![](/screenshots/ea846ca2-c43d-4818-9be0-643e45f05072.png)
thedfirreport.com
Open in
urlscan Pro
2606:4700:3036::ac43:bd2f
Public Scan
Effective URL: https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/
Submission: On May 02 via api from DE — Scanned from DE
Summary
TLS certificate: Issued by E1 on March 17th 2024. Valid for: 3 months.
This is the only time thedfirreport.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
translate.googleapis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
35 |
thedfirreport.com
thedfirreport.com — Cisco Umbrella Rank: 418125 |
5 MB |
16 |
wp.com
c0.wp.com — Cisco Umbrella Rank: 9651 stats.wp.com — Cisco Umbrella Rank: 2906 pixel.wp.com — Cisco Umbrella Rank: 2883 |
114 KB |
4 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
11 KB |
3 |
google.com
translate.google.com — Cisco Umbrella Rank: 1182 region1.analytics.google.com — Cisco Umbrella Rank: 3095 www.google.com — Cisco Umbrella Rank: 2 |
31 KB |
2 |
google.de
www.google.de — Cisco Umbrella Rank: 7810 |
126 B |
2 |
doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 89 |
397 B |
2 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 32 |
21 KB |
2 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39 |
161 KB |
1 |
googleapis.com
translate.googleapis.com — Cisco Umbrella Rank: 866 |
72 KB |
1 |
cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 804 |
7 KB |
69 | 10 |
Domain | Requested by | |
---|---|---|
35 | thedfirreport.com |
thedfirreport.com
c0.wp.com static.cloudflareinsights.com |
14 | c0.wp.com |
thedfirreport.com
|
3 | www.gstatic.com |
www.gstatic.com
|
2 | www.google.de | |
2 | stats.g.doubleclick.net |
www.googletagmanager.com
www.google-analytics.com |
2 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
2 | www.googletagmanager.com |
thedfirreport.com
www.googletagmanager.com |
1 | www.google.com | |
1 | fonts.gstatic.com | |
1 | region1.analytics.google.com |
www.googletagmanager.com
|
1 | translate.googleapis.com | |
1 | pixel.wp.com | |
1 | stats.wp.com |
thedfirreport.com
|
1 | translate.google.com |
thedfirreport.com
|
1 | static.cloudflareinsights.com |
thedfirreport.com
|
69 | 15 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
thedfirreport.com E1 |
2024-03-17 - 2024-06-15 |
3 months | crt.sh |
*.wp.com Sectigo ECC Domain Validation Secure Server CA |
2023-11-28 - 2024-12-28 |
a year | crt.sh |
cloudflareinsights.com GTS CA 1P5 |
2024-03-10 - 2024-06-08 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2024-04-08 - 2024-07-01 |
3 months | crt.sh |
*.google.de GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/
Frame ID: 3D0E15794B668D45E687FA443AEE12BD
Requests: 70 HTTP requests in this frame
Frame:
data://truncated
Frame ID: AA0013878B38AA2F90B0F96E883FB6EB
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/ea846ca2-c43d-4818-9be0-643e45f05072.png)
Page Title
From IcedID to Dagon Locker Ransomware in 29 Days – The DFIR ReportDetected technologies
Detected patterns
- <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
- /wp-(?:content|includes)/
Detected patterns
- static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/gtag/js
Slick (JavaScript Libraries) Expand
Detected patterns
- (?:/([\d.]+))?/slick(?:\.min)?\.js
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?
Page Statistics
46 Outgoing links
These are links going to different origins than the main page.
