threatresearch.ext.hp.com Open in urlscan Pro
192.124.249.59 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
Submission: On December 19 via api (December 19th 2022, 10:56:34 am UTC) from IN — Scanned from DE

Summary HTTP 189 Redirects Links 214 Behaviour Indicators

Summary

This website contacted 17 IPs in 4 countries across 15 domains to perform 189 HTTP transactions. The main IP is 192.124.249.59, located in Menifee, United States and belongs to SUCURI-SEC, US. The main domain is threatresearch.ext.hp.com.
TLS certificate: Issued by Starfield Secure Certificate Authorit... on February 12th 2022. Valid for: a year.

This is the only time threatresearch.ext.hp.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
133	192.124.249.59 192.124.249.59	30148 (SUCURI-SEC) (SUCURI-SEC)
2 19	104.109.56.104 104.109.56.104	16625 (AKAMAI-AS) (AKAMAI-AS)
7	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba99	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a00:1450:400... 2a00:1450:4001:803::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
3	23.45.104.85 23.45.104.85	16625 (AKAMAI-AS) (AKAMAI-AS)
4	152.195.15.58 152.195.15.58	15133 (EDGECAST) (EDGECAST)
1	15.72.164.74 15.72.164.74	71 (HP-INTERN...) (HP-INTERNET-AS)
1	2a02:fe80:101... 2a02:fe80:1010::17:8	30148 (SUCURI-SEC) (SUCURI-SEC)
2	2a00:1450:400... 2a00:1450:400d:80c::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:806::200e	15169 (GOOGLE) (GOOGLE)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
1	2a00:1450:402... 2a00:1450:4025:401::9d	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400d:80c::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
9	2606:4700::68... 2606:4700::6810:9540	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:1a55	13335 (CLOUDFLAR...) (CLOUDFLARENET)
189	17

133 192.124.249.59 (Menifee, United States)

ASN30148 (SUCURI-SEC, US)
PTR: cloudproxy10059.sucuri.net

threatresearch.ext.hp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 104.109.56.104 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-109-56-104.deploy.static.akamaitechnologies.com

www8.hp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:26f0:6c00::210:ba99 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

www.hp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:803::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.45.104.85 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-45-104-85.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 152.195.15.58 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.bizibly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 15.72.164.74 (United States)

ASN71 (HP-INTERNET-AS, US)
PTR: hpdownloads.com

hp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fe80:1010::17:8 (United States)

ASN30148 (SUCURI-SEC, US)

www.bromium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:80c::2003 (Ireland)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:806::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

497-itq-712.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4025:401::9d (Den Helder, Netherlands)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:80c::2004 (Ireland)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700::6810:9540 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1a55 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
160	hp.com 2 redirects threatresearch.ext.hp.com www8.hp.com — Cisco Umbrella Rank: 35987 www.hp.com — Cisco Umbrella Rank: 12014 hp.com — Cisco Umbrella Rank: 1654	12 MB
9	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 403	172 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 29	20 KB
3	bizible.com cdn.bizible.com — Cisco Umbrella Rank: 7521	33 KB
3	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3364	8 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 51	204 KB
2	gstatic.com fonts.gstatic.com	39 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 672	312 B
1	google.de www.google.de — Cisco Umbrella Rank: 6041	501 B
1	google.com www.google.com — Cisco Umbrella Rank: 2	501 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 77	448 B
1	mktoresp.com 497-itq-712.mktoresp.com	318 B
1	bizibly.com cdn.bizibly.com — Cisco Umbrella Rank: 11516	202 B
1	bromium.com www.bromium.com — Cisco Umbrella Rank: 394120	20 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 37	2 KB
189	15

