4d

Request headers

Upgrade-Insecure-Requests
1
Referer
https://t.co/JR3qBR2def
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 28 Aug 2017 18:47:31 GMT
Content-Encoding
gzip
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.6.31
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
close
Link
<https://www.helpnetsecurity.com/wp-json/>; rel="https://api.w.org/", <https://www.helpnetsecurity.com/?p=69764>; rel=shortlink
Content-Length
19524
Expires
Thu, 19 Nov 1981 08:52:00 GMT
remodal-1.0.1.css
www.helpnetsecurity.com/wp-content/plugins/hns-tools/assets/js/remodal/ Frame 2847 		2 KB
659 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/plugins/hns-tools/assets/js/remodal/remodal-1.0.1.css?ver=1.1.0
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
6b986cc934432b19f05b4a2f0d0f5fbeb96cf698b545465df15cf53c35ecd196

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:32 GMT
Content-Encoding
gzip
Last-Modified
Mon, 16 Jan 2017 16:56:08 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31536000
Connection
close
Accept-Ranges
bytes
Content-Length
659
Expires
Tue, 28 Aug 2018 18:47:32 GMT
remodal-default-theme-1.0.1.css
www.helpnetsecurity.com/wp-content/plugins/hns-tools/assets/js/remodal/ Frame 2847 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/plugins/hns-tools/assets/js/remodal/remodal-default-theme-1.0.1.css?ver=1.1.0
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
370c49c5ba241c54b36196c644394dd9f91554a875ab4dbfae6549ca7088dee3

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:32 GMT
Content-Encoding
gzip
Last-Modified
Mon, 16 Jan 2017 16:56:09 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31536000
Connection
close
Accept-Ranges
bytes
Content-Length
1320
Expires
Tue, 28 Aug 2018 18:47:32 GMT
hnst-1.0.1.css
www.helpnetsecurity.com/wp-content/plugins/hns-tools/assets/css/ Frame 2847 		829 B
357 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/plugins/hns-tools/assets/css/hnst-1.0.1.css?ver=1.0.1
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
b11735d37dd9df13e8e29fb6051d9e222b79c4154199bac1718ac5ae4d902f72

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:32 GMT
Content-Encoding
gzip
Last-Modified
Mon, 16 Jan 2017 16:56:01 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31536000
Connection
close
Accept-Ranges
bytes
Content-Length
357
Expires
Tue, 28 Aug 2018 18:47:32 GMT
bar.min.css
www.helpnetsecurity.com/wp-content/plugins/mailchimp-top-bar/assets/css/ Frame 2847 		4 KB
917 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/plugins/mailchimp-top-bar/assets/css/bar.min.css?ver=1.2.16
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
79fb00a58c109ef4bec1709595bb4464c0534ab618a0a053513ebda58878a726

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:32 GMT
Content-Encoding
gzip
Last-Modified
Thu, 19 Jan 2017 17:06:38 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31536000
Connection
close
Accept-Ranges
bytes
Content-Length
917
Expires
Tue, 28 Aug 2018 18:47:32 GMT
form-themes.min.css
www.helpnetsecurity.com/wp-content/plugins/mailchimp-for-wp/assets/css/ Frame 2847 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/plugins/mailchimp-for-wp/assets/css/form-themes.min.css?ver=4.1.6
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
b6d12ae932ef5b95b0fcdd0af5a430af06afbbe34a94fa700e353cf96eff7d5e

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:32 GMT
Content-Encoding
gzip
Last-Modified
Mon, 31 Jul 2017 22:21:21 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31536000
Connection
close
Accept-Ranges
bytes
Content-Length
1585
Expires
Tue, 28 Aug 2018 18:47:32 GMT
css
fonts.googleapis.com/ Frame 2847 		3 KB
651 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto%3A400%2C100%2C100italic%2C300%2C300italic%2C400italic%2C500%2C500italic%2C700%2C700italic%2C900%2C900italic&subset=latin%2Clatin-ext
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:824::200a , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
ESF /
Resource Hash
b4168629ce22b6a641bbb3608be20e7fa95054bbf1235b9bc4960f2a97522032
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

date
Mon, 28 Aug 2017 11:54:50 GMT
content-encoding
gzip
server
ESF
status
200
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
x-xss-protection
1; mode=block
expires
Mon, 28 Aug 2017 11:54:50 GMT
styles.css
www.helpnetsecurity.com/wp-content/themes/hns/assets/css/hns-icons/ Frame 2847 		2 KB
554 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/css/hns-icons/styles.css?ver=1.0
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
4216ac08edacd9cc26e971b634c81e03d39901a43d04b7019160df4344ef8e52

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:32 GMT
Content-Encoding
gzip
Last-Modified
Thu, 09 Feb 2017 16:40:28 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31536000
Connection
close
Accept-Ranges
bytes
Content-Length
554
Expires
Tue, 28 Aug 2018 18:47:32 GMT
owl.carousel.min.css
cdnjs.cloudflare.com/ajax/libs/owl-carousel/1.3.3/ Frame 2847 		1 KB
417 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/owl-carousel/1.3.3/owl.carousel.min.css?ver=1.3.3
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6813:c066 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
7c39dc75c9579402ea4771ce3b7e0e187c5e93dd6af00a660f780695d33e4678

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

date
Mon, 28 Aug 2017 11:54:50 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 22 Jun 2016 20:06:50 GMT
server
cloudflare-nginx
status
200
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
395713ffda5163af-FRA
expires
Sat, 18 Aug 2018 11:54:50 GMT
owl.transitions.min.css
cdnjs.cloudflare.com/ajax/libs/owl-carousel/1.3.3/ Frame 2847 		4 KB
597 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/owl-carousel/1.3.3/owl.transitions.min.css?ver=1.3.3
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6813:c066 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
757c8e2aef7abba7d397c133b90c88464c41108cd52cf413f1cd7a3520a5e127