Title: Access DFIR Labs
Search URL Search Domain Scan URL
Title: SentinelOne
Search URL Search Domain Scan URL
Title: Group-IB
Search URL Search Domain Scan URL
Title: Spotify
Search URL Search Domain Scan URL
Title: Apple
Search URL Search Domain Scan URL
Title: YouTube
Search URL Search Domain Scan URL
Title: Audible
Search URL Search Domain Scan URL
Title: Amazon
Search URL Search Domain Scan URL
Title: r3nzsec
Search URL Search Domain Scan URL
Title: angelo_violetti
Search URL Search Domain Scan URL
Title: PrometheusTDS
Search URL Search Domain Scan URL
Title: @ffforward
Search URL Search Domain Scan URL
Title: Twitter
Search URL Search Domain Scan URL
Title: MemprocFS;
Search URL Search Domain Scan URL
Title: https://github.com/elastic/protections-artifacts/blob/72fd8cad90189e9d145d22eb3d4fee2fe3d5902f/yara/rules/Windows_Trojan_CobaltStrike.yar#L1011
Search URL Search Domain Scan URL
Title: LOKI signature base
Search URL Search Domain Scan URL
Title: 1768.py
Search URL Search Domain Scan URL
Title: Process Security and Access Rights – Win32 apps | Microsoft Learn
Search URL Search Domain Scan URL
Title: https://github.com/0xThiebaut/PCAPeek/
Search URL Search Domain Scan URL
Title: Invoke-ShareFinder
Search URL Search Domain Scan URL
Title: Fast Guide
Search URL Search Domain Scan URL
Title: Seatbelt
Search URL Search Domain Scan URL
Title: ipify.org
Search URL Search Domain Scan URL
Title: Sharphound
Search URL Search Domain Scan URL
Title: netscan
Search URL Search Domain Scan URL
Title: AdFind
Search URL Search Domain Scan URL
Title: nbtscan
Search URL Search Domain Scan URL
Title: tool version docs
Search URL Search Domain Scan URL
Title: Early Bird APC Queue process injection technique
Search URL Search Domain Scan URL
Title: SentinelOne script
Search URL Search Domain Scan URL
Title: urlscan.io
Search URL Search Domain Scan URL
Title: VirusTotal – File – f415c7d1b6a19975f2bb09e79f4416975375490fc645865dd63478c8aa605d97
Search URL Search Domain Scan URL
Title: pCloud
Search URL Search Domain Scan URL
Title: https://helgeklein.com/setacl/
Search URL Search Domain Scan URL
Title: Invoke-CommandAs
Search URL Search Domain Scan URL
Title: Invoke-Command
Search URL Search Domain Scan URL
Title: WmiExec
Search URL Search Domain Scan URL
Title: Invoke-DCOM
Search URL Search Domain Scan URL
Title: Invoke-PsExec
Search URL Search Domain Scan URL
Title: Invoke-SMBExec
Search URL Search Domain Scan URL
Title: detection.fyi
Search URL Search Domain Scan URL
Title: sigmasearchengine.com
Search URL Search Domain Scan URL
Title: Repo
Search URL Search Domain Scan URL
Title: Repo
Search URL Search Domain Scan URL
Title: Google Ãœbersetzer
Search URL Search Domain Scan URL
Title: Proudly powered by WordPress
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
69 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/ |
222 KB 45 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.min.css
c0.wp.com/c/6.5.2/wp-includes/css/dist/block-library/ |
111 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mediaelementplayer-legacy.min.css
c0.wp.com/c/6.5.2/wp-includes/js/mediaelement/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wp-mediaelement.min.css
c0.wp.com/c/6.5.2/wp-includes/js/mediaelement/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
thedfirreport.com/wp-content/themes/freenews/ |
60 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.css
thedfirreport.com/wp-content/themes/freenews/assets/library/fontawesome/css/ |
100 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d92fef3d9e5de6f7993b11046e265436.css
thedfirreport.com/wp-content/fonts/ |
4 KB 955 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
social-logos.min.css