	Domain	Requested by
133	threatresearch.ext.hp.com	threatresearch.ext.hp.com
19	www8.hp.com	2 redirects threatresearch.ext.hp.com www8.hp.com
9	cdn.cookielaw.org	www.hp.com cdn.bizible.com cdn.cookielaw.org
7	www.hp.com	threatresearch.ext.hp.com www8.hp.com hp.com
3	www.google-analytics.com	www.googletagmanager.com cdn.bizible.com
3	cdn.bizible.com	threatresearch.ext.hp.com cdn.bizible.com
3	munchkin.marketo.net	threatresearch.ext.hp.com munchkin.marketo.net
3	www.googletagmanager.com	threatresearch.ext.hp.com
2	fonts.gstatic.com	threatresearch.ext.hp.com
1	geolocation.onetrust.com	cdn.bizible.com
1	www.google.de	threatresearch.ext.hp.com
1	www.google.com	threatresearch.ext.hp.com
1	stats.g.doubleclick.net	cdn.bizible.com
1	497-itq-712.mktoresp.com	munchkin.marketo.net
1	cdn.bizibly.com	threatresearch.ext.hp.com
1	www.bromium.com	threatresearch.ext.hp.com
1	hp.com	threatresearch.ext.hp.com
1	fonts.googleapis.com	threatresearch.ext.hp.com
189	18

This site contains links to these domains. Also see Links.

Domain
www.hp.com
h20429.www2.hp.com
hp.com
support.hp.com
h30434.www3.hp.com
instantink.hpconnected.com
parts.hp.com
register.hp.com
twitter.com
www.linkedin.com
www.facebook.com
malpedia.caad.fkie.fraunhofer.de
www.bleepingcomputer.com
github.com
learn.microsoft.com
pinvoke.net
j00ru.vexillium.org
winscripting.blog
www.cisa.gov
www8.hp.com
jobs.hp.com
investor.hp.com
press.hp.com
garage.hp.com
locator.hp.com
h20212.www2.hp.com
www.hpsalescentral.com
partner.hp.com
developers.hp.com
www.instagram.com
www.youtube.com
h20195.www2.hp.com
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
threatresearch.ext.hp.com Starfield Secure Certificate Authority - G2	`2022-02-12` - `2023-03-15`	a year	crt.sh
www8.hp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2022-02-03` - `2023-02-03`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2022-02-06` - `2023-02-07`	a year	crt.sh
io.bizible.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-30` - `2023-07-31`	a year	crt.sh
cdn-origin-ftp.extweb.hp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2022-05-09` - `2023-05-10`	a year	crt.sh
bromium.com Starfield Secure Certificate Authority - G2	`2022-02-22` - `2023-02-22`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
www.hp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2022-01-25` - `2023-01-25`	a year	crt.sh
*.mktoresp.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-05` - `2023-11-05`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2022-05-01` - `2023-05-01`	a year	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2022-12-13` - `2023-12-13`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
Frame ID: 90C5EA8CBDC5D92E22DABB244AD6065B
Requests: 189 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Magniber Ransomware Adopts JavaScript, Targeting Home Users with Fake Software Updates | HP Wolf SecurityBack ButtonFilter Button

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc\.clientlibs/

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Backbone.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

backbone.*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Lightbox (JavaScript Libraries) Expand

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Revslider (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

/revslider/[/\w-]+/js

Select2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

select2(?:\.min|\.full)?\.js

Underscore.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

underscore.*\.js(?:\?ver=([\d.]+))?

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

189
Requests

99 %
HTTPS

65 %
IPv6

15
Domains

18
Subdomains

17
IPs

4
Countries

12551 kB
Transfer

18169 kB
Size

21
Cookies

214 Outgoing links

These are links going to different origins than the main page.