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

date
Mon, 28 Aug 2017 11:54:50 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 22 Jun 2016 20:06:50 GMT
server
cloudflare-nginx
status
200
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
395713ffda5263af-FRA
expires
Sat, 18 Aug 2018 11:54:50 GMT
lightbox.min.css
www.helpnetsecurity.com/wp-content/themes/hns/assets/js/lightbox/css/ Frame 2847 		3 KB
938 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/js/lightbox/css/lightbox.min.css?ver=2.9.0
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
894fd68751cc02cfcd829bab0c0bb5e1eed2dc592595c27968f9e93c37673ba7

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:32 GMT
Content-Encoding
gzip
Last-Modified
Thu, 09 Feb 2017 16:41:05 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31536000
Connection
close
Accept-Ranges
bytes
Content-Length
938
Expires
Tue, 28 Aug 2018 18:47:32 GMT
style.css
www.helpnetsecurity.com/wp-content/themes/hns/ Frame 2847 		173 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns/style.css?ver=06796bce69fa8e829bfbbdd89bd0f24e
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3d060ee7e0d227afa3b36fb29756c6f3ea239fbd82e16013d1a9f1233934bcf9

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:32 GMT
Content-Encoding
gzip
Last-Modified
Thu, 09 Feb 2017 16:42:19 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31536000
Connection
close
Accept-Ranges
bytes
Content-Length
24317
Expires
Tue, 28 Aug 2018 18:47:32 GMT
style-custom.css
www.helpnetsecurity.com/wp-content/themes/hns/ Frame 2847 		297 B
209 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns/style-custom.css?ver=1.0
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
b828d9c310c4b20b7cb4d90e33970668cae263a516f31fb19be4a083d2eef552

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:32 GMT
Content-Encoding
gzip
Last-Modified
Thu, 09 Feb 2017 16:42:17 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31536000
Connection
close
Accept-Ranges
bytes
Content-Length
209
Expires
Tue, 28 Aug 2018 18:47:32 GMT
jquery.js
www.helpnetsecurity.com/wp-includes/js/jquery/ Frame 2847 		95 KB
95 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-includes/js/jquery/jquery.js?ver=1.12.4
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:32 GMT
Last-Modified
Wed, 22 Jun 2016 16:28:49 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
text/javascript
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
97184
Expires
Wed, 27 Sep 2017 18:47:32 GMT
jquery-migrate.min.js
www.helpnetsecurity.com/wp-includes/js/jquery/ Frame 2847 		10 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:32 GMT
Last-Modified
Wed, 22 Jun 2016 16:28:49 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
text/javascript
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
10056
Expires
Wed, 27 Sep 2017 18:47:32 GMT
ransvrh.jpg
www.helpnetsecurity.com/wp-content/uploads/2017/06/ Frame 2847 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2017/06/ransvrh.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
f84124206be5b8a17003c60170b088136c0189e9067067b86f3668d31b420b5e

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Wed, 21 Jun 2017 21:57:48 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
36775
Expires
Wed, 27 Sep 2017 18:47:34 GMT
avatar-zeljka-100x100.jpg
www.helpnetsecurity.com/wp-content/uploads/2015/12/ Frame 2847 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2015/12/avatar-zeljka-100x100.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
13d85df1b5d47bb2997e0e0a08e44a59bb2b9b4cdd977008a81af21d26888c0d

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:33 GMT
Last-Modified
Wed, 16 Dec 2015 09:59:09 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
21431
Expires
Wed, 27 Sep 2017 18:47:33 GMT
defray-ransom-note.jpg
www.helpnetsecurity.com/images/posts/ Frame 2847 		243 KB
243 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/images/posts/defray-ransom-note.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
030831c76a62b7a7b7d87f2480d08201f15d661d54ca09cff56009c9ce32e27d

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:33 GMT
Last-Modified
Mon, 28 Aug 2017 16:13:29 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
249105
Expires
Wed, 27 Sep 2017 18:47:33 GMT
dark-1-400x200.jpeg
www.helpnetsecurity.com/wp-content/uploads/2017/08/ Frame 2847 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2017/08/dark-1-400x200.jpeg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
b588ebf851ab4bd513509bf669f3ea70fc647874316496dfad238b22edacce26

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:33 GMT
Last-Modified
Wed, 23 Aug 2017 16:22:36 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
13185
Expires
Wed, 27 Sep 2017 18:47:33 GMT
ransdes.jpg
www.helpnetsecurity.com/wp-content/uploads/2017/06/ Frame 2847 		39 KB
39 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2017/06/ransdes.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
d321fd7b972551638cca17a8611a2767d7904e2e0ba5970a99963f99f7e55dd0

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:33 GMT
Last-Modified
Wed, 21 Jun 2017 21:57:50 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
40168
Expires
Wed, 27 Sep 2017 18:47:33 GMT
target-100x100.jpg
www.helpnetsecurity.com/wp-content/uploads/2016/03/ Frame 2847 		20 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2016/03/target-100x100.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
81b809766022ca0b78554d505a7cfb144ed5a9c07e02008d0a14cf952d8eb403

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:33 GMT
Last-Modified
Thu, 31 Mar 2016 21:37:34 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
20885
Expires
Wed, 27 Sep 2017 18:47:33 GMT
gdpr-100x100.jpg
www.helpnetsecurity.com/wp-content/uploads/2017/05/ Frame 2847 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2017/05/gdpr-100x100.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
c2dbf853e7eaaf95cb56b935f4f35ae2a8699e4f1b874cd98a5e7bf3ee678b23

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:33 GMT
Last-Modified
Wed, 03 May 2017 18:49:51 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
5084
Expires
Wed, 27 Sep 2017 18:47:33 GMT
laptop-eyes-technology-computer-100x100.jpg
www.helpnetsecurity.com/wp-content/uploads/2016/05/ Frame 2847 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2016/05/laptop-eyes-technology-computer-100x100.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
cda2f498564432d187c4362d64efac935bc40f8d8af5c348b06ac530592c332b

