w.securelist.com Open in urlscan Pro
77.74.179.157 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz
Effective URL:
https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
Submission: On March 30 via manual (March 30th 2020, 10:12:59 pm UTC) from US

Summary HTTP 75 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 20 IPs in 8 countries across 25 domains to perform 75 HTTP transactions. The main IP is 77.74.179.157, located in Russian Federation and belongs to KL-EXT, RU. The main domain is w.securelist.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on February 25th 2020. Valid for: a year.

This is the only time w.securelist.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3 3	35.173.160.135 35.173.160.135	14618 (AMAZON-AES) (AMAZON-AES)
7	77.74.179.157 77.74.179.157	200107 (KL-EXT) (KL-EXT)
1	2a00:1450:400... 2a00:1450:4001:800::200a	15169 (GOOGLE) (GOOGLE)
1 3	2a00:1450:400... 2a00:1450:4001:808::2004	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:4104	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:81a::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81d::2008	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:81c::200e	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:400c:c08::9a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
3	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	23.38.48.101 23.38.48.101	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	13.224.194.7 13.224.194.7	16509 (AMAZON-02) (AMAZON-02)
1	143.204.94.29 143.204.94.29	16509 (AMAZON-02) (AMAZON-02)
3 3	104.109.80.223 104.109.80.223	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 3	37.252.172.250 37.252.172.250	29990 (ASN-APPNEX) (ASN-APPNEX)
1 1	35.227.248.159 35.227.248.159	15169 (GOOGLE) (GOOGLE)
6 9	18.184.247.200 18.184.247.200	16509 (AMAZON-02) (AMAZON-02)
2 2	52.17.92.255 52.17.92.255	16509 (AMAZON-02) (AMAZON-02)
1	147.75.102.200 147.75.102.200	54825 (PACKET) (PACKET)
1 2	172.217.18.166 172.217.18.166	15169 (GOOGLE) (GOOGLE)
2	185.31.128.128 185.31.128.128	54312 (ROCKETFUEL) (ROCKETFUEL)
1	52.19.29.48 52.19.29.48	16509 (AMAZON-02) (AMAZON-02)
75	20

3 35.173.160.135 (Ashburn, United States) 3 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-160-135.compute-1.amazonaws.com

www.securelist.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
securelist.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 77.74.179.157 (Russian Federation)

ASN200107 (KL-EXT, RU)

w.securelist.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
noransom.kaspersky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:808::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4104 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81c::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9a (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.38.48.101 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-38-48-101.deploy.static.akamaitechnologies.com

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.194.7 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-194-7.fra2.r.cloudfront.net

vt.myvisualiq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.94.29 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-94-29.fra50.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.109.80.223 (Netherlands) 3 redirects

ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-80-223.deploy.static.akamaitechnologies.com

s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.252.172.250 (Ascension Island) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.248.159 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 159.248.227.35.bc.googleusercontent.com

tapestry.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 18.184.247.200 (Frankfurt am Main, Germany) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-184-247-200.eu-central-1.compute.amazonaws.com

t.myvisualiq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.17.92.255 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-92-255.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.102.200 (Central, Hong Kong)

ASN54825 (PACKET, US)

loadus.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.166 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s29-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.31.128.128 (Netherlands)

ASN54312 (ROCKETFUEL, US)

a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
20730592p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.19.29.48 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-19-29-48.eu-west-1.compute.amazonaws.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	myvisualiq.net 6 redirects vt.myvisualiq.net t.myvisualiq.net	9 KB
6	kaspersky.com noransom.kaspersky.com	140 KB
4	securelist.com 3 redirects www.securelist.com securelist.com w.securelist.com	15 KB
3	adnxs.com 2 redirects ib.adnxs.com	3 KB
3	tribalfusion.com 3 redirects s.tribalfusion.com a.tribalfusion.com	1 KB
3	facebook.com www.facebook.com	672 B
3	doubleclick.net 2 redirects stats.g.doubleclick.net ad.doubleclick.net	1 KB
3	google.com 1 redirects www.google.com	915 B
2	rfihub.com a.rfihub.com 20730592p.rfihub.com	685 B
2	demdex.net 2 redirects dpm.demdex.net	2 KB
2	adsrvr.org js.adsrvr.org insight.adsrvr.org	2 KB
2	google-analytics.com 1 redirects www.google-analytics.com	18 KB
2	googletagmanager.com www.googletagmanager.com	111 KB
2	facebook.net connect.facebook.net	143 KB
1	exelator.com loadus.exelator.com	124 B
1	tapad.com 1 redirects tapestry.tapad.com	317 B
1	rfihub.net c1.rfihub.net	7 KB
1	google.de www.google.de	109 B
1	gstatic.com www.gstatic.com	93 KB
1	cloudflare.com cdnjs.cloudflare.com	29 KB
1	googleapis.com ajax.googleapis.com	6 KB
0	usabilla.com Failed w.usabilla.com Failed
0	contentsquare.net Failed t.contentsquare.net Failed
0	xg4ken.com Failed resources.xg4ken.com Failed
0	bing.com Failed bat.bing.com Failed
75	25

	Domain	Requested by
9	t.myvisualiq.net	6 redirects
6	noransom.kaspersky.com	w.securelist.com
3	ib.adnxs.com	2 redirects
3	www.facebook.com	w.securelist.com
3	www.google.com	1 redirects w.securelist.com www.gstatic.com
2	ad.doubleclick.net	1 redirects
2	dpm.demdex.net	2 redirects
2	s.tribalfusion.com	2 redirects
2	www.google-analytics.com	1 redirects www.googletagmanager.com
2	www.googletagmanager.com	w.securelist.com
2	connect.facebook.net	w.securelist.com connect.facebook.net
2	www.securelist.com	2 redirects
1	20730592p.rfihub.com	c1.rfihub.net
1	insight.adsrvr.org	js.adsrvr.org
1	a.rfihub.com	c1.rfihub.net
1	loadus.exelator.com
1	tapestry.tapad.com	1 redirects
1	a.tribalfusion.com	1 redirects
1	js.adsrvr.org	www.googletagmanager.com
1	vt.myvisualiq.net	www.googletagmanager.com
1	c1.rfihub.net	w.securelist.com
1	www.google.de	w.securelist.com
1	stats.g.doubleclick.net	1 redirects
1	www.gstatic.com	www.google.com
1	cdnjs.cloudflare.com	w.securelist.com
1	ajax.googleapis.com	w.securelist.com
1	w.securelist.com
1	securelist.com	1 redirects
0	w.usabilla.com Failed	w.securelist.com
0	t.contentsquare.net Failed	w.securelist.com
0	resources.xg4ken.com Failed	w.securelist.com
0	bat.bing.com Failed	w.securelist.com
75	32

This site contains links to these domains. Also see Links.

Domain
www.kaspersky.com
noransom.kaspersky.com
www.facebook.com
www.twitter.com
plus.google.com
twitter.com
www.youtube.com
kasperskyclub.com

Subject Issuer	Validity	Valid
noransom.kaspersky.com DigiCert SHA2 Secure Server CA	`2020-02-25` - `2021-03-01`	a year	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-12-05` - `2020-06-12`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-03-01` - `2020-05-30`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.rfihub.net DigiCert SHA2 Secure Server CA	`2019-01-25` - `2020-04-25`	a year	crt.sh
*.myvisualiq.net Amazon	`2019-11-14` - `2020-12-14`	a year	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
t.myvisualiq.net COMODO RSA Domain Validation Secure Server CA	`2017-07-05` - `2020-07-28`	3 years	crt.sh
*.exelator.com Go Daddy Secure Certificate Authority - G2	`2019-05-17` - `2021-06-25`	2 years	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.rfihub.com DigiCert SHA2 Secure Server CA	`2019-08-27` - `2020-08-31`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
Frame ID: 52D896E1503A8D397F457607AE100542
Requests: 72 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LciMlIUAAAAAGc3ehT3ev1Y0JBMf7_CGUGzSnwL&co=aHR0cHM6Ly93LnNlY3VyZWxpc3QuY29tOjQ0Mw..&hl=en&v=OOKISvkNnVD_m_9dreR_1S0n&size=normal&cb=ieb138k9rnph
Frame ID: D2B1F56680837957C16C30E9DCFC6F1C
Requests: 1 HTTP requests in this frame