URL: https://www.hp.com/us-en/home.html

Search URL Search Domain Scan URL

URL: https://www.hp.com/webapp/wcs/stores/servlet/AjaxOrderItemDisplayView?langId=-1&catalogId=10051&storeId=10151

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/security/endpoint-security-solutions.html
Title: Security

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/solutions/hybrid-work.html
Title: Hybrid work

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/printers/hp-plus.html
Title: HP+ smart printing system

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/printers/instant-ink.html
Title: Instant Ink

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/printers/printandplay.html
Title: Print, play, learn

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/vr/vr-products.html
Title: VR

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/hp-information/sustainable-impact.html
Title: Sustainable Impact

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/printers/site-print/layout-robot.html
Title: Construction layout robot

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/laptops-and-2-in-1s.html
Title: Laptops

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/desktops-and-all-in-ones.html
Title: Desktops

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/gaming.html
Title: Gaming

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/monitors-accessories/computer-monitors.html
Title: Monitors

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/monitors-accessories/computer-accessories.html
Title: Accessories

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/laptops/business-laptops-and-2-in-1s.html
Title: Business laptops

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/desktops/business-desktops.html
Title: Business desktops

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/workstations/workstation-pcs.html
Title: Workstations

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/solutions/pos-systems.html#All-in-OneSystems
Title: Retail solutions

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/cartridge/ink-toner-paper.html
Title: Ink, toner & papers

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/printers/home-printers.html
Title: Home printers

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/printers/business-printers.html
Title: Home office & Business printers

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/printers/enterprise-printers.html
Title: Enterprise printers

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/printers/scanners.html
Title: Scanners

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/printers/large-format.html
Title: Large-format printers & plotters

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/industrial-digital-presses.html
Title: Industrial presses

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/specialty-printing-solutions.html
Title: Specialty printing solutions

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/services/managed-print-services.html
Title: Managed print services

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/printers/3d-printers.html
Title: 3D print

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/printers/3d-printers/molded-fiber-tooling.html
Title: Molded fiber

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/solutions/presence.html
Title: Collaboration

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/solutions/digital-workspaces.html
Title: Digital workspaces

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/solutions/industries.html
Title: Industry solutions

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/services.html
Title: Business services

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/services/consumer/services-overview.html
Title: Consumer services

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/solutions/business-solutions.html
Title: Explore all

Search URL Search Domain Scan URL

URL: https://h20429.www2.hp.com/HP2B/landingpages/US_Public_Sector.html
Title: Public sector purchasing

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop
Title: HP.com store

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/cat/ink--toner---paper
Title: Ink & toner cartridges

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/cv/instantink
Title: Instant Ink

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/slp/weekly-deals
Title: Weekly Deals

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/slp/holiday-gift-guide
Title: Holiday Gift Guide

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/cat/business-solutions
Title: Business store

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/cv/hp-business-club
Title: Business discounts

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/cv/smallbusinessadvisor
Title: Small Business Advisor

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/cv/hp-education
Title: University student discounts

Search URL Search Domain Scan URL

URL: https://www.hp.com/webapp/wcs/stores/servlet/MyAccountOrderStatusView?catalogId=10051&langId=-1&storeId=10151&krypto=7GuY4YJJvZeu0wI0CGjE%2Bw%3D%3D&ddkey=http:MyAccountOrderStatusView
Title: Track your order

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/cat/laptops
Title: Laptops

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/cat/desktops
Title: Desktops

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/slp/hp-gaming
Title: Gaming PCs

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/vwa/business-solutions/bizcat=Laptop
Title: Business laptops

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/mlp/business-solutions/desktops-and-workstations
Title: Business desktops

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/mlp/business-solutions/workstations
Title: Z Workstations

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/cv/hp-chromebooks
Title: Chromebooks

Search URL Search Domain Scan URL

URL: https://hp.com/us-en/shop/cat/printers
Title: Printers

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/vwa/printers/prnttyp=Laser
Title: Laser printers

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/vwa/printers/segm=Home,Home-and-home-office
Title: Home & home office printers

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/slp/designjet-plotter-printers
Title: Large format plotter printers

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/slp/hp-plus-printers/hp-plus
Title: HP+

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/slp/hp-refurbs
Title: Refurbished printers