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:33 GMT
Last-Modified
Thu, 19 May 2016 15:48:25 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
16927
Expires
Wed, 27 Sep 2017 18:47:33 GMT
main-securing-the-iot-100x100.jpg
www.helpnetsecurity.com/wp-content/uploads/2017/08/ Frame 2847 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2017/08/main-securing-the-iot-100x100.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
cfa8f3d477b154af9a40b92d1f793ead0bc2ceaa9b186b034446cd43e121cf9d

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:33 GMT
Last-Modified
Fri, 25 Aug 2017 16:36:25 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
3728
Expires
Wed, 27 Sep 2017 18:47:33 GMT
quantum-100x100.jpg
www.helpnetsecurity.com/wp-content/uploads/2017/03/ Frame 2847 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2017/03/quantum-100x100.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
f5b0499b95220732c168c6eb178a9953ee0260267e88a6f0e9db27b1207a9706

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:33 GMT
Last-Modified
Wed, 08 Mar 2017 15:48:51 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
7078
Expires
Wed, 27 Sep 2017 18:47:33 GMT
sqrrl-binary-100x100.jpg
www.helpnetsecurity.com/wp-content/uploads/2017/08/ Frame 2847 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2017/08/sqrrl-binary-100x100.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ca569fd2e451e08f1b2fad1428cc529bfeaefd6ec4d7e07ef8612ba497e42d07

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Mon, 28 Aug 2017 14:30:54 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
3855
Expires
Wed, 27 Sep 2017 18:47:34 GMT
target-227x164.jpg
www.helpnetsecurity.com/wp-content/uploads/2016/03/ Frame 2847 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2016/03/target-227x164.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3556940b98c02947b4d37bc7e00a98795869e79f6eaaadfcf4c88cee2e90a3ec

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Thu, 31 Mar 2016 21:37:35 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
27974
Expires
Wed, 27 Sep 2017 18:47:34 GMT
sqrrl-binary-227x164.jpg
www.helpnetsecurity.com/wp-content/uploads/2017/08/ Frame 2847 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2017/08/sqrrl-binary-227x164.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
6be272f20c9ac76d09686e0962cbd8520c38d9ff7a5dbe19adaab7167b39fe87

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Mon, 28 Aug 2017 14:30:55 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
9738
Expires
Wed, 27 Sep 2017 18:47:34 GMT
gdpr-227x164.jpg
www.helpnetsecurity.com/wp-content/uploads/2017/05/ Frame 2847 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2017/05/gdpr-227x164.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
5467ddaf8dd900fd58cf5a5ac5a42fbbd91c8d4d2ee8b248260b5786dd4ade8d

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Wed, 03 May 2017 18:49:52 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
13080
Expires
Wed, 27 Sep 2017 18:47:34 GMT
laptop-eyes-technology-computer-227x164.jpg
www.helpnetsecurity.com/wp-content/uploads/2016/05/ Frame 2847 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2016/05/laptop-eyes-technology-computer-227x164.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
7c02092171340f354a340940e17c776031c97f992a9c746f2429bd182f2a7e33

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Thu, 19 May 2016 15:48:25 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
19080
Expires
Wed, 27 Sep 2017 18:47:34 GMT
main-securing-the-iot-227x164.jpg
www.helpnetsecurity.com/wp-content/uploads/2017/08/ Frame 2847 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2017/08/main-securing-the-iot-227x164.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
cc5a719ede03f8cf3640781ffa5ee66e5f366eca42c5beb57c4767d1636b1df6

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Fri, 25 Aug 2017 16:36:26 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
8864
Expires
Wed, 27 Sep 2017 18:47:34 GMT
cloud-227x164.jpg
www.helpnetsecurity.com/wp-content/uploads/2016/12/ Frame 2847 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2016/12/cloud-227x164.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
905017acc3861476bcaf236486041e61fda0e965d8750f64fb9a0ff377ade442

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Tue, 06 Dec 2016 21:38:38 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
9935
Expires
Wed, 27 Sep 2017 18:47:34 GMT
android-oreo-227x164.jpg
www.helpnetsecurity.com/wp-content/uploads/2017/08/ Frame 2847 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2017/08/android-oreo-227x164.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3dd6226446ff8da5438b13ca3ebf6f8befc572c9cdd37e247805f4a9b3f324e8

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:35 GMT
Last-Modified
Thu, 24 Aug 2017 13:27:35 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
10411
Expires
Wed, 27 Sep 2017 18:47:35 GMT
world-227x164.jpg
www.helpnetsecurity.com/wp-content/uploads/2016/11/ Frame 2847 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2016/11/world-227x164.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
d55036d4b75962ee0d48378969a1602d6579699cd1429a9750af34cdde3171e9

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:35 GMT
Last-Modified
Tue, 01 Nov 2016 16:19:22 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
4243
Expires
Wed, 27 Sep 2017 18:47:35 GMT
google-hand-227x164.jpg
www.helpnetsecurity.com/wp-content/uploads/2017/08/ Frame 2847 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2017/08/google-hand-227x164.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
bc04f2339ef604e208cb80df742824992c5af4f6322502f26f10b791d8940b54

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:35 GMT
Last-Modified
Wed, 23 Aug 2017 17:07:44 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
6188
Expires
Wed, 27 Sep 2017 18:47:35 GMT
dark-1-227x164.jpeg
www.helpnetsecurity.com/wp-content/uploads/2017/08/ Frame 2847 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2017/08/dark-1-227x164.jpeg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
b9c46520857062f3b5fa0cec47c8e2e71ec413d6f1ebd97cf722bf11ace9bf8e

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:35 GMT
Last-Modified
Wed, 23 Aug 2017 16:22:36 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
11517
Expires
Wed, 27 Sep 2017 18:47:35 GMT
ddos-world-227x164.jpg
www.helpnetsecurity.com/wp-content/uploads/2016/09/ Frame 2847 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2016/09/ddos-world-227x164.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
16108511a7dbd944e8f560bbe6de960302234f8c29bc60023bbf1d0ecf75f813