c0.wp.com/p/jetpack/13.3.1/_inc/social-logos/ |
13 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jetpack.css
c0.wp.com/p/jetpack/13.3.1/css/ |
105 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
23869-001.png
thedfirreport.com/wp-content/uploads/2024/04/ |
137 KB 138 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
23869-002-2048x1152.png
thedfirreport.com/wp-content/uploads/2024/04/ |
468 KB 469 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
23869-003.png
thedfirreport.com/wp-content/uploads/2024/04/ |
43 KB 43 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
rocket-loader.min.js
thedfirreport.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v55bfa2fee65d44688e90c00735ed189a1713218998793
static.cloudflareinsights.com/beacon.min.js/ |
19 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sharing.min.js
c0.wp.com/p/jetpack/13.3.1/_inc/build/sharedaddy/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
view.js
thedfirreport.com/wp-content/plugins/jetpack/_inc/blocks/subscriptions/ |
4 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dom-ready.min.js
c0.wp.com/c/6.5.2/wp-includes/js/dist/ |
457 B 798 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wp-polyfill.min.js
c0.wp.com/c/6.5.2/wp-includes/js/dist/vendor/ |
38 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
regenerator-runtime.min.js
c0.wp.com/c/6.5.2/wp-includes/js/dist/vendor/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wp-polyfill-inert.min.js
c0.wp.com/c/6.5.2/wp-includes/js/dist/vendor/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
element.js
translate.google.com/translate_a/ |
88 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google-translate.min.js
c0.wp.com/p/jetpack/13.3.1/_inc/build/widgets/google-translate/ |
796 B 776 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e-202418.js
stats.wp.com/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
marquee-settings.js
thedfirreport.com/wp-content/themes/freenews/assets/library/marquee/ |
171 B 638 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.marquee.min.js
thedfirreport.com/wp-content/themes/freenews/assets/library/marquee/ |
9 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
sticky-setting.js
thedfirreport.com/wp-content/themes/freenews/assets/library/sticky/ |
397 B 689 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.sticky.js
thedfirreport.com/wp-content/themes/freenews/assets/library/sticky/ |
6 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
slick-settings.js
thedfirreport.com/wp-content/themes/freenews/assets/library/slick/ |
1 KB 955 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
slick.min.js
thedfirreport.com/wp-content/themes/freenews/assets/library/slick/ |
43 KB 12 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
theia-sticky-sidebar.min.js
thedfirreport.com/wp-content/themes/freenews/assets/library/sticky-sidebar/ |
5 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ResizeSensor.min.js
thedfirreport.com/wp-content/themes/freenews/assets/library/sticky-sidebar/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
skip-link-focus-fix.js
thedfirreport.com/wp-content/themes/freenews/assets/js/ |
426 B 754 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
navigation.min.js
thedfirreport.com/wp-content/themes/freenews/assets/js/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
201 KB 73 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
global.js
thedfirreport.com/wp-content/themes/freenews/assets/js/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-migrate.min.js
c0.wp.com/c/6.5.2/wp-includes/js/jquery/ |
13 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
c0.wp.com/c/6.5.2/wp-includes/js/jquery/ |