Frame: https://w.usabilla.com/1649d5fbb67c.js?lv=1
Frame ID: 7421D8CD76D02880A089678DC3EE15CF
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=3flza28&ref=https%3A%2F%2Fw.securelist.com%2Fen%2Fdescriptions%2Ftrojan-gamethief.win32.magania.eogz&upid=5jbt2zb&upv=1.1.0
Frame ID: 77513CD801DDBEB2CE037D333F048A0E
Requests: 1 HTTP requests in this frame

Frame: https://20730592p.rfihub.com/ca.html?rfiidc=1582804167492665968&rfiaid=7bba47d2d62f41948e4bfc39ce9f23c4&ver=9&rb=20707&ca=20730592&pe=https%3A%2F%2Fw.securelist.com%2Fen%2Fdescriptions%2Ftrojan-gamethief.win32.magania.eogz&pf=&ra=8916102997430686
Frame ID: 2AE50B1CF0586D104409C0FDE06342FB
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz HTTP 301
https://www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz HTTP 301
https://securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz HTTP 301
https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
html //i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

script /\/recaptcha\/api\.js/i

Page Statistics

75
Requests

43 %
HTTPS

42 %
IPv6

25
Domains

32
Subdomains

20
IPs

8
Countries

566 kB
Transfer

1870 kB
Size

1
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://www.kaspersky.com/blog/kaspersky-anti-ransomware-tool-for-business/?utm_source=noransom&utm_medium=sm-project&utm_campaign=gl_kart_ay0073_organic&utm_content=banner&utm_term=gl_noransom_organic_ay0073_banner_sm-project_kart
Title: PROTECT YOUR BUSINESS GAINS FROM RANSOMWARE THREAT FOR FREE

Search URL Search Domain Scan URL

URL: https://noransom.kaspersky.com/
Title: Ransomware Decryptor

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/advert/advert/downloads/thank-you/internet-security-free-trial?redef=1&THRU&reseller=gl_noransom_acq_ona_smm__onl_b2c__lp____kis___
Title: Download trial

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/advert/advert/internet-security?redef=1&THRU&reseller=gl_noransom_acq_ona_smm__onl_b2c__lp____kis___
Title: Buy full version

Search URL Search Domain Scan URL

URL: http://www.facebook.com/sharer.php?s=100&p[title]=&p[url]=&p[images][0]=https://noransom.kaspersky.com/wp-content/themes/ransomware/static/img/assets/logo/logo-bg.png
Title:

Search URL Search Domain Scan URL

URL: http://www.twitter.com/share?url=
Title:

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=
Title:

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/web-privacy-policy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com/about/contact
Title: Legal

Search URL Search Domain Scan URL

URL: https://twitter.com/Kaspersky
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Kaspersky
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/Kaspersky
Title: YouTube

Search URL Search Domain Scan URL

URL: https://kasperskyclub.com/
Title: Club

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz HTTP 301
https://www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz HTTP 301
https://securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz HTTP 301
https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 49

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=991718989&t=pageview&_s=1&dl=https%3A%2F%2Fw.securelist.com%2Fen%2Fdescriptions%2Ftrojan-gamethief.win32.magania.eogz&dp=%2Fen%2Fdescriptions%2Ftrojan-gamethief.win32.magania.eogz&ul=en-us&de=UTF-8&dt=Free%20Ransomware%20Decryptors%20-%20Kaspersky&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAEAB~&jid=378827441&gjid=1671595420&cid=1755857266.1585606360&tid=UA-63997723-27&_gid=1966240923.1585606360&_r=1&gtm=2wg3i0WZ7LJ3&cd6=&cd7=&cd8=&cd9=&cd13=&cd14=sv_SE&cd37=0&cd40=0&cd16=1755857266.1585606360&z=996330106 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-63997723-27&cid=1755857266.1585606360&jid=378827441&_gid=1966240923.1585606360&gjid=1671595420&_v=j81&z=996330106 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-63997723-27&cid=1755857266.1585606360&jid=378827441&_v=j81&z=996330106 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-63997723-27&cid=1755857266.1585606360&jid=378827441&_v=j81&z=996330106&slf_rd=1&random=751399195

Request Chain 64

https://s.tribalfusion.com/i.cid?c=705083&ev=0&page=Global HTTP 302
https://s.tribalfusion.com/z/i.cid?c=705083&ev=0&page=Global HTTP 302
https://ib.adnxs.com/getuidu?https://a.tribalfusion.com/i.match?p=b26&u=$UID&redirect=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D305%26code%3D%24TF_USER_ID_ENC%24 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuidu%3Fhttps%3A%2F%2Fa.tribalfusion.com%2Fi.match%3Fp%3Db26%26u%3D%24UID%26redirect%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D305%2526code%253D%2524TF_USER_ID_ENC%2524 HTTP 302
https://a.tribalfusion.com/i.match?p=b26&u=3840305674342909104&redirect=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D305%26code%3D%24TF_USER_ID_ENC%24 HTTP 302
https://ib.adnxs.com/setuid?entity=305&code=18072662246930774519

Request Chain 66

https://tapestry.tapad.com/tapestry/1?ta_partner_id=950&ta_redirect=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3D1001%26ao%3D0%26pruuid%3DTAPAD_%24%7BIDS%3Akey%7D HTTP 302
https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_92a2cc31-72d3-11ea-b510-0a40cd988777

Request Chain 67

https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&red=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D125310%26dpuuid%3D%24%7BUUID%7D%26redir%3Dhttps%253A%252F%252Ft.myvisualiq.net%252Fsync%253Fprid%253DAOEPNR1%2526ao%253D0%2526pruuid%253D%2524%257BDD_UUID%257D%250A HTTP 302
https://t.myvisualiq.net/ul_cb/sync?prid=AOEPNR1&ao=0&red=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D125310%26dpuuid%3D%24%7BUUID%7D%26redir%3Dhttps%253A%252F%252Ft.myvisualiq.net%252Fsync%253Fprid%253DAOEPNR1%2526ao%253D0%2526pruuid%253D%2524%257BDD_UUID%257D%250A HTTP 302
https://dpm.demdex.net/ibs:dpid=125310&dpuuid=2c42fd8f-1e56-4e6b-9b59-27008e924e71&redir=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3DAOEPNR1%26ao%3D0%26pruuid%3D%24%7BDD_UUID%7D HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=125310&dpuuid=2c42fd8f-1e56-4e6b-9b59-27008e924e71&redir=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3DAOEPNR1%26ao%3D0%26pruuid%3D%24%7BDD_UUID%7D HTTP 302
https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&pruuid=43877991503779768830610072718123480184

Request Chain 68

https://t.myvisualiq.net/sync?prid=EEAEPNR1&red=https%3A%2F%2Floadus.exelator.com%2Fload%2F%3Fp%3D204%26g%3D1260%26buid%3D%24%7BUUID%7D HTTP 302
https://t.myvisualiq.net/ul_cb/sync?prid=EEAEPNR1&red=https%3A%2F%2Floadus.exelator.com%2Fload%2F%3Fp%3D204%26g%3D1260%26buid%3D%24%7BUUID%7D HTTP 302
https://loadus.exelator.com/load/?p=204&g=1260&buid=48065a64-1219-4d02-827f-60014eb3c97d