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:35 GMT
Last-Modified
Tue, 13 Sep 2016 21:59:06 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
12763
Expires
Wed, 27 Sep 2017 18:47:35 GMT
bridge-227x164.jpeg
www.helpnetsecurity.com/wp-content/uploads/2017/08/ Frame 2847 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/uploads/2017/08/bridge-227x164.jpeg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
fb8b6c233dd852eb82549152adb568c925080bf128c3db2763eff2041d67209d

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:35 GMT
Last-Modified
Wed, 23 Aug 2017 12:16:58 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
17878
Expires
Wed, 27 Sep 2017 18:47:35 GMT
microsite-magazine.jpg
www.helpnetsecurity.com/images/posts/ Frame 2847 		56 KB
56 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/images/posts/microsite-magazine.jpg
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
d8b315d9f0810015bbe647cab0a696b2edbe611a25a86a2c5c820553dbbf1eb3

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:35 GMT
Last-Modified
Fri, 22 Jul 2016 13:29:34 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
57005
Expires
Wed, 27 Sep 2017 18:47:35 GMT
remodal.min-1.0.1.js
www.helpnetsecurity.com/wp-content/plugins/hns-tools/assets/js/remodal/ Frame 2847 		8 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/plugins/hns-tools/assets/js/remodal/remodal.min-1.0.1.js?ver=1.1.0
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
c21ea2a0ec1a9c48686c58d481b308e247fa9f747d2208099ce598ef823e555c

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:33 GMT
Last-Modified
Mon, 16 Jan 2017 16:56:10 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
text/javascript
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
7806
Expires
Wed, 27 Sep 2017 18:47:33 GMT
ads.js
www.helpnetsecurity.com/wp-content/plugins/hns-tools/assets/js/ Frame 2847 		196 B
196 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/plugins/hns-tools/assets/js/ads.js?ver=1.0
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
42bab798cb49674bd7c3eba2a5b9b5d930aa56369822cccbc7fecf7ae67051b5

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Mon, 16 Jan 2017 16:56:05 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
text/javascript
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
196
Expires
Wed, 27 Sep 2017 18:47:34 GMT
hnst-1.0.1.js
www.helpnetsecurity.com/wp-content/plugins/hns-tools/assets/js/ Frame 2847 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/plugins/hns-tools/assets/js/hnst-1.0.1.js?ver=1.0.1
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
429deb9ba17eb9b3a104234ec64dac144fa21cfd676e35e2ad7ae0969cf957e6

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Mon, 16 Jan 2017 16:56:07 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
text/javascript
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
3061
Expires
Wed, 27 Sep 2017 18:47:34 GMT
hnst-daninja-1.0.1.js
www.helpnetsecurity.com/wp-content/plugins/hns-tools/assets/js/ Frame 2847 		322 B
322 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/plugins/hns-tools/assets/js/hnst-daninja-1.0.1.js?ver=1.0.1
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
abf17aa02154aa369ff5cd78cd28c898e126abda1811b7c14ff1be112e66b118

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Mon, 16 Jan 2017 16:56:08 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
text/javascript
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
322
Expires
Wed, 27 Sep 2017 18:47:34 GMT
script.min.js
www.helpnetsecurity.com/wp-content/plugins/mailchimp-top-bar/assets/js/ Frame 2847 		5 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/plugins/mailchimp-top-bar/assets/js/script.min.js?ver=1.2.16
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
58a14ea0086593359fa7a54b4e9bb5224d38b0f88596c0f3ba4325aae79f092f

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Thu, 19 Jan 2017 17:06:38 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
text/javascript
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
5142
Expires
Wed, 27 Sep 2017 18:47:34 GMT
owl.carousel.min.js
cdnjs.cloudflare.com/ajax/libs/owl-carousel/1.3.3/ Frame 2847 		23 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/owl-carousel/1.3.3/owl.carousel.min.js?ver=1.3.3
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6813:c066 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
e0e2bc4e1d3ee5024c4e1aa58a6cad9aa42fc63a8c89ce18013a1c8f2b94875c

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

date
Mon, 28 Aug 2017 11:54:51 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 22 Jun 2016 20:06:50 GMT
server
cloudflare-nginx
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
395714059e2863af-FRA
expires
Sat, 18 Aug 2018 11:54:51 GMT
modernizr-custom.js
www.helpnetsecurity.com/wp-content/themes/hns/assets/js/ Frame 2847 		7 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/js/modernizr-custom.js?ver=3.1.0
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
eda492db45bd35df08b0cd58fa453ee44a840e6ce297bc112c2f1ef631e58ee7

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Thu, 09 Feb 2017 16:41:14 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
text/javascript
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
7058
Expires
Wed, 27 Sep 2017 18:47:34 GMT
jquery.sticky-kit.min.js
www.helpnetsecurity.com/wp-content/themes/hns/assets/js/ Frame 2847 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/js/jquery.sticky-kit.min.js?ver=1.1.2
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
1ad6ef19b2b3182f66a2b868c62d0e2ce59b3128e8ebfb80c2a2188415113cda

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Thu, 09 Feb 2017 16:41:03 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
text/javascript
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
3283
Expires
Wed, 27 Sep 2017 18:47:34 GMT
lightbox.min.js
www.helpnetsecurity.com/wp-content/themes/hns/assets/js/lightbox/js/ Frame 2847 		9 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/js/lightbox/js/lightbox.min.js?ver=2.9.0
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
f6bec31e895f7b96a81fe6d48f8144a9106adad99a21707139851915a9428d21

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Thu, 09 Feb 2017 16:41:13 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
text/javascript
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
9372
Expires
Wed, 27 Sep 2017 18:47:34 GMT
js
maps.googleapis.com/maps/api/ Frame 2847 		71 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps/api/js?v=3.exp&ver=3
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81e::200a , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
mafe /
Resource Hash
4b405872293219fa759196915480f778482b588603f3e1017984ae684d5e68fd
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

date
Mon, 28 Aug 2017 11:54:51 GMT
content-encoding
gzip
vary
Accept-Language
server
mafe
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
public, max-age=1800
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
24041
x-xss-protection
1; mode=block
expires
Mon, 28 Aug 2017 12:24:51 GMT
init.js
www.helpnetsecurity.com/wp-content/themes/hns/assets/js/ Frame 2847 		15 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/js/init.js?ver=1.0
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
710db2a8c83743735b3bc529c351fea540bace4e7f04222af6c229c9b34f76d0