86 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
related-posts.min.js
c0.wp.com/p/jetpack/13.3.1/_inc/build/related-posts/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
P5sfzZCDf9_T_3cV7NCUECyoxNk37cxcABrB.woff2
thedfirreport.com/wp-content/fonts/arimo/ |
10 KB 10 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
NGS6v5_NC0k9P9H2TbE.woff2
thedfirreport.com/wp-content/fonts/heebo/ |
26 KB 27 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fa-solid-900.woff2
thedfirreport.com/wp-content/themes/freenews/assets/library/fontawesome/webfonts/ |
147 KB 147 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 7 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
monitor5-s.png
thedfirreport.com/wp-content/uploads/2023/09/ |
12 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cloud4-s.png
thedfirreport.com/wp-content/uploads/2023/09/ |
16 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
warning4-s.png
thedfirreport.com/wp-content/uploads/2023/09/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
labs-s.png
thedfirreport.com/wp-content/uploads/2024/04/ |
16 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
artifact4-s.png
thedfirreport.com/wp-content/uploads/2023/09/ |
8 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
help4-s.png
thedfirreport.com/wp-content/uploads/2023/09/ |
14 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
23869-117-1.png
thedfirreport.com/wp-content/uploads/2024/04/ |
3 MB 3 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
23869-118-2048x1079.png
thedfirreport.com/wp-content/uploads/2024/04/ |
639 KB 640 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
dfc6b6ce-84ea-4855-b139-fe6766242174
https://thedfirreport.com/ |
1 KB 0 |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cropped-dfir-v1-w-32x32.png
thedfirreport.com/wp-content/uploads/2020/04/ |
2 KB 2 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
251 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
g.gif
pixel.wp.com/ |
50 B 177 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=el_main_css
www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=AAM/d=0/rs=AN8SPfrUh4eQMB1I5qTj-4-oeXAO15kIQQ/ |
22 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=el_main
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.de.2pE-gEeAWJk.O/am=ABA/d=1/exm=el_conf/ed=1/rs=AN8SPfokwm6d6Guluekhk-XWyq2fGl2cBQ/ |
206 KB 72 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/ |
4 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
wp-emoji-release.min.js
thedfirreport.com/wp-includes/js/ |
18 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
rum
thedfirreport.com/cdn-cgi/ |
0 143 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.analytics.google.com/g/ |
0 255 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/g/ |
0 246 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ga-audiences
www.google.de/ads/ |
42 B 63 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
2 B 208 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
4 B 151 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame AA00 |
1 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
24px.svg
fonts.gstatic.com/s/i/productlogos/translate/v14/ |
6 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
googlelogo_color_42x16dp.png
www.gstatic.com/images/branding/googlelogo/1x/ |
910 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
translate_24dp.png
www.gstatic.com/images/branding/product/2x/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ga-audiences
www.google.com/ads/ |
42 B 63 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ga-audiences
www.google.de/ads/ |
42 B 63 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