Request Chain 69

https://t.myvisualiq.net/sync?prid=Test&ao=0&red=https%253A%252F%252Fad.doubleclick.net%252Fddm%252Ftrackimp%252FN408002.2426714VISUALIQ%252FB10122619.135787232%253Bdc_trk_aid%253D308320322%253Bdc_trk_cid%253D72964178%253Bsz%253D1x1%253Bu%253D-https%25253A%25252F%25252Fw.securelist.com%25252Fen%25252Fdescriptions%25252Ftrojan-gamethief.win32.magania.eogz%7CVIQ_%24%7BUUID%7D%7C%3Bord%3D4159496 HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N408002.2426714VISUALIQ/B10122619.135787232;dc_trk_aid=308320322;dc_trk_cid=72964178;sz=1x1;u=-https%3A%2F%2Fw.securelist.com%2Fen%2Fdescriptions%2Ftrojan-gamethief.win32.magania.eogz%7CVIQ_0-1faf1de7-dc28-40b7-96dc-82948657a7d6%7C;ord=4159496 HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N408002.2426714VISUALIQ/B10122619.135787232;dc_pre=CNSmsv-bw-gCFc1EGwodDNcELg;dc_trk_aid=308320322;dc_trk_cid=72964178;sz=1x1;u=-https%3A%2F%2Fw.securelist.com%2Fen%2Fdescriptions%2Ftrojan-gamethief.win32.magania.eogz%7CVIQ_0-1faf1de7-dc28-40b7-96dc-82948657a7d6%7C;ord=4159496

Request Chain 71

https://t.myvisualiq.net/sync?prid=123&ao=0&red=https%3A%2F%2Fwww.facebook.com%2Ftr%3Fid%3D238727726635232%26ev%3DPageView%26cd%5Border_id%5D%3D%24%7BUUID%7D HTTP 302
https://www.facebook.com/tr?id=238727726635232&ev=PageView&cd[order_id]=0-0571655e-3034-45d5-acf7-693a999cca5a

75 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

404
Not Found

Primary Request trojan-gamethief.win32.magania.eogz Show response
w.securelist.com/en/descriptions/
Redirect Chain

http://www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz
https://www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz
https://securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz
https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

32 KB
8 KB

850ms
463ms

Document
text/html

77.74.179.157
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

77.74.179.157 , Russian Federation, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

nginx/1.16.1 / PHP/7.2.29

Resource Hash

02a8f13923aa47de3e272299eb4132d2c43bb44dd48d790380d97f2f697aa716

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.google.com https://cdnjs.cloudflare.com https://kaspersky.ugc.bazaarvoice.com https://s.yimg.com https://js.adsrvr.org https://apps.nexus.bazaarvoice.com https://cdnssl.clicktale.net https://sp.analytics.yahoo.com https://www.googleadservices.com https://c1.rfihub.net https://px.airpr.com https://googleads.g.doubleclick.net https://vt.myvisualiq.net https://a.rfihub.com https://connect.facebook.net https://www.googletagmanager.com https://www.google-analytics.com https://ajax.googleapis.com https://www.gstatic.com; object-src 'self'
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff

Request headers

Host: w.securelist.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx/1.16.1
Date: Mon, 30 Mar 2020 22:12:39 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.2.29
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Link: <https://noransom.kaspersky.com/wp-json/>; rel="https://api.w.org/"
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.google.com https://cdnjs.cloudflare.com https://kaspersky.ugc.bazaarvoice.com https://s.yimg.com https://js.adsrvr.org https://apps.nexus.bazaarvoice.com https://cdnssl.clicktale.net https://sp.analytics.yahoo.com https://www.googleadservices.com https://c1.rfihub.net https://px.airpr.com https://googleads.g.doubleclick.net https://vt.myvisualiq.net https://a.rfihub.com https://connect.facebook.net https://www.googletagmanager.com https://www.google-analytics.com https://ajax.googleapis.com https://www.gstatic.com; object-src 'self'
Strict-Transport-Security: max-age=2592000
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer-when-downgrade
Content-Encoding: gzip

Redirect headers

Server: nginx
Date: Mon, 30 Mar 2020 22:12:38 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0, no-store
Content-Security-Policy: connect-src 'self' https://*.clicktale.net https://*.demdex.net https://*.doubleclick.net https://*.everesttech.net https://*.facebook.com https://*.facebook.net https://*.google-analytics.com https://*.google.com https://*.mktoresp.com https://*.optimizely.com https://*.pingdom.net https://*.reddit.com https://*.securelist.com https://*.youtube.com https://cdn.securelist.com https://e.infogram.com https://hn.algolia.com https://kaspersky.d3.sc.omtrdc.net https://kasperskycontenthub.com https://securelist.com https://tagmanager.google.com https://tpc.googlesyndication.com https://www.google-analytics.com; default-src 'self' https://*.securelist.com https://cdn.securelist.com https://kasperskycontenthub.com https://kasperskycontenthub.com/securelist https://securelist.com https://tpc.googlesyndication.com; font-src 'self' data: https://*.gstatic.com https://*.securelist.com https://*.wp.com https://assets.kasperskycontenthub.com https://assets.threatpost.com https://cdn.securelist.com https://fonts.googleapis.com https://fonts.gstatic.com https://kasperskycontenthub.com https://securelist.com https://tpc.googlesyndication.com; frame-src 'self' http://*.slideshare.net https://*.addthis.com https://*.doubleclick.net https://*.facebook.com https://*.google.com https://*.infogram.com https://*.instagram.com https://*.libsyn.com https://*.marketo.com https://*.securelist.com https://*.sekindo.com https://*.sharethis.com https://*.slideshare.net https://*.twitter.com https://*.wp.com https://*.youtube.com https://cdn.securelist.com https://infogram.com https://kasperskycontenthub.com https://player.vimeo.com https://s-static.ak.facebook.com https://securelist.com https://tagmanager.google.com https://tpc.googlesyndication.com https://www.brighttalk.com; img-src 'self' data: http://*.netdna-cdn.com http://*.wordpress.com http://*.wp.com http://assets.kasperskycontenthub.com http://assets.kasperskydaily.com http://assets.threatpost.com http://d2538mqrb7brka.cloudfront.net http://forum.kasperskyclub.ru http://i0.poll.fm http://media.kasperskycontenthub.com http://media.kasperskydaily.com http://media.threatpost.com https://*.addthis.com https://*.doubleclick.net https://*.facebook.com https://*.google-analytics.com https://*.google.com https://*.gravatar.com https://*.gstatic.com https://*.infogram.com https://*.instagram.com https://*.netdna-cdn.com https://*.netdna-ssl.com https://*.securelist.com https://*.sekindo.com https://*.sharethis.com https://*.staticflickr.com https://*.twimg.com https://*.twitter.com https://*.wordpress.com https://*.wp.com https://*.ytimg.com https://addevent.com https://assets.kasperskycontenthub.com https://assets.kasperskydaily.com https://assets.threatpost.com https://blog.kaspersky.com https://cdn.securelist.com https://csi.gstatic.com https://d1srlirzdlmpew.cloudfront.net https://d2538mqrb7brka.cloudfront.net https://geo.yahoo.com https://images.telechargement.fr https://instagramimages-a.akamaihd.net https://kaspersky.d2.sc.omtrdc.net https://kasperskycontenthub.com https://m.addthis.com https://maps.googleapis.com https://media.kasperskycontenthub.com https://media.kasperskydaily.com https://media.threatpost.com https://player.vimeo.com https://polldaddy.com https://rum-collector.pingdom.net https://s.w.org https://s3-eu-west-1.amazonaws.com https://scontent.cdninstagram.com https://securelist.com https://stats.g.doubleclick.net https://t.co https://tagmanager.google.com https://threatpost.com https://tpc.googlesyndication.com https://track.addevent.com; object-src 'self' https://*.securelist.com https://kasperskycontenthub.com https://player.vimeo.com https://polldaddy.com https://securelist.com https://tpc.googlesyndication.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' http://assets.kasperskycontenthub.com http://assets.threatpost.com https://*.addevent.com https://*.addthis.com https://*.cloudfront.net https://*.crazyegg.com https://*.demdex.net https://*.doubleclick.net https://*.facebook.com https://*.facebook.net https://*.flickr.com https://*.google-analytics.com https://*.google.com https://*.googleapis.com https://*.googlesyndication.com https://*.gravatar.com https://*.gstatic.com https://*.instagram.com https://*.kaspersky.com https://*.marketo.com https://*.marketo.net https://*.optimizely.com https://*.polldaddy.com https://*.securelist.com https://*.sekindo.com https://*.sharethis.com https://*.twimg.com https://*.twitter.com https://*.woopra.com https://*.wp.com https://addthisevent.com https://adservice.google.com https://adservice.google.hr https://adservice.google.ru https://assets.adobedtm.com https://assets.kasperskycontenthub.com https://assets.threatpost.com https://cdn.optimizely.com https://cdn.securelist.com https://connect.facebook.net https://connect.mail.ru https://e.infogram.com https://kaspersky.d2.sc.omtrdc.net https://kasperskycontenthub.com https://m.addthis.com https://m.addthisedge.com https://munchkin.marketo.net https://player.vimeo.com https://polldaddy.com https://rum-static.pingdom.net https://script.crazyegg.com https://securelist.com https://share.yandex.ru/ https://static.ads-twitter.com https://tagmanager.google.com https://tpc.googlesyndication.com https://vk.com https://www.addevent.com https://www.brighttalk.com https://www.flickr.com https://www.googletagmanager.com https://www.googletagservices.com https://www.linkedin.com; style-src 'self' 'unsafe-inline' http://*.googleapis.com http://assets.kasperskycontenthub.com http://assets.threatpost.com https://*.googleapis.com https://*.gravatar.com https://*.kaspersky.com https://*.marketo.com https://*.securelist.com https://*.sekindo.com https://*.sharethis.com https://*.twimg.com https://*.twitter.com https://*.wp.com https://assets.kasperskycontenthub.com https://assets.threatpost.com https://cdn.securelist.com https://fonts.googleapis.com https://kasperskycontenthub.com https://s0.wp.com https://secure.gravatar.com https://securelist.com https://tagmanager.google.com https://tpc.googlesyndication.com
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Redirect-By: WordPress
Location: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
X-Frame-Options: SAMEORIGIN
X-Debug-Auth: off
X-Request-Host: securelist.com
x-cache-hit: MISS