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Thu, 09 Feb 2017 16:41:03 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
text/javascript
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
15782
Expires
Wed, 27 Sep 2017 18:47:34 GMT
wp-embed.min.js
www.helpnetsecurity.com/wp-includes/js/ Frame 2847 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-includes/js/wp-embed.min.js?ver=06796bce69fa8e829bfbbdd89bd0f24e
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
dcb5e540e62fc85857254a1066afb6a7e8999279c6d4c583eef855d39f9289c0

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Wed, 07 Dec 2016 14:19:36 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
text/javascript
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
1398
Expires
Wed, 27 Sep 2017 18:47:34 GMT
forms-api.min.js
www.helpnetsecurity.com/wp-content/plugins/mailchimp-for-wp/assets/js/ Frame 2847 		12 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/plugins/mailchimp-for-wp/assets/js/forms-api.min.js?ver=4.1.6
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
11c461f533a7fcd0c5955d1adae6a88caf4426e1933dcacf7670646ac96d589b

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Mon, 31 Jul 2017 22:21:21 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
text/javascript
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
11929
Expires
Wed, 27 Sep 2017 18:47:34 GMT
ajax-forms.min.js
www.helpnetsecurity.com/wp-content/plugins/mc4wp-premium/ajax-forms/assets/js/ Frame 2847 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/plugins/mc4wp-premium/ajax-forms/assets/js/ajax-forms.min.js?ver=3.3.18
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
35daf65335d7e13c7451c262762ee8c83fd045af09f2512b801aca678f69da25

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:34 GMT
Last-Modified
Thu, 03 Aug 2017 20:31:11 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
text/javascript
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
3467
Expires
Wed, 27 Sep 2017 18:47:34 GMT
analytics.js
www.google-analytics.com/ Frame 2847 		32 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:824::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
Golfe2 /
Resource Hash
522cc831f77209aa434abd05e5a9a114ec3aab233232394877ea5446130584de
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 17 Aug 2017 01:11:09 GMT
server
Golfe2
age
2385
date
Mon, 28 Aug 2017 11:15:06 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
13472
expires
Mon, 28 Aug 2017 13:15:06 GMT
mbg.png
www.helpnetsecurity.com/wp-content/themes/hns/assets/images/ Frame 2847 		437 B
437 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/images/mbg.png
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
5aaeb64c022ed0f249fcdd9a7d3d6ac558f00726ddd25c8468003f773a4d68c0

Request headers

Referer
https://www.helpnetsecurity.com/wp-content/themes/hns/style.css?ver=06796bce69fa8e829bfbbdd89bd0f24e
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:33 GMT
Last-Modified
Thu, 09 Feb 2017 16:40:50 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/png
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
437
Expires
Wed, 27 Sep 2017 18:47:33 GMT
5M21SdFLkD52QavfmHs6cA.ttf
fonts.gstatic.com/s/roboto/v16/ Frame 2847 		51 KB
28 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v16/5M21SdFLkD52QavfmHs6cA.ttf
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:824::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
b0f2ebd32b79e8c4347c92163ad30b3876ecf3bdf89ee6b653ccadfb450030e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A400%2C100%2C100italic%2C300%2C300italic%2C400italic%2C500%2C500italic%2C700%2C700italic%2C900%2C900italic&subset=latin%2Clatin-ext
Origin
https://www.helpnetsecurity.com

Response headers

date
Thu, 03 Aug 2017 17:49:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2138720
status
200
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
28372
x-xss-protection
1; mode=block
last-modified
Mon, 17 Apr 2017 21:22:33 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 03 Aug 2018 17:49:31 GMT
hns-icons.woff
www.helpnetsecurity.com/wp-content/themes/hns/assets/css/hns-icons/fonts/ Frame 2847 		4 KB
4 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/css/hns-icons/fonts/hns-icons.woff
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
7acfd00d1a9131e79da27c56333d4f89d812b7fc78726167c0d287186813a334

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36
Referer
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/css/hns-icons/styles.css?ver=1.0
Origin
https://www.helpnetsecurity.com

Response headers

Date
Mon, 28 Aug 2017 18:47:33 GMT
Last-Modified
Thu, 09 Feb 2017 16:40:27 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
text/plain; charset=UTF-8
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
3588
Expires
Wed, 27 Sep 2017 18:47:33 GMT
97uahxiqZRoncBaCEI3aW6CWcynf_cDxXwCLxiixG1c.ttf
fonts.gstatic.com/s/roboto/v16/ Frame 2847 		51 KB
28 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v16/97uahxiqZRoncBaCEI3aW6CWcynf_cDxXwCLxiixG1c.ttf
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:824::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
b2c20af2cfa48b7a10f6d77a2af2e093c798ca31c3dfc4747ae7ef38b9d9a113
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A400%2C100%2C100italic%2C300%2C300italic%2C400italic%2C500%2C500italic%2C700%2C700italic%2C900%2C900italic&subset=latin%2Clatin-ext
Origin
https://www.helpnetsecurity.com

Response headers

date
Tue, 15 Aug 2017 21:36:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1088327
status
200
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
28337
x-xss-protection
1; mode=block
last-modified
Mon, 17 Apr 2017 21:22:14 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 15 Aug 2018 21:36:04 GMT
Pru33qjShpZSmG3z6VYwnaCWcynf_cDxXwCLxiixG1c.ttf
fonts.gstatic.com/s/roboto/v16/ Frame 2847 		51 KB
28 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v16/Pru33qjShpZSmG3z6VYwnaCWcynf_cDxXwCLxiixG1c.ttf
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:824::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
5b92d1cf4f1f1b10eb559c79ee44a214489dac79cb9cbad7bd710a4c151215c2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A400%2C100%2C100italic%2C300%2C300italic%2C400italic%2C500%2C500italic%2C700%2C700italic%2C900%2C900italic&subset=latin%2Clatin-ext
Origin
https://www.helpnetsecurity.com