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/vwa/ink--toner---paper/papertype=HP-Business-Papers-for-inkjet,HP-Business-Papers-for-laser,HP-Business-Papers-for-laser-HP-Business-Papers-for-inkjet,HP-Home-Office-Papers,HP-Photo-Papers-for-inkjet,Large-format
Title: Paper

Search URL Search Domain Scan URL

URL: https://hp.com/us-en/shop/cat/accessories-88342--1
Title: Accessories

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/vwa/accessories-88342--1/subcat=Monitors
Title: Monitors

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/vwa/accessories-88342--1/subcat=Workspace-Accessories;typeworkacc=Docking-Stations,USB-Hubs
Title: Docking stations & hubs

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/vwa/accessories-88342--1/subcat=Mice-Keyboards
Title: Mice & keyboards

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/vwa/accessories-88342--1/subcat=Audio-Video-Multimedia
Title: Audio & video

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/vwa/accessories-88342--1/subcat=Bundles
Title: Holiday bundles

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/vwa/accessories-88342--1/subcat=Software
Title: Software

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/vwa/accessories-88342--1/subcat=Chargers-Adapters
Title: Chargers & power adapters

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/cat/care-packs-88343--1
Title: Care packs

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/slp/consumer-support-services/hp-smartfriend
Title: HP support services

Search URL Search Domain Scan URL

URL: https://support.hp.com/us-en
Title: Support & troubleshooting

Search URL Search Domain Scan URL

URL: https://support.hp.com/us-en/drivers
Title: Software & drivers

Search URL Search Domain Scan URL

URL: https://support.hp.com/us-en/topic/diagnostics
Title: Diagnostic tools

Search URL Search Domain Scan URL

URL: https://h30434.www3.hp.com/
Title: Community

Search URL Search Domain Scan URL

URL: https://support.hp.com/us-en/topic/windows-10-support-center
Title: Windows 10 / Windows 11 Support

Search URL Search Domain Scan URL

URL: https://support.hp.com/us-en/printer
Title: Printing

Search URL Search Domain Scan URL

URL: https://support.hp.com/us-en/computer
Title: Computing

Search URL Search Domain Scan URL

URL: https://instantink.hpconnected.com/us/en/l/
Title: Instant Ink

Search URL Search Domain Scan URL

URL: https://support.hp.com/us-en/products
Title: Other Products

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/contact-hp/contact.html
Title: Contact us

Search URL Search Domain Scan URL

URL: https://support.hp.com/us-en/checkwarranty
Title: Check warranty

Search URL Search Domain Scan URL

URL: https://support.hp.com/us-en/service-center
Title: Authorized service providers

Search URL Search Domain Scan URL

URL: https://support.hp.com/us-en/security-bulletins
Title: Security bulletin archive

Search URL Search Domain Scan URL

URL: https://parts.hp.com/hpparts/default.aspx?cc=US&lang=EN
Title: Parts store

Search URL Search Domain Scan URL

URL: https://register.hp.com/americas/flowPage/registration/index.do?execution=e1s1&cc=US&lang=en
Title: Product registration

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?url=https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Search URL Search Domain Scan URL

URL: https://hp.com/wolf
Title: HP Wolf Security

Search URL Search Domain Scan URL

URL: https://malpedia.caad.fkie.fraunhofer.de/details/win.magniber
Title: Magniber

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/fake-windows-10-updates-infect-you-with-magniber-ransomware/
Title: known to demand $2,500

Search URL Search Domain Scan URL

URL: https://github.com/tyranid/DotNetToJScript
Title: DotNetToJScript

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows-server/storage/file-server/volume-shadow-copy-service
Title: shadow copy files

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows/win32/memory/memory-protection-constants
Title: PAGE_EXECUTE_READWRITE

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows/win32/api/winnls/nf-winnls-enumuilanguagesa
Title: EnumUILanguages

Search URL Search Domain Scan URL

URL: http://pinvoke.net/default.aspx/ntdll/NtCreateThreadEx.html
Title: NtCreateThreadEx