GET
H/1.1 200
OK main.min.css
noransom.kaspersky.com/wp-content/themes/ransomware/static/css/ 79 KB
18 KB 246ms
85ms Stylesheet
text/css 77.74.179.157
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://noransom.kaspersky.com/wp-content/themes/ransomware/static/css/main.min.css

Requested by

Host: w.securelist.com
URL: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

77.74.179.157 , Russian Federation, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

nginx/1.16.1 /

Resource Hash

f7cc7b5c6b903cb33a6541fb840371745c09849295799c10ee6181eb7c352454

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Mon, 30 Mar 2020 22:12:39 GMT
Content-Encoding: gzip
Origin: https://noransom.kaspersky.com
Last-Modified: Tue, 01 Oct 2019 08:50:24 GMT
Server: nginx/1.16.1
ETag: W/"13bb5-593d571762a66"
X-Frame-Options: DENY
Content-Type: text/css
Access-Control-Allow-Origin: https://noransom.kaspersky.com
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: false
X-Content-Type-Options: nosniff

GET
H2 200 jquery-ui.css
ajax.googleapis.com/ajax/libs/jqueryui/1.8.1/themes/base/ 32 KB
6 KB 7ms
6ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.8.1/themes/base/jquery-ui.css?ver=4.9.9

Requested by

Host: w.securelist.com
URL: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c17625547e20f91e831da065cc127ac73b17df21ea578a3a87df6baabf58d47e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 05 Mar 2020 05:14:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2221097
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5774
x-xss-protection: 0
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 05 Mar 2021 05:14:22 GMT

GET
H/1.1 200
OK pagenavi-css.css
noransom.kaspersky.com/wp-content/plugins/wp-pagenavi/ 374 B
704 B 237ms
74ms Stylesheet
text/css 77.74.179.157
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://noransom.kaspersky.com/wp-content/plugins/wp-pagenavi/pagenavi-css.css?ver=2.70

Requested by

Host: w.securelist.com
URL: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

77.74.179.157 , Russian Federation, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

nginx/1.16.1 /

Resource Hash

c2711e9edc60964dcb5aada1bfa59c2d68d3d9dc1baf4a5ee058b4c1bd32c3eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Mon, 30 Mar 2020 22:12:39 GMT
Content-Encoding: gzip
Origin: https://noransom.kaspersky.com
Last-Modified: Tue, 01 Oct 2019 08:50:17 GMT
Server: nginx/1.16.1
ETag: W/"176-593d571137dfb"
X-Frame-Options: DENY
Content-Type: text/css
Access-Control-Allow-Origin: https://noransom.kaspersky.com
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: false
X-Content-Type-Options: nosniff

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 674 B
542 B 17ms
16ms Script
text/javascript 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en

Requested by

Host: w.securelist.com
URL: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

aec8f06eaabf9c98bf6595dc0869dc0e20138dc5fdf439bfc03963c39244ff6e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 30 Mar 2020 22:12:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 444
x-xss-protection: 1; mode=block
expires: Mon, 30 Mar 2020 22:12:39 GMT

GET
H/1.1 200
OK logo.svg
noransom.kaspersky.com/wp-content/themes/ransomware/static/img/assets/logo/ 3 KB
2 KB 242ms
76ms Image
image/svg+xml 77.74.179.157
KL-EXT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://noransom.kaspersky.com/wp-content/themes/ransomware/static/img/assets/logo/logo.svg

Requested by

Host: w.securelist.com
URL: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

77.74.179.157 , Russian Federation, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

nginx/1.16.1 /

Resource Hash

6670587c6c6f7eaea610366096842e6256d42aa527149b0627416005f81f3390

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 30 Mar 2020 22:12:39 GMT
Content-Encoding: gzip
Origin: https://noransom.kaspersky.com
Last-Modified: Tue, 01 Oct 2019 08:50:24 GMT
Server: nginx/1.16.1
ETag: W/"d79-593d57179a6ef"
X-Frame-Options: DENY
Content-Type: image/svg+xml
Access-Control-Allow-Origin: https://noransom.kaspersky.com
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: false
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK illustration.svg
noransom.kaspersky.com/wp-content/themes/ransomware/static/img/assets/illustration/ 10 KB
5 KB 246ms
77ms Image
image/svg+xml 77.74.179.157
KL-EXT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://noransom.kaspersky.com/wp-content/themes/ransomware/static/img/assets/illustration/illustration.svg

Requested by

Host: w.securelist.com
URL: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

77.74.179.157 , Russian Federation, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

nginx/1.16.1 /

Resource Hash

578d161057d45151b3b3bac271a43d41995075b12548328e21ddbb09838e5889

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 30 Mar 2020 22:12:39 GMT
Content-Encoding: gzip
Origin: https://noransom.kaspersky.com
Last-Modified: Tue, 01 Oct 2019 08:50:24 GMT
Server: nginx/1.16.1
ETag: W/"27ff-593d571793b75"
X-Frame-Options: DENY
Content-Type: image/svg+xml
Access-Control-Allow-Origin: https://noransom.kaspersky.com
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: false
X-Content-Type-Options: nosniff

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/ 85 KB
29 KB 16ms
16ms Script
application/javascript 2606:4700::6811:4104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js

Requested by

Host: w.securelist.com
URL: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 30 Mar 2020 22:12:39 GMT
content-encoding: br
cf-cache-status: HIT
age: 30240301
cf-ray: 57c52c658d793244-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Thu, 17 May 2018 09:21:00 GMT
server: cloudflare
etag: W/"5afd497c-152b5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Sat, 20 Mar 2021 22:12:39 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.041

GET wp-emoji-release.min.js
noransom.kaspersky.com/wp-includes/js/ 0
0

GET jquery.js
noransom.kaspersky.com/wp-includes/js/jquery/ 0
0

GET jquery-migrate.min.js
noransom.kaspersky.com/wp-includes/js/jquery/ 0
0

GET alert_text.js
noransom.kaspersky.com/wp-content/plugins/kaspersky-cookies-notification/languages/en_US/ 0
0

GET alert.js
noransom.kaspersky.com/wp-content/plugins/kaspersky-cookies-notification/scripts/ 0
0