Response headers

date
Thu, 03 Aug 2017 13:13:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2155275
status
200
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
28395
x-xss-protection
1; mode=block
last-modified
Mon, 17 Apr 2017 21:22:13 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 03 Aug 2018 13:13:36 GMT
9_7S_tWeGDh5Pq3u05RVkqCWcynf_cDxXwCLxiixG1c.ttf
fonts.gstatic.com/s/roboto/v16/ Frame 2847 		51 KB
28 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v16/9_7S_tWeGDh5Pq3u05RVkqCWcynf_cDxXwCLxiixG1c.ttf
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:824::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
074eb77bad351c4ab3c3735096b0543022dd0e45da85876d3ba09335c0ee8ea9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A400%2C100%2C100italic%2C300%2C300italic%2C400italic%2C500%2C500italic%2C700%2C700italic%2C900%2C900italic&subset=latin%2Clatin-ext
Origin
https://www.helpnetsecurity.com

Response headers

date
Thu, 03 Aug 2017 13:11:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2155409
status
200
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
28352
x-xss-protection
1; mode=block
last-modified
Mon, 17 Apr 2017 21:21:53 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 03 Aug 2018 13:11:22 GMT
oOeFwZNlrTefzLYmlVV1UKCWcynf_cDxXwCLxiixG1c.ttf
fonts.gstatic.com/s/roboto/v16/ Frame 2847 		51 KB
28 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v16/oOeFwZNlrTefzLYmlVV1UKCWcynf_cDxXwCLxiixG1c.ttf
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:824::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
935891d993e92489108f8f067f95ecd570a113d2fe4f93cb15423d217c677742
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A400%2C100%2C100italic%2C300%2C300italic%2C400italic%2C500%2C500italic%2C700%2C700italic%2C900%2C900italic&subset=latin%2Clatin-ext
Origin
https://www.helpnetsecurity.com

Response headers

date
Thu, 03 Aug 2017 15:27:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2147249
status
200
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
28402
x-xss-protection
1; mode=block
last-modified
Mon, 17 Apr 2017 21:22:17 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 03 Aug 2018 15:27:22 GMT
OKegwhKhBNN-dhuHI27Hy_esZW2xOQ-xsNqO47m55DA.ttf
fonts.gstatic.com/s/roboto/v16/ Frame 2847 		52 KB
30 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v16/OKegwhKhBNN-dhuHI27Hy_esZW2xOQ-xsNqO47m55DA.ttf
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:824::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
ef291d07dbf9e41a8d3dfe017b58df8b5b6283598a40b67a4e29236e460f9be2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A400%2C100%2C100italic%2C300%2C300italic%2C400italic%2C500%2C500italic%2C700%2C700italic%2C900%2C900italic&subset=latin%2Clatin-ext
Origin
https://www.helpnetsecurity.com

Response headers

date
Thu, 03 Aug 2017 20:11:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2130173
status
200
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
30205
x-xss-protection
1; mode=block
last-modified
Mon, 17 Apr 2017 21:21:39 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 03 Aug 2018 20:11:58 GMT
close.png
www.helpnetsecurity.com/wp-content/themes/hns/assets/js/lightbox/images/ Frame 2847 		280 B
280 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/js/lightbox/images/close.png
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
5d62e6c90005bfb71f6abb440f9e4753681cb23bbd5e60477ab6f442d2f0e69c

Request headers

Referer
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/js/lightbox/css/lightbox.min.css?ver=2.9.0
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:35 GMT
Last-Modified
Thu, 09 Feb 2017 16:41:06 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/png
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
280
Expires
Wed, 27 Sep 2017 18:47:35 GMT
loading.gif
www.helpnetsecurity.com/wp-content/themes/hns/assets/js/lightbox/images/ Frame 2847 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/js/lightbox/images/loading.gif
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
225aa88b6ab02c06222ec9468d62e15fa188e39cdb9431d1f55401ad380753ed

Request headers

Referer
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/js/lightbox/css/lightbox.min.css?ver=2.9.0
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:35 GMT
Last-Modified
Thu, 09 Feb 2017 16:41:07 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/gif
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
8476
Expires
Wed, 27 Sep 2017 18:47:35 GMT
prev.png
www.helpnetsecurity.com/wp-content/themes/hns/assets/js/lightbox/images/ Frame 2847 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/js/lightbox/images/prev.png
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
7fd9273f20fdb1229c224341271a119020a5eee74ccf6b4605730917c864caf2

Request headers

Referer
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/js/lightbox/css/lightbox.min.css?ver=2.9.0
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:35 GMT
Last-Modified
Thu, 09 Feb 2017 16:41:08 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/png
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
1360
Expires
Wed, 27 Sep 2017 18:47:35 GMT
next.png
www.helpnetsecurity.com/wp-content/themes/hns/assets/js/lightbox/images/ Frame 2847 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/js/lightbox/images/next.png
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.168.117.22 Arlington Heights, United States, ASN32181 (ASN-GIGENET - GigeNET, US),
Reverse DNS
22.117.168.199.hosted.by.thegcloud.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
15b869b02c6fbaa8c6c26445a2dd2d9bad80fd27b1409f8179e5dd89dc89d90a

Request headers

Referer
https://www.helpnetsecurity.com/wp-content/themes/hns/assets/js/lightbox/css/lightbox.min.css?ver=2.9.0
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