Search URL Search Domain Scan URL

URL: https://j00ru.vexillium.org/syscalls/nt/64/
Title: source

Search URL Search Domain Scan URL

URL: https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/
Title: UAC bypass

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bcdedit
Title: bcdedit

Search URL Search Domain Scan URL

URL: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
Title: wbadmin

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/uscert/bsi/articles/knowledge/principles/least-privilege
Title: principle of least privilege

Search URL Search Domain Scan URL

URL: https://www8.hp.com/lamerica_nsc_cnt_amer/es/home.html
Title: América Central

Search URL Search Domain Scan URL

URL: https://www8.hp.com/ar/es/home.html
Title: Argentina

Search URL Search Domain Scan URL

URL: https://www8.hp.com/bo/es/home.html
Title: Bolivia

Search URL Search Domain Scan URL

URL: https://www8.hp.com/br/pt/home.html
Title: Brasil

Search URL Search Domain Scan URL

URL: https://www8.hp.com/ca/en/home.html
Title: Canada

Search URL Search Domain Scan URL

URL: https://www8.hp.com/ca/fr/home.html
Title: Canada - Français

Search URL Search Domain Scan URL

URL: https://www8.hp.com/lamerica_nsc_carib/en/home.html
Title: Caribbean

Search URL Search Domain Scan URL

URL: https://www8.hp.com/cl/es/home.html
Title: Chile

Search URL Search Domain Scan URL

URL: https://www8.hp.com/co/es/home.html
Title: Colombia

Search URL Search Domain Scan URL

URL: https://www8.hp.com/ec/es/home.html
Title: Ecuador

Search URL Search Domain Scan URL

URL: https://www8.hp.com/mx/es/home.html
Title: México

Search URL Search Domain Scan URL

URL: https://www8.hp.com/py/es/home.html
Title: Paraguay

Search URL Search Domain Scan URL

URL: https://www8.hp.com/pe/es/home.html
Title: Perú

Search URL Search Domain Scan URL

URL: https://www8.hp.com/pr/es/home.html
Title: Puerto Rico

Search URL Search Domain Scan URL

URL: https://www8.hp.com/us/en/home.html
Title: United States

Search URL Search Domain Scan URL

URL: https://www8.hp.com/uy/es/home.html
Title: Uruguay

Search URL Search Domain Scan URL

URL: https://www8.hp.com/ve/es/home.html
Title: Venezuela

Search URL Search Domain Scan URL

URL: https://www8.hp.com/asia_pac/en/default.html
Title: Asia Pacific

Search URL Search Domain Scan URL

URL: https://www8.hp.com/au/en/home.html
Title: Australia

Search URL Search Domain Scan URL

URL: https://www.hp.com/bd-en/home.html
Title: Bangladesh

Search URL Search Domain Scan URL

URL: https://www8.hp.com/hk/en/home.html
Title: Hong Kong SAR

Search URL Search Domain Scan URL

URL: https://www8.hp.com/in/en/home.html
Title: India

Search URL Search Domain Scan URL

URL: https://www.hp.com/id-id/home.html
Title: Indonesia

Search URL Search Domain Scan URL

URL: https://www8.hp.com/my/en/home.html
Title: Malaysia

Search URL Search Domain Scan URL

URL: https://www8.hp.com/nz/en/home.html
Title: New Zealand

Search URL Search Domain Scan URL

URL: https://www8.hp.com/ph/en/home.html
Title: Philippines

Search URL Search Domain Scan URL

URL: https://www8.hp.com/sg/en/home.html
Title: Singapore

Search URL Search Domain Scan URL

URL: https://www.hp.com/lk-en/home.html
Title: Sri Lanka

Search URL Search Domain Scan URL

URL: https://www.hp.com/vn-vi/home.html
Title: Việt Nam

Search URL Search Domain Scan URL

URL: https://www.hp.com/th-th/home.html
Title: ไทย

Search URL Search Domain Scan URL

URL: https://www8.hp.com/cn/zh/home.html
Title: 中华人民共和国

Search URL Search Domain Scan URL