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 126 KB
30 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: w.securelist.com
URL: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
content-length: 30466
x-xss-protection: 0
pragma: private
x-fb-debug: mnY9vrm5CWEtvginW403G6FxARkaeu54RYsjdKdYoQVTmdBjvScp4UuhjifySldWcVX93t3JTfZcC9HWRHptdg==
x-fb-trip-id: 1850256238
date: Mon, 30 Mar 2020 22:12:39 GMT, Mon, 30 Mar 2020 22:12:39 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: private
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/OOKISvkNnVD_m_9dreR_1S0n/ 259 KB
93 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/OOKISvkNnVD_m_9dreR_1S0n/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8750509f5a4895bc45c5d3cbc3e3892a09d34e3463fcacdde920882eed78be8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 30 Mar 2020 16:39:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 30 Mar 2020 04:05:21 GMT
server: sffe
age: 19964
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 94752
x-xss-protection: 0
expires: Tue, 30 Mar 2021 16:39:55 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 94 KB
26 KB 19ms
19ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-K3WXWL

Requested by

Host: w.securelist.com
URL: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

258a6637531aac64460db7abeb59055b297872d4c9b52abab8f7092e8f13f037

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 30 Mar 2020 22:12:40 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 26519
x-xss-protection: 0
last-modified: Mon, 30 Mar 2020 21:56:33 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 30 Mar 2020 22:12:40 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 503 KB
85 KB 16ms
15ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3

Requested by

Host: w.securelist.com
URL: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9b107329e98443475d4ace4ba3b9e317806ea72cdf2d73520cac0f928fbb5183

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 30 Mar 2020 22:12:40 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 87365
x-xss-protection: 0
last-modified: Mon, 30 Mar 2020 21:56:33 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 30 Mar 2020 22:12:40 GMT

GET svg-symbols.svg
noransom.kaspersky.com/wp-content/themes/ransomware/ 0
0

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK KART-1.jpg
noransom.kaspersky.com/wp-content/uploads/2018/04/ 112 KB
112 KB 74ms
73ms Image
image/jpeg 77.74.179.157
KL-EXT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://noransom.kaspersky.com/wp-content/uploads/2018/04/KART-1.jpg

Requested by

Host: w.securelist.com
URL: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

77.74.179.157 , Russian Federation, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

nginx/1.16.1 /

Resource Hash

c762acb008ab90d1ec4857712c46d851042e9858c8bf7360821e0975b530fb33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 30 Mar 2020 22:12:40 GMT
Content-Encoding: gzip
Origin: https://noransom.kaspersky.com
Last-Modified: Thu, 26 Apr 2018 13:24:50 GMT
Server: nginx/1.16.1
ETag: W/"1c0f2-56ac04fe18c80"
X-Frame-Options: DENY
Content-Type: image/jpeg
Access-Control-Allow-Origin: https://noransom.kaspersky.com
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: false
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK club.png
noransom.kaspersky.com/wp-content/themes/ransomware/static/img/assets/channels/ 1 KB
2 KB 76ms
74ms Image
image/png 77.74.179.157
KL-EXT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://noransom.kaspersky.com/wp-content/themes/ransomware/static/img/assets/channels/club.png

Requested by

Host: w.securelist.com
URL: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

77.74.179.157 , Russian Federation, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

nginx/1.16.1 /

Resource Hash

14c5bc2a47638dcdd63ab2276a25fe3be81f0b24fbab44bf6bb1cf28c5580ef5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://noransom.kaspersky.com/wp-content/themes/ransomware/static/css/main.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 30 Mar 2020 22:12:40 GMT
Content-Encoding: gzip
Origin: https://noransom.kaspersky.com
Last-Modified: Tue, 01 Oct 2019 08:50:24 GMT
Server: nginx/1.16.1
ETag: W/"5cb-593d5717919c0"
X-Frame-Options: DENY
Content-Type: image/png
Access-Control-Allow-Origin: https://noransom.kaspersky.com
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: false
X-Content-Type-Options: nosniff

GET MuseoSansCyrl-700.woff2
noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/ 0
0

GET MuseoSansCyrl-900.woff2
noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/ 0
0

GET MuseoSansCyrl-300.woff2
noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/ 0
0

GET main.min.js
noransom.kaspersky.com/wp-content/themes/ransomware/static/js/ 0
0

GET core.min.js
noransom.kaspersky.com/wp-includes/js/jquery/ui/ 0
0

GET widget.min.js
noransom.kaspersky.com/wp-includes/js/jquery/ui/ 0
0

GET tabs.min.js
noransom.kaspersky.com/wp-includes/js/jquery/ui/ 0
0

GET wp-embed.min.js
noransom.kaspersky.com/wp-includes/js/ 0
0

GET
H2 200 839281392784015 Show response
connect.facebook.net/signals/config/ 447 KB
113 KB 12ms
11ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/839281392784015?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

823c238dc56a978c81fed39b83d77f2f61ad74caa1a3401349d9f2ef260989f8

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
content-length: 114947
x-xss-protection: 0
pragma: public
x-fb-debug: +bFNzS2J2HEP8o/BbGGfti08XEABCFTKnB1mHTohkjyj6CH4XvpEO4HdB21Ty9MNC++Tb1/mk0Rjb8cfKvczCg==
x-fb-trip-id: 1850256238
date: Mon, 30 Mar 2020 22:12:40 GMT, Mon, 30 Mar 2020 22:12:40 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 anchor
www.google.com/recaptcha/api2/ Frame D2B1 0
0 27ms
26ms Document
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LciMlIUAAAAAGc3ehT3ev1Y0JBMf7_CGUGzSnwL&co=aHR0cHM6Ly93LnNlY3VyZWxpc3QuY29tOjQ0Mw..&hl=en&v=OOKISvkNnVD_m_9dreR_1S0n&size=normal&cb=ieb138k9rnph

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/OOKISvkNnVD_m_9dreR_1S0n/recaptcha__en.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-EZRCccSxfsCEx4VcDJSLTw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LciMlIUAAAAAGc3ehT3ev1Y0JBMf7_CGUGzSnwL&co=aHR0cHM6Ly93LnNlY3VyZWxpc3QuY29tOjQ0Mw..&hl=en&v=OOKISvkNnVD_m_9dreR_1S0n&size=normal&cb=ieb138k9rnph
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Response headers

status: 200
content-security-policy: script-src 'report-sample' 'nonce-EZRCccSxfsCEx4VcDJSLTw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
content-encoding: gzip
date: Mon, 30 Mar 2020 22:12:40 GMT
expires: Mon, 30 Mar 2020 22:12:40 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1102
server: GSE
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81c::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K3WXWL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 5948
date: Mon, 30 Mar 2020 20:33:32 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 18174
expires: Mon, 30 Mar 2020 22:33:32 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=991718989&t=pageview&_s=1&dl=https%3A%2F%2Fw.securelist.com%2Fen%2Fdescriptions%2Ftrojan-gamethief.win32.magania.eogz&dp=%2Fen%2Fdescriptions...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-63997723-27&cid=1755857266.1585606360&jid=378827441&_gid=1966240923.1585606360&gjid=1671595420&_v=j81&z=996330106
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-63997723-27&cid=1755857266.1585606360&jid=378827441&_v=j81&z=996330106
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-63997723-27&cid=1755857266.1585606360&jid=378827441&_v=j81&z=996330106&slf_rd=1&random=751399195

42 B
109 B

16ms
15ms

Image
image/gif

2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-63997723-27&cid=1755857266.1585606360&jid=378827441&_v=j81&z=996330106&slf_rd=1&random=751399195

Requested by

Host: w.securelist.com
URL: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 30 Mar 2020 22:12:40 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 30 Mar 2020 22:12:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-63997723-27&cid=1755857266.1585606360&jid=378827441&_v=j81&z=996330106&slf_rd=1&random=751399195
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
322 B 7ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=839281392784015&ev=PageView&dl=https%3A%2F%2Fw.securelist.com%2Fen%2Fdescriptions%2Ftrojan-gamethief.win32.magania.eogz&rl=&if=false&ts=1585606360165&sw=1600&sh=1200&v=2.9.15&r=stable&ec=0&o=30&fbp=fb.1.1585606360165.42613352&it=1585606360041&coo=false&rqm=GET