Date
Mon, 28 Aug 2017 18:47:35 GMT
Last-Modified
Thu, 09 Feb 2017 16:41:07 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
image/png
Cache-Control
max-age=2592000
Connection
close
Accept-Ranges
bytes
Content-Length
1350
Expires
Wed, 27 Sep 2017 18:47:35 GMT
collect
www.google-analytics.com/r/ Frame 2847 		35 B
53 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j60&a=953490532&t=pageview&_s=1&dl=https%3A%2F%2Fwww.helpnetsecurity.com%2F2017%2F08%2F28%2Fcustom-ransomware-delivered%2F&dr=https%3A%2F%2Ft.co%2FJR3qBR2def&ul=en-us&de=UTF-8&dt=New%2C%20custom%20ransomware%20delivered%20to%20orgs%20via%20extremely%20targeted%20emails%20-%20Help%20Net%20Security&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEABI~&jid=1799879944&gjid=741055916&cid=28563206.1503921291&tid=UA-73418497-1&_gid=1509944327.1503921291&_r=1&z=1707609465
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:824::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Aug 2017 11:54:51 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame 2847 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://csi.gstatic.com/csi?v=2&s=mapsapi3&v3v=30.2&action=apiboot2&e=10_1_0,10_2_0&rt=main.5
Requested by
Host: www.helpnetsecurity.com
URL: https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4009:815::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Aug 2017 11:54:52 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/ Frame 2847 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/gif
common.js
maps.googleapis.com/maps-api-v3/api/js/30/2/ Frame 2847 		114 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/30/2/common.js
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?v=3.exp&ver=3
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81e::200a , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
c0ae52d30a2cca451e1fe882365628e2f8fbdf069942aea3ed2b7d180cca689b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

date
Tue, 22 Aug 2017 23:51:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Aug 2017 06:12:54 GMT
server
sffe
age
475418
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
40391
x-xss-protection
1; mode=block
expires
Wed, 22 Aug 2018 23:51:19 GMT
util.js
maps.googleapis.com/maps-api-v3/api/js/30/2/ Frame 2847 		128 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/30/2/util.js
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?v=3.exp&ver=3
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81e::200a , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
d1e1766236a292ced308f5668403e043dc742ab33a25e93886c878c662726fa1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

date
Tue, 22 Aug 2017 23:51:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Aug 2017 06:12:54 GMT
server
sffe
age
475417
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
49316
x-xss-protection
1; mode=block
expires
Wed, 22 Aug 2018 23:51:20 GMT
stats.js
maps.googleapis.com/maps-api-v3/api/js/30/2/ Frame 2847 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/30/2/stats.js
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?v=3.exp&ver=3
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81e::200a , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
94410f0b77e3b2126df956dd15415d0a7bb7e56ed39668a33fa1aff30253933b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

date
Tue, 22 Aug 2017 23:51:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Aug 2017 06:12:54 GMT
server
sffe
age
475415
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
1558
x-xss-protection
1; mode=block
expires
Wed, 22 Aug 2018 23:51:22 GMT
AuthenticationService.Authenticate
maps.googleapis.com/maps/api/js/ Frame 2847 		48 B
75 B 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate?1shttps%3A%2F%2Fwww.helpnetsecurity.com%2F2017%2F08%2F28%2Fcustom-ransomware-delivered%2F&callback=_xdc_._dpk39w&token=25821
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?v=3.exp&ver=3
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81e::200a , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
mafe /
Resource Hash
501dfff7fc319c6193a8749d87e4d18bfe3f720e124c11e4a934c8f0e5f79b35
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 28 Aug 2017 11:54:57 GMT
content-encoding
gzip
server
mafe
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
57
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.helpnetsecurity.com
URL
https://www.helpnetsecurity.com/2017/08/28/custom-ransomware-delivered/

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Domain/Path Name / Value
.helpnetsecurity.com/ Name: _gat
Value: 1
.helpnetsecurity.com/ Name: _ga
Value: GA1.2.28563206.1503921291
.helpnetsecurity.com/ Name: _gid
Value: GA1.2.1509944327.1503921291
www.helpnetsecurity.com/ Name: PHPSESSID
Value: 64la4ibg9aidtkmds0m7slv055
www.helpnetsecurity.com/ Name: wfvt_34328101
Value: 59a46543bfafc

2 Console Messages

Source Level URL
Text
console-api log URL: https://www.helpnetsecurity.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1
console-api warning URL: https://maps.googleapis.com/maps-api-v3/api/js/30/2/util.js(Line 222)
Message:
Google Maps API warning: NoApiKeys https://developers.google.com/maps/documentation/javascript/error-messages#no-api-keys