URL: https://www8.hp.com/hk/zh/home.html
Title: 中國香港 - 繁體中文

Search URL Search Domain Scan URL

URL: https://www8.hp.com/tw/zh/home.html
Title: 臺灣地區

Search URL Search Domain Scan URL

URL: https://www8.hp.com/jp/ja/home.html
Title: 日本

Search URL Search Domain Scan URL

URL: https://www8.hp.com/kr/ko/home.html
Title: 한국

Search URL Search Domain Scan URL

URL: https://www8.hp.com/emea_africa/en/home.html
Title: Africa

Search URL Search Domain Scan URL

URL: https://www8.hp.com/emea_africa/fr/home.html
Title: Afrique

Search URL Search Domain Scan URL

URL: https://www8.hp.com/be/nl/home.html
Title: België

Search URL Search Domain Scan URL

URL: https://www8.hp.com/be/fr/home.html
Title: Belgique

Search URL Search Domain Scan URL

URL: https://www8.hp.com/cz/cs/home.html
Title: Česká republika

Search URL Search Domain Scan URL

URL: https://www8.hp.com/dk/da/home.html
Title: Danmark

Search URL Search Domain Scan URL

URL: https://www8.hp.com/de/de/home.html
Title: Deutschland

Search URL Search Domain Scan URL

URL: https://www8.hp.com/ee/et/home.html
Title: Eesti

Search URL Search Domain Scan URL

URL: https://www8.hp.com/es/es/home.html
Title: España

Search URL Search Domain Scan URL

URL: https://www8.hp.com/fr/fr/home.html
Title: France

Search URL Search Domain Scan URL

URL: https://www8.hp.com/hr/hr/home.html
Title: Hrvatska

Search URL Search Domain Scan URL

URL: https://www8.hp.com/ie/en/home.html
Title: Ireland

Search URL Search Domain Scan URL

URL: https://www8.hp.com/it/it/home.html
Title: Italia

Search URL Search Domain Scan URL

URL: https://www8.hp.com/lv/lv/home.html
Title: Latvija

Search URL Search Domain Scan URL

URL: https://www8.hp.com/lt/lt/home.html
Title: Lietuva

Search URL Search Domain Scan URL

URL: https://www8.hp.com/hu/hu/home.html
Title: Magyarország

Search URL Search Domain Scan URL

URL: https://www8.hp.com/emea_middle_east/en/home.html
Title: Middle East

Search URL Search Domain Scan URL

URL: https://www8.hp.com/nl/nl/home.html
Title: Nederland

Search URL Search Domain Scan URL

URL: https://www8.hp.com/no/no/home.html
Title: Norge

Search URL Search Domain Scan URL

URL: https://www8.hp.com/at/de/home.html
Title: Österreich

Search URL Search Domain Scan URL

URL: https://www8.hp.com/pl/pl/home.html
Title: Polska

Search URL Search Domain Scan URL

URL: https://www8.hp.com/pt/pt/home.html
Title: Portugal

Search URL Search Domain Scan URL

URL: https://www8.hp.com/ro/ro/home.html
Title: România

Search URL Search Domain Scan URL

URL: https://www8.hp.com/sa/en/home.html
Title: Saudi Arabia

Search URL Search Domain Scan URL

URL: https://www8.hp.com/si/sl/home.html
Title: Slovenija

Search URL Search Domain Scan URL

URL: https://www8.hp.com/sk/sk/home.html
Title: Slovensko

Search URL Search Domain Scan URL

URL: https://www8.hp.com/za/en/home.html
Title: South Africa

Search URL Search Domain Scan URL

URL: https://www8.hp.com/ch/fr/home.html
Title: Suisse

Search URL Search Domain Scan URL

URL: https://www8.hp.com/fi/fi/home.html
Title: Suomi

Search URL Search Domain Scan URL

URL: https://www8.hp.com/se/sv/home.html
Title: Sverige

Search URL Search Domain Scan URL

URL: https://www8.hp.com/ch/de/home.html
Title: Switzerland

Search URL Search Domain Scan URL

URL: https://www8.hp.com/tr/tr/home.html
Title: Türkiye

Search URL Search Domain Scan URL

URL: https://www8.hp.com/uk/en/home.html
Title: United Kingdom

Search URL Search Domain Scan URL

URL: https://www8.hp.com/gr/el/home.html
Title: Ελλάδα