Requested by

Host: w.securelist.com
URL: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 30 Mar 2020 22:12:40 GMT, Mon, 30 Mar 2020 22:12:40 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 30 Mar 2020 22:12:40 GMT

GET MuseoSansCyrl-700.woff
noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/ 0
0

GET MuseoSansCyrl-900.woff
noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/ 0
0

GET MuseoSansCyrl-300.woff
noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/ 0
0

GET MuseoSansCyrl-700.ttf
noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/ 0
0

GET MuseoSansCyrl-900.ttf
noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/ 0
0

GET MuseoSansCyrl-300.ttf
noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/ 0
0

GET
H2 200 /
www.facebook.com/tr/ 44 B
202 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=839281392784015&ev=Microdata&dl=https%3A%2F%2Fw.securelist.com%2Fen%2Fdescriptions%2Ftrojan-gamethief.win32.magania.eogz&rl=&if=false&ts=1585606360667&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Free%20Ransomware%20Decryptors%20-%20Kaspersky%22%2C%22meta%3Adescription%22%3A%22Remove%20ransomware%20and%20download%20free%20decryption%20tools.%20Powered%20by%20Kaspersky.%22%2C%22meta%3Akeywords%22%3A%22%22%7D&cd[OpenGraph]=%7B%22og%3Aimage%22%3A%22https%3A%2F%2Fnoransom.kaspersky.com%2Fwp-content%2Fthemes%2Fransomware%2Fstatic%2Fimg%2Fassets%2Flogo%2Flogo-bg-square1.png%22%2C%22og%3Adescription%22%3A%22Don%E2%80%99t%20know%20how%20to%20remove%20ransomware%3F%20The%20No%20More%20Ransom%20website%20contains%20free%20decryption%20tools%20and%20comprehensive%20information%20on%20ransomware%20protection.%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.15&r=stable&a=tmgoogletagmanager&ec=1&o=30&fbp=fb.1.1585606360667.1997866033&it=1585606360041&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Host: w.securelist.com
URL: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 30 Mar 2020 22:12:40 GMT, Mon, 30 Mar 2020 22:12:40 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 30 Mar 2020 22:12:40 GMT

GET
H/1.1 200
OK tc.min.js Show response
c1.rfihub.net/js/ 20 KB
7 KB 61ms
19ms Script
application/x-javascript 23.38.48.101
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: w.securelist.com
URL: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.38.48.101 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-38-48-101.deploy.static.akamaitechnologies.com
Software: Jetty(9.0.6.v20130930) /
Resource Hash: cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 30 Mar 2020 22:12:41 GMT
Content-Encoding: gzip
Last-Modified: Wed, 24 Jul 2019 06:34:16 GMT
Server: Jetty(9.0.6.v20130930)
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: public, max-age=3600
Connection: keep-alive
Content-Type: application/x-javascript
Content-Length: 6375
Expires: Mon, 30 Mar 2020 23:12:41 GMT

GET bat.js
bat.bing.com/ 0
0

GET ktag.js
resources.xg4ken.com/js/v2/ 0
0

GET
H/1.1 200
OK vt-132.js Show response
vt.myvisualiq.net/2/7hrBnrmZAM5n6cl1WjyOsg%3D%3D/ 17 KB
5 KB 53ms
18ms Script
application/x-javascript 13.224.194.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vt.myvisualiq.net/2/7hrBnrmZAM5n6cl1WjyOsg%3D%3D/vt-132.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.194.7 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-194-7.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b27f6c546b342d36a22801e2ed49f19198c486cb1559f9478e19fde10d498ed6

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 30 Mar 2020 14:49:11 GMT
Content-Encoding: gzip
Last-Modified: Wed, 26 Sep 2018 19:47:38 GMT
Server: AmazonS3
Age: 26610
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
x-amz-version-id: ocso9vBwiDAMIwzgZeIi2Q7YJDCshSHW
Via: 1.1 0b9e85cfe8fe19b385db56d32b4ce802.cloudfront.net (CloudFront)
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA2-C1
Connection: keep-alive
Content-Type: application/x-javascript
X-Amz-Cf-Id: 7K91UDtqIPPcn1vs-uPPTx84iEEgBk_Bscv1BHtjTtdLINacwCnjkw==

GET 2c47087421d0b.js
t.contentsquare.net/uxa/ 0
0

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 58ms
22ms Script
application/x-javascript 143.204.94.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.94.29 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-94-29.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0615974c40d602afdbf9759533e352bc17b0458c85aad6694b1a1ad20659625b

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 30 Mar 2020 08:14:48 GMT
Content-Encoding: gzip
Last-Modified: Mon, 13 Jan 2020 19:16:48 GMT
Server: AmazonS3
Age: 80172
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 32c8da10203574baccb74b8f771a7ffb.cloudfront.net (CloudFront)
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA50-C1
Connection: keep-alive
X-Amz-Cf-Id: CQxM9fwpAKvL0_L_D1xMWsp7j_7-hYpAqroXS7kC2pqgRkZQuugLeQ==

GET
H/1.1

200
OK

setuid
ib.adnxs.com/
Redirect Chain

https://s.tribalfusion.com/i.cid?c=705083&ev=0&page=Global
https://s.tribalfusion.com/z/i.cid?c=705083&ev=0&page=Global
https://ib.adnxs.com/getuidu?https://a.tribalfusion.com/i.match?p=b26&u=$UID&redirect=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D305%26code%3D%24TF_USER_ID_ENC%24
https://ib.adnxs.com/bounce?%2Fgetuidu%3Fhttps%3A%2F%2Fa.tribalfusion.com%2Fi.match%3Fp%3Db26%26u%3D%24UID%26redirect%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D305%2526code%253D%...
https://a.tribalfusion.com/i.match?p=b26&u=3840305674342909104&redirect=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D305%26code%3D%24TF_USER_ID_ENC%24
https://ib.adnxs.com/setuid?entity=305&code=18072662246930774519

43 B
1017 B

23ms
23ms

Image
image/gif

37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=305&code=18072662246930774519

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 30 Mar 2020 22:12:43 GMT
AN-X-Request-Uuid: 57a63cc5-d583-4245-80b0-113078653e4e
Content-Type: image/gif
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 185.236.201.131; 185.236.201.131; 538.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.244:80
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 30 Mar 2020 22:12:41 GMT
x-function: 209
x-reuse-index: 2590
location: https://ib.adnxs.com/setuid?entity=305&code=18072662246930774519
p3p: CP="NOI DEVo TAIa OUR BUS"
status: 302
cache-control: no-cache, private
content-type: text/html
content-length: 36
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET 1649d5fbb67c.js
w.usabilla.com/ Frame 7421 0
0

GET
H/1.1

200
OK

sync
t.myvisualiq.net/
Redirect Chain

https://tapestry.tapad.com/tapestry/1?ta_partner_id=950&ta_redirect=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3D1001%26ao%3D0%26pruuid%3DTAPAD_%24%7BIDS%3Akey%7D
https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_92a2cc31-72d3-11ea-b510-0a40cd988777

43 B
300 B

104ms
22ms

Image
image/gif

18.184.247.200
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_92a2cc31-72d3-11ea-b510-0a40cd988777
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.247.200 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-247-200.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 30 Mar 2020 22:12:41 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

strict-transport-security: max-age=31536000
via: 1.1 google
server: Jetty(8.1.13.v20130916)
date: Mon, 30 Mar 2020 22:12:41 GMT
location: https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_92a2cc31-72d3-11ea-b510-0a40cd988777
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
status: 302
alt-svc: clear
content-length: 0

GET
H/1.1

200
OK

sync
t.myvisualiq.net/
Redirect Chain

https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&red=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D125310%26dpuuid%3D%24%7BUUID%7D%26redir%3Dhttps%253A%252F%252Ft.myvisualiq.net%252Fsync%253Fprid%253D...
https://t.myvisualiq.net/ul_cb/sync?prid=AOEPNR1&ao=0&red=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D125310%26dpuuid%3D%24%7BUUID%7D%26redir%3Dhttps%253A%252F%252Ft.myvisualiq.net%252Fsync%253Fpri...
https://dpm.demdex.net/ibs:dpid=125310&dpuuid=2c42fd8f-1e56-4e6b-9b59-27008e924e71&redir=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3DAOEPNR1%26ao%3D0%26pruuid%3D%24%7BDD_UUID%7D
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=125310&dpuuid=2c42fd8f-1e56-4e6b-9b59-27008e924e71&redir=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3DAOEPNR1%26ao%3D0%26pruuid%3D%24%7BDD_UU...
https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&pruuid=43877991503779768830610072718123480184