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy referrer always;
Strict-Transport-Security max-age=0
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
csi.gstatic.com
fonts.googleapis.com
fonts.gstatic.com
maps.googleapis.com
t.co
www.google-analytics.com
www.helpnetsecurity.com
www.helpnetsecurity.com
104.244.42.133
199.168.117.22
2400:cb00:2048:1::6813:c066
2a00:1450:4001:81e::200a
2a00:1450:4001:824::2003
2a00:1450:4001:824::200a
2a00:1450:4001:824::200e
2a00:1450:4009:815::2003
030831c76a62b7a7b7d87f2480d08201f15d661d54ca09cff56009c9ce32e27d
074eb77bad351c4ab3c3735096b0543022dd0e45da85876d3ba09335c0ee8ea9
11c461f533a7fcd0c5955d1adae6a88caf4426e1933dcacf7670646ac96d589b
13d85df1b5d47bb2997e0e0a08e44a59bb2b9b4cdd977008a81af21d26888c0d
15b869b02c6fbaa8c6c26445a2dd2d9bad80fd27b1409f8179e5dd89dc89d90a
16108511a7dbd944e8f560bbe6de960302234f8c29bc60023bbf1d0ecf75f813
1ad6ef19b2b3182f66a2b868c62d0e2ce59b3128e8ebfb80c2a2188415113cda
225aa88b6ab02c06222ec9468d62e15fa188e39cdb9431d1f55401ad380753ed
316f9ad70b1da06cfd9e8c644c6b67f6105454f581cbb0337cf5fa65d35c9a4d
3556940b98c02947b4d37bc7e00a98795869e79f6eaaadfcf4c88cee2e90a3ec
35daf65335d7e13c7451c262762ee8c83fd045af09f2512b801aca678f69da25
370c49c5ba241c54b36196c644394dd9f91554a875ab4dbfae6549ca7088dee3
3d060ee7e0d227afa3b36fb29756c6f3ea239fbd82e16013d1a9f1233934bcf9
3dd6226446ff8da5438b13ca3ebf6f8befc572c9cdd37e247805f4a9b3f324e8
4216ac08edacd9cc26e971b634c81e03d39901a43d04b7019160df4344ef8e52
429deb9ba17eb9b3a104234ec64dac144fa21cfd676e35e2ad7ae0969cf957e6
42bab798cb49674bd7c3eba2a5b9b5d930aa56369822cccbc7fecf7ae67051b5
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4b405872293219fa759196915480f778482b588603f3e1017984ae684d5e68fd
501dfff7fc319c6193a8749d87e4d18bfe3f720e124c11e4a934c8f0e5f79b35
522cc831f77209aa434abd05e5a9a114ec3aab233232394877ea5446130584de
5467ddaf8dd900fd58cf5a5ac5a42fbbd91c8d4d2ee8b248260b5786dd4ade8d
58a14ea0086593359fa7a54b4e9bb5224d38b0f88596c0f3ba4325aae79f092f
5aaeb64c022ed0f249fcdd9a7d3d6ac558f00726ddd25c8468003f773a4d68c0
5b92d1cf4f1f1b10eb559c79ee44a214489dac79cb9cbad7bd710a4c151215c2
5d62e6c90005bfb71f6abb440f9e4753681cb23bbd5e60477ab6f442d2f0e69c
6b986cc934432b19f05b4a2f0d0f5fbeb96cf698b545465df15cf53c35ecd196
6be272f20c9ac76d09686e0962cbd8520c38d9ff7a5dbe19adaab7167b39fe87
710db2a8c83743735b3bc529c351fea540bace4e7f04222af6c229c9b34f76d0
757c8e2aef7abba7d397c133b90c88464c41108cd52cf413f1cd7a3520a5e127
79fb00a58c109ef4bec1709595bb4464c0534ab618a0a053513ebda58878a726
7acfd00d1a9131e79da27c56333d4f89d812b7fc78726167c0d287186813a334
7c02092171340f354a340940e17c776031c97f992a9c746f2429bd182f2a7e33
7c39dc75c9579402ea4771ce3b7e0e187c5e93dd6af00a660f780695d33e4678
7fd9273f20fdb1229c224341271a119020a5eee74ccf6b4605730917c864caf2
81b809766022ca0b78554d505a7cfb144ed5a9c07e02008d0a14cf952d8eb403
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
894fd68751cc02cfcd829bab0c0bb5e1eed2dc592595c27968f9e93c37673ba7
905017acc3861476bcaf236486041e61fda0e965d8750f64fb9a0ff377ade442
935891d993e92489108f8f067f95ecd570a113d2fe4f93cb15423d217c677742
94410f0b77e3b2126df956dd15415d0a7bb7e56ed39668a33fa1aff30253933b
94838949780a839b8daf9b6300cfa75d06487a49f3e21d442491e633947ec51a
abf17aa02154aa369ff5cd78cd28c898e126abda1811b7c14ff1be112e66b118
b0f2ebd32b79e8c4347c92163ad30b3876ecf3bdf89ee6b653ccadfb450030e0
b11735d37dd9df13e8e29fb6051d9e222b79c4154199bac1718ac5ae4d902f72
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2c20af2cfa48b7a10f6d77a2af2e093c798ca31c3dfc4747ae7ef38b9d9a113
b4168629ce22b6a641bbb3608be20e7fa95054bbf1235b9bc4960f2a97522032
b588ebf851ab4bd513509bf669f3ea70fc647874316496dfad238b22edacce26
b6d12ae932ef5b95b0fcdd0af5a430af06afbbe34a94fa700e353cf96eff7d5e
b828d9c310c4b20b7cb4d90e33970668cae263a516f31fb19be4a083d2eef552
b9c46520857062f3b5fa0cec47c8e2e71ec413d6f1ebd97cf722bf11ace9bf8e
bc04f2339ef604e208cb80df742824992c5af4f6322502f26f10b791d8940b54
c0ae52d30a2cca451e1fe882365628e2f8fbdf069942aea3ed2b7d180cca689b
c21ea2a0ec1a9c48686c58d481b308e247fa9f747d2208099ce598ef823e555c
c2dbf853e7eaaf95cb56b935f4f35ae2a8699e4f1b874cd98a5e7bf3ee678b23
ca569fd2e451e08f1b2fad1428cc529bfeaefd6ec4d7e07ef8612ba497e42d07
cc5a719ede03f8cf3640781ffa5ee66e5f366eca42c5beb57c4767d1636b1df6
cda2f498564432d187c4362d64efac935bc40f8d8af5c348b06ac530592c332b
cfa8f3d477b154af9a40b92d1f793ead0bc2ceaa9b186b034446cd43e121cf9d
d1e1766236a292ced308f5668403e043dc742ab33a25e93886c878c662726fa1
d321fd7b972551638cca17a8611a2767d7904e2e0ba5970a99963f99f7e55dd0
d55036d4b75962ee0d48378969a1602d6579699cd1429a9750af34cdde3171e9
d8b315d9f0810015bbe647cab0a696b2edbe611a25a86a2c5c820553dbbf1eb3
dcb5e540e62fc85857254a1066afb6a7e8999279c6d4c583eef855d39f9289c0
e0e2bc4e1d3ee5024c4e1aa58a6cad9aa42fc63a8c89ce18013a1c8f2b94875c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eda492db45bd35df08b0cd58fa453ee44a840e6ce297bc112c2f1ef631e58ee7
ef291d07dbf9e41a8d3dfe017b58df8b5b6283598a40b67a4e29236e460f9be2
f5b0499b95220732c168c6eb178a9953ee0260267e88a6f0e9db27b1207a9706
f6bec31e895f7b96a81fe6d48f8144a9106adad99a21707139851915a9428d21
f84124206be5b8a17003c60170b088136c0189e9067067b86f3668d31b420b5e
fb8b6c233dd852eb82549152adb568c925080bf128c3db2763eff2041d67209d
fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e