93 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| __cfQR object| __cfBeacon object| _wpemojiSettings object| related_posts_js_options undefined| $ function| jQuery function| gtag object| dataLayer object| WPCOM_sharing_counts object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga function| ResizeSensor function| st_go function| linktracker_init object| wpcom object| _stq object| _wp_google_translate_widget function| googleTranslateElementInit function| _DumpException object| default_tr object| _F_toggles string| MSG_TRANSLATE string| MSG_CANCEL string| MSG_CLOSE function| MSGFUNC_PAGE_TRANSLATED_TO function| MSGFUNC_TRANSLATED_TO string| MSG_GENERAL_ERROR string| MSG_LEARN_MORE function| MSGFUNC_POWERED_BY string| MSG_TRANSLATE_PRODUCT_NAME string| MSG_TRANSLATION_IN_PROGRESS function| MSGFUNC_TRANSLATE_PAGE_TO function| MSGFUNC_VIEW_PAGE_IN string| MSG_RESTORE string| MSG_SSL_INFO_LOCAL_FILE string| MSG_SSL_INFO_SECURE_PAGE string| MSG_SSL_INFO_INTRANET_PAGE string| MSG_SELECT_LANGUAGE function| MSGFUNC_TURN_OFF_TRANSLATION function| MSGFUNC_TURN_OFF_FOR string| MSG_ALWAYS_HIDE_AUTO_POPUP_BANNER string| MSG_ORIGINAL_TEXT string| MSG_FILL_SUGGESTION string| MSG_SUBMIT_SUGGESTION string| MSG_SHOW_TRANSLATE_ALL string| MSG_SHOW_RESTORE_ALL string| MSG_SHOW_CANCEL_ALL string| MSG_TRANSLATE_TO_MY_LANGUAGE function| MSGFUNC_TRANSLATE_EVERYTHING_TO string| MSG_SHOW_ORIGINAL_LANGUAGES string| MSG_OPTIONS string| MSG_TURN_OFF_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_SUGGESTION string| MSG_ALT_ACTIVITY_HELPER_TEXT string| MSG_USE_ALTERNATIVES string| MSG_DRAG_TIP string| MSG_CLICK_FOR_ALT string| MSG_DRAG_INSTUCTIONS string| MSG_SUGGESTION_SUBMITTED string| MSG_MANAGE_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_AND_CONTRIBUTE_ACTIVITY_HELPER_TEXT string| MSG_ORIGINAL_TEXT_NO_COLON string| MSG_LANGUAGE_UNSUPPORTED string| MSG_LANGUAGE_TRANSLATE_WIDGET string| MSG_RATE_THIS_TRANSLATION string| MSG_FEEDBACK_USAGE_FOR_IMPROVEMENT string| MSG_FEEDBACK_SATISFIED_LABEL string| MSG_FEEDBACK_DISSATISFIED_LABEL string| MSG_TRANSLATION_NO_COLON function| _exportVersion function| _getCallbackFunction function| _exportMessages function| _loadJs function| _loadCss function| _isNS function| _setupNS object| google object| runtime object| regeneratorRuntime string| Jetpack_Block_Assets_Base_Url object| wp object| sharing_js_options object| WPCOMSharing undefined| windowOpen boolean| __cfRLUnblockHandlers object| twemoji object| gaGlobal object| gaplugins object| gaData object| closure_lm_4966784 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.thedfirreport.com/ | Name: _ga_N6F85L400D Value: GS1.1.1714641989.1.0.1714641989.60.0.0 |
|
.thedfirreport.com/ | Name: _ga Value: GA1.2.952072925.1714641990 |
|
.thedfirreport.com/ | Name: _gid Value: GA1.2.486443775.1714641990 |
|
.thedfirreport.com/ | Name: _gat_gtag_UA_162747485_1 Value: 1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
c0.wp.com
fonts.gstatic.com
pixel.wp.com
region1.analytics.google.com
static.cloudflareinsights.com
stats.g.doubleclick.net
stats.wp.com
thedfirreport.com
translate.google.com
translate.googleapis.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
142.250.185.195
142.250.186.36
172.67.189.47
192.0.76.3
192.0.77.37
2001:4860:4802:32::178
2001:4860:4802:32::36
2606:4700:3036::ac43:bd2f
2606:4700::6810:4f49
2a00:1450:4001:806::2003
2a00:1450:4001:80e::2003
2a00:1450:4001:80e::200e
2a00:1450:4001:827::2008
2a00:1450:4001:82b::200a
2a00:1450:400c:c00::9d
009cc61f461cab88cb60813e63477ea1a7248ad7a957eb146ab22f1fe019881d
0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5
17106bf803d42bcf2f2bdf778ece084d3f91c68e7ea41dae7bff61fefa573dee
17b79ece7ef9d1454a90156690d33d64387b67a7a7548fc826012512e287a937