43 B
300 B

24ms
23ms

Image
image/gif

18.184.247.200
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&pruuid=43877991503779768830610072718123480184
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.247.200 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-247-200.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 30 Mar 2020 22:12:41 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: m2xNf9yYQUU=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&pruuid=43877991503779768830610072718123480184
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

/
loadus.exelator.com/load/
Redirect Chain

https://t.myvisualiq.net/sync?prid=EEAEPNR1&red=https%3A%2F%2Floadus.exelator.com%2Fload%2F%3Fp%3D204%26g%3D1260%26buid%3D%24%7BUUID%7D
https://t.myvisualiq.net/ul_cb/sync?prid=EEAEPNR1&red=https%3A%2F%2Floadus.exelator.com%2Fload%2F%3Fp%3D204%26g%3D1260%26buid%3D%24%7BUUID%7D
https://loadus.exelator.com/load/?p=204&g=1260&buid=48065a64-1219-4d02-827f-60014eb3c97d

124 B
124 B

87ms
30ms

Image
application/x-javascript

147.75.102.200
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadus.exelator.com/load/?p=204&g=1260&buid=48065a64-1219-4d02-827f-60014eb3c97d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.102.200 Central, Hong Kong, ASN54825 (PACKET, US),
Reverse DNS
Software: nginx/1.14.0 / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Mar 2020 22:12:41 GMT
server: nginx/1.14.0
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
status: 200
cache-control: no-cache
access-control-allow-credentials: true
content-type: application/x-javascript;charset=UTF-8

Redirect headers

Location: https://loadus.exelator.com/load/?p=204&g=1260&buid=48065a64-1219-4d02-827f-60014eb3c97d
Date: Mon, 30 Mar 2020 22:12:41 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

B10122619.135787232;dc_pre=CNSmsv-bw-gCFc1EGwodDNcELg;dc_trk_aid=308320322;dc_trk_cid=72964178;sz=1x1;u=-https%3A%2F%2Fw.securelist.com%2Fen%2Fdescriptions%2Ftrojan-gamethief.win32.magania.eogz%7CV...
ad.doubleclick.net/ddm/trackimp/N408002.2426714VISUALIQ/
Redirect Chain

https://t.myvisualiq.net/sync?prid=Test&ao=0&red=https%253A%252F%252Fad.doubleclick.net%252Fddm%252Ftrackimp%252FN408002.2426714VISUALIQ%252FB10122619.135787232%253Bdc_trk_aid%253D308320322%253Bdc_...
https://ad.doubleclick.net/ddm/trackimp/N408002.2426714VISUALIQ/B10122619.135787232;dc_trk_aid=308320322;dc_trk_cid=72964178;sz=1x1;u=-https%3A%2F%2Fw.securelist.com%2Fen%2Fdescriptions%2Ftrojan-ga...
https://ad.doubleclick.net/ddm/trackimp/N408002.2426714VISUALIQ/B10122619.135787232;dc_pre=CNSmsv-bw-gCFc1EGwodDNcELg;dc_trk_aid=308320322;dc_trk_cid=72964178;sz=1x1;u=-https%3A%2F%2Fw.securelist.c...

42 B
221 B

39ms
38ms

Image
image/gif

172.217.18.166
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N408002.2426714VISUALIQ/B10122619.135787232;dc_pre=CNSmsv-bw-gCFc1EGwodDNcELg;dc_trk_aid=308320322;dc_trk_cid=72964178;sz=1x1;u=-https%3A%2F%2Fw.securelist.com%2Fen%2Fdescriptions%2Ftrojan-gamethief.win32.magania.eogz%7CVIQ_0-1faf1de7-dc28-40b7-96dc-82948657a7d6%7C;ord=4159496

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 30 Mar 2020 22:12:41 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 30 Mar 2020 22:12:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://ad.doubleclick.net/ddm/trackimp/N408002.2426714VISUALIQ/B10122619.135787232;dc_pre=CNSmsv-bw-gCFc1EGwodDNcELg;dc_trk_aid=308320322;dc_trk_cid=72964178;sz=1x1;u=-https%3A%2F%2Fw.securelist.com%2Fen%2Fdescriptions%2Ftrojan-gamethief.win32.magania.eogz%7CVIQ_0-1faf1de7-dc28-40b7-96dc-82948657a7d6%7C;ord=4159496
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 302
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK impression_pixel
t.myvisualiq.net/ 43 B
300 B 153ms
28ms Image
image/gif 18.184.247.200
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.myvisualiq.net/impression_pixel?r=2811264&et=i&ago=212&ao=537&aca=-10&si=-10&ci=-10&pi=-10&ad=-10&advt=-10&chnl=-10&vndr=1583&sz=8968&u=||https%3A%2F%2Fw.securelist.com%2Fen%2Fdescriptions%2Ftrojan-gamethief.win32.magania.eogz&pt=i
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.247.200 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-247-200.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 30 Mar 2020 22:12:41 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

tr
www.facebook.com/
Redirect Chain

https://t.myvisualiq.net/sync?prid=123&ao=0&red=https%3A%2F%2Fwww.facebook.com%2Ftr%3Fid%3D238727726635232%26ev%3DPageView%26cd%5Border_id%5D%3D%24%7BUUID%7D
https://www.facebook.com/tr?id=238727726635232&ev=PageView&cd[order_id]=0-0571655e-3034-45d5-acf7-693a999cca5a

44 B
148 B

7ms
6ms

Image
image/gif

2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr?id=238727726635232&ev=PageView&cd[order_id]=0-0571655e-3034-45d5-acf7-693a999cca5a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 30 Mar 2020 22:12:41 GMT, Mon, 30 Mar 2020 22:12:41 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 30 Mar 2020 22:12:41 GMT

Redirect headers

Location: https://www.facebook.com/tr?id=238727726635232&ev=PageView&cd[order_id]=0-0571655e-3034-45d5-acf7-693a999cca5a
Date: Mon, 30 Mar 2020 22:12:41 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1 200
OK idr.js Show response
a.rfihub.com/ 83 B
685 B 149ms
27ms Script
application/javascript 185.31.128.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://a.rfihub.com/idr.js?_callback=window.RocketfuelBCP.jsonpCallbacks.request_cmZpSWRJbkNhY2hl
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 185.31.128.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash: 95755b0dea60f4a899ca63b7f53cd846aaa087e26115239e49b50aef924c60c1

Request headers

Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Expires: Sat, 24 Apr 2021 22:12:41 GMT
Cache-Control: public, max-age=33696000
Server: Jetty(9.0.6.v20130930)
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 83
Content-Type: application/javascript

GET
H2 200 up
insight.adsrvr.org/track/ Frame 7751 0
0 160ms
43ms Document
text/html 52.19.29.48
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=3flza28&ref=https%3A%2F%2Fw.securelist.com%2Fen%2Fdescriptions%2Ftrojan-gamethief.win32.magania.eogz&upid=5jbt2zb&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.19.29.48 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-19-29-48.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: insight.adsrvr.org
:scheme: https
:path: /track/up?adv=3flza28&ref=https%3A%2F%2Fw.securelist.com%2Fen%2Fdescriptions%2Ftrojan-gamethief.win32.magania.eogz&upid=5jbt2zb&upv=1.1.0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Response headers

status: 200
date: Mon, 30 Mar 2020 22:12:41 GMT
content-type: text/html
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1 200
OK Cookie set ca.html
20730592p.rfihub.com/ Frame 2AE5 0
0 104ms
31ms Document
text/html 185.31.128.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20730592p.rfihub.com/ca.html?rfiidc=1582804167492665968&rfiaid=7bba47d2d62f41948e4bfc39ce9f23c4&ver=9&rb=20707&ca=20730592&pe=https%3A%2F%2Fw.securelist.com%2Fen%2Fdescriptions%2Ftrojan-gamethief.win32.magania.eogz&pf=&ra=8916102997430686
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 185.31.128.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash

Request headers

Host: 20730592p.rfihub.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: ruds=H4sIAAAAAAAAAOMSNjS1MLIwMDE0MzexNDIzM7U0sxDiM9RNM460DHHKiyiK988CABqr41AlAAAA; rud=H4sIAAAAAAAAAOMSNjS1MLIwMDE0MzexNDIzM7U0sxDiM9RNM460DHHKiyiK98-S4gUqMjUzMDM2MzQ2NgQAFGPtcDQAAAA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://w.securelist.com/en/descriptions/trojan-gamethief.win32.magania.eogz

Response headers

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: eud=H4sIAAAAAAAAAJvFyGtoamFqZmBmbGZoYmz5Co3fxITKX4TG38SKyt_Fjcr_hcZfJIzKf4TGBwB-z-d8kAAAAA; Path=/; Domain=.rfihub.com; Expires=Sat, 24 Apr 2021 22:12:41 GMT; Secure; SameSite=None ruds=H4sIAAAAAAAAAOMSNjS1MLIwMDE0MzexNDIzM7U0sxDiM9RNM460DHHKiyiK988CABqr41AlAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None rud=H4sIAAAAAAAAAOMSNjS1MLIwMDE0MzexNDIzM7U0sxDiM9RNM460DHHKiyiK98-S4gUqMjUzMDM2MzQ2NgQAFGPtcDQAAAA; Path=/; Domain=.rfihub.com; Expires=Sat, 24 Apr 2021 22:12:41 GMT; Secure; SameSite=None
Cache-Control: no-cache
Content-Type: text/html
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Transfer-Encoding: chunked
Server: Jetty(9.0.6.v20130930)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-includes/js/wp-emoji-release.min.js?ver=4.9.9

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-includes/js/jquery/jquery.js?ver=1.12.4

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/plugins/kaspersky-cookies-notification/languages/en_US/alert_text.js?ver=1569919816

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js?ver=1569919816

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/svg-symbols.svg

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/MuseoSansCyrl-700.woff2

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/MuseoSansCyrl-900.woff2

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/MuseoSansCyrl-300.woff2

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/static/js/main.min.js

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-includes/js/jquery/ui/core.min.js?ver=1.11.4

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-includes/js/jquery/ui/widget.min.js?ver=1.11.4

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-includes/js/jquery/ui/tabs.min.js?ver=1.11.4

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-includes/js/wp-embed.min.js?ver=4.9.9

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/MuseoSansCyrl-700.woff

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/MuseoSansCyrl-900.woff

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/MuseoSansCyrl-300.woff

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/MuseoSansCyrl-700.ttf

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/MuseoSansCyrl-900.ttf

Domain: noransom.kaspersky.com
URL: https://noransom.kaspersky.com/wp-content/themes/ransomware/static/fonts/MuseoSansCyrl-300.ttf

Domain: bat.bing.com
URL: https://bat.bing.com/bat.js

Domain: resources.xg4ken.com
URL: https://resources.xg4ken.com/js/v2/ktag.js?tid=KT-N3AA7-3EE

Domain: t.contentsquare.net
URL: https://t.contentsquare.net/uxa/2c47087421d0b.js

Domain: w.usabilla.com
URL: https://w.usabilla.com/1649d5fbb67c.js?lv=1

Verdicts & Comments Add Verdict or Comment

40 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.securelist.com/	1970-01-19 10:36:22	Name: _fbp Value: fb.1.1585606360667.1997866033

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://connect.facebook.net/en_US/fbevents.js(Line 23) Message: [Facebook Pixel] - Duplicate Pixel ID: 839281392784015.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://*.google.com https://cdnjs.cloudflare.com https://kaspersky.ugc.bazaarvoice.com https://s.yimg.com https://js.adsrvr.org https://apps.nexus.bazaarvoice.com https://cdnssl.clicktale.net https://sp.analytics.yahoo.com https://www.googleadservices.com https://c1.rfihub.net https://px.airpr.com https://googleads.g.doubleclick.net https://vt.myvisualiq.net https://a.rfihub.com https://connect.facebook.net https://www.googletagmanager.com https://www.google-analytics.com https://ajax.googleapis.com https://www.gstatic.com; object-src 'self'
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20730592p.rfihub.com
a.rfihub.com
a.tribalfusion.com
ad.doubleclick.net
ajax.googleapis.com
bat.bing.com
c1.rfihub.net
cdnjs.cloudflare.com
connect.facebook.net
dpm.demdex.net
ib.adnxs.com
insight.adsrvr.org
js.adsrvr.org
loadus.exelator.com
noransom.kaspersky.com
resources.xg4ken.com
s.tribalfusion.com
securelist.com
stats.g.doubleclick.net
t.contentsquare.net
t.myvisualiq.net
tapestry.tapad.com
vt.myvisualiq.net
w.securelist.com
w.usabilla.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
www.securelist.com
bat.bing.com
noransom.kaspersky.com
resources.xg4ken.com
t.contentsquare.net
w.usabilla.com
104.109.80.223
13.224.194.7
143.204.94.29
147.75.102.200
172.217.18.166
18.184.247.200
185.31.128.128
23.38.48.101
2606:4700::6811:4104
2a00:1450:4001:800::200a
2a00:1450:4001:808::2003
2a00:1450:4001:808::2004
2a00:1450:4001:81a::2003
2a00:1450:4001:81c::200e
2a00:1450:4001:81d::2008
2a00:1450:400c:c08::9a
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
35.173.160.135
35.227.248.159
37.252.172.250
52.17.92.255
52.19.29.48
77.74.179.157
02a8f13923aa47de3e272299eb4132d2c43bb44dd48d790380d97f2f697aa716
0615974c40d602afdbf9759533e352bc17b0458c85aad6694b1a1ad20659625b
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
14c5bc2a47638dcdd63ab2276a25fe3be81f0b24fbab44bf6bb1cf28c5580ef5
258a6637531aac64460db7abeb59055b297872d4c9b52abab8f7092e8f13f037
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
578d161057d45151b3b3bac271a43d41995075b12548328e21ddbb09838e5889
5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685
6670587c6c6f7eaea610366096842e6256d42aa527149b0627416005f81f3390
823c238dc56a978c81fed39b83d77f2f61ad74caa1a3401349d9f2ef260989f8
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
8750509f5a4895bc45c5d3cbc3e3892a09d34e3463fcacdde920882eed78be8b
95755b0dea60f4a899ca63b7f53cd846aaa087e26115239e49b50aef924c60c1
9b107329e98443475d4ace4ba3b9e317806ea72cdf2d73520cac0f928fbb5183
aec8f06eaabf9c98bf6595dc0869dc0e20138dc5fdf439bfc03963c39244ff6e
b27f6c546b342d36a22801e2ed49f19198c486cb1559f9478e19fde10d498ed6
c17625547e20f91e831da065cc127ac73b17df21ea578a3a87df6baabf58d47e
c2711e9edc60964dcb5aada1bfa59c2d68d3d9dc1baf4a5ee058b4c1bd32c3eb
c762acb008ab90d1ec4857712c46d851042e9858c8bf7360821e0975b530fb33
cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f7cc7b5c6b903cb33a6541fb840371745c09849295799c10ee6181eb7c352454

w.securelist.com Open in urlscan Pro 77.74.179.157 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

75 Requests

43 %HTTPS

42 %IPv6

25 Domains

32 Subdomains

20 IPs

8 Countries

566 kBTransfer

1870 kBSize

1 Cookies

13 Outgoing links

Page URL History

Redirected requests

75 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

w.securelist.com Open in urlscan Pro
77.74.179.157 Public Scan

Screenshot
Live screenshot

Full Image

75
Requests

43 %
HTTPS

42 %
IPv6

25
Domains

32
Subdomains

20
IPs

8
Countries

566 kB
Transfer

1870 kB
Size

1
Cookies

75 HTTP transactions
1 data transactions