1a24f65c00a46166e180a3501c19b60562e56362308ea9363130620772de741a
1c53cf45642757f0bf32e977df12981f67a50578ba67e08d35c05d54affd3ff3
1d52e1ac7d3bc25a8b0ffc257153f9dd50249f96fe9a4df5e0d771241a69062c
20231adb2bb75cd06c79f7ce556d97e6e83333e99ba5cc690e227ebb14bf0ac8
23a3fe27a84c2a2efe9b4099b5f05546b6b83418ddb0560548004323ac02e4ba
2ce4fcff403a4a73c39694880c0f7a1773d2d5abc2f99fbcb91444094b311a0d
2d39834086b6021b46bd051ac46cc41227eb396e21546edc7639ea582a0927bb
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
2ec23484fae47980001eed8805ef2fa389d25d6b9db0a5aaeb41ecb76c411905
31f4e4abd5d8e145d6bd5505ae3ee469f66e6aba53fcc6cf04741d0a802ebc3d
357452f2a55c999ddd3afdcbce2c339d41cf7a01613d9d45ff88a753bb82f21d
3b664859147d28cfb3e00d342c0309760083456524874587c8807823d32efc79
3edbacad2108de95ae81bd176d2b28352af38e6be269dd4597ca3631eac28dc2
405a5e4943b97243440d632a958bb6e79f1d1929666745000a22ebaa5fa2d819
4cc2c1b7490946e66134f776b66c30972379313d68a2749fbb83a55c3fba5849
4d6f1bf2dc927d828827c43d7da011c9b40b8fb3d77fa5032133fee8432f343f
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3
4f9f4e2e225088f9cf3b6b54aa421e0f776d1802255505d2f752e1f83f441641
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
529f93d902f2ac8d1f991e7ca3c8d48633b45232799d3b07e6a809852a700652
598452489982b65d1f477d903ccb527cc49d72db7251760e203ba8047e06795b
59f626902cee1ec6add9c9ac20ae2be6f2e39f4f821a550b73bba584b9d87e03
5a43a22e48f94b7a45a9a9b1a107f197213b73307fdfa2e6b2daadab264f94d2
5b9f9afe7621ec465573f58064f5bef3a229e5e19362351168fd211f6a28bb5c
5c426b919582109bc92f11696dc77bf1253039f3a877cf3226520d70e85a34c7
5f684ad26075f87606559c490de4d7018b5c5c249e879ee4eb07a01890c9aca2
6084047dd7206556f859642b8bd51c3bd11097a41b160362f7bb35949fe47916
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
6a026b870773ee2931f45664344f16ffbae2f1abc88dbffd46e7a5ddad8d8824
71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3
78d3032d2b15d8f0037a7e1d63f38ee3212ad16e8b43972cb70b01c80f44691a
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
886c86112a804ef1ddd1cb206af4c8c40e34b73c26652ca231404aa35a6b30d9
8f8078d5fa79042c80aff9ac50f962fca0a2461febc620b567e38fff39ddc182
98cecf88a23542fa047ce46eedb650b5c5128761ed4386c0977b847094ddfa20
98ea495d590c298f281d8ddbe9c3a82c9d507d6c9a6bd6356fbfbb666ee037ff
9e1dae23d3ad3212f67d09ca79a50003c32953c36bab976f634c9b38d8a8c6dc
9f5bc01dc459d6fe7e27565e71a3c9ba75909bfba87db15cb30aca7385692fd5
a68827190bc01a61ee0a62ec59efa74497a6bc5aa8586f1fac50a58d0cf42d88
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
ae29216f58cbe66f5cb9665e54a082b21c63666ea719e80d4c9873fb64aa91d8
af1e91b84165ece39fcdd3ca49b1dbc9c67a4bf3af73474ea4e2049f49a1b416
b38977ea35fde92fe200fa14ac7cc55e2edce54b998ce9a08734ba1dd9053fed
b39ee87ec510600913dd00d4794368d9e5b7000bc880c033098e6e1261662115
b59d766ccd09e7b386bb88fb30e8b2fcb634d8bf11bdddfdc42779c4979b0796
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4
c2cd3e005de210fcbb5372b4267c5d3d067e0564f017dd5ccba202d040f820d7
c8853e8db8dbd87dbd0de8f513e1fe5bccd647932a7f3a36953fe041f460bf71
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d75d917d9b5850cc096281bed75f0cd7d3065d33611a2d3ff971dbf5de0194e7
d88b2f05bcd6de59fcdc958ab1c6f63d0225f275d24ce003381c09deb3a4bf1e
dd9deeeda732605e55b86620fb2826df09c308ada3108333ec104a75afa52650
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e17c9d291ad45e7ce492e56d4831008b55869c7abff22c5a11fdd49c8ad8dfe7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e489b7e49ea4b6d49e7637fbd2b42562664ebcbbacf9ee1aed398145ede7bb48
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1d759e86165ec9e5f9f5c9775acfe83f2c00833aa1c3522fbede166c38a2205
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1