Search URL Search Domain Scan URL

URL: https://www8.hp.com/bg/bg/home.html
Title: България

Search URL Search Domain Scan URL

URL: https://www8.hp.com/kz/ru/home.html
Title: Казахстан

Search URL Search Domain Scan URL

URL: https://www8.hp.com/rs/sr/home.html
Title: Србија

Search URL Search Domain Scan URL

URL: https://www.hp.com/ua-uk/home.html
Title: Україна

Search URL Search Domain Scan URL

URL: https://www8.hp.com/il/he/home.html
Title: ישראל

Search URL Search Domain Scan URL

URL: https://www8.hp.com/emea_middle_east/ar/home.html
Title: الشرق الأوسط

Search URL Search Domain Scan URL

URL: https://www8.hp.com/sa/ar/home.html
Title: المملكة العربية السعودية

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/hp-information.html
Title: About Us

Search URL Search Domain Scan URL

URL: https://jobs.hp.com/en-us/
Title: Careers

Search URL Search Domain Scan URL

URL: https://investor.hp.com/home/default.aspx
Title: Investor relations

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/hp-information/about-hp/diversity.html
Title: Diversity, Equity and Inclusion

Search URL Search Domain Scan URL

URL: https://press.hp.com/us/en.html
Title: Press center

Search URL Search Domain Scan URL

URL: https://garage.hp.com/us/en.html
Title: The Garage

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/contact-hp/shopping.html
Title: Call an HP rep

Search URL Search Domain Scan URL

URL: https://locator.hp.com/us/en/?ml___lang=en-US%20(1)&ml___region=us&ml___cont=US
Title: Find a reseller

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/hp-information/business-site.html
Title: Enterprise store

Search URL Search Domain Scan URL

URL: https://support.hp.com/us-en/
Title: Support

Search URL Search Domain Scan URL

URL: https://register.hp.com/apac/flowPage/registration/index.do?execution=e1s1&cc=us&lang=en
Title: Register your product

Search URL Search Domain Scan URL

URL: https://h20212.www2.hp.com/Cso_Status/CsoStatus.aspx?lc=en&cc=us
Title: Check repair status

Search URL Search Domain Scan URL

URL: https://www.hpsalescentral.com/#/training/training
Title: Training & certification

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/hpfraud-alert.html
Title: Fraud alert

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/security/cyber-security-center.html
Title: Security Center

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/solutions/hp-amplify-partner-program.html
Title: HP Amplify Partner Program

Search URL Search Domain Scan URL

URL: https://partner.hp.com/login
Title: HP Partner Portal

Search URL Search Domain Scan URL

URL: https://developers.hp.com/
Title: Developers

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/hp

Search URL Search Domain Scan URL

URL: http://www.facebook.com/HP

Search URL Search Domain Scan URL

URL: https://www.instagram.com/hp/

Search URL Search Domain Scan URL

URL: https://twitter.com/HP

Search URL Search Domain Scan URL

URL: http://www.youtube.com/hp

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/hp-information/recalls.html
Title: Recalls

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/hp-information/sustainable-impact/planet-product-recycling.html
Title: Product recycling

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/hp-information/accessibility-aging.html
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://h20195.www2.hp.com/v2/GetDocument.aspx?docname=c05388050
Title: CA Supply Chains Act

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/privacy/privacy-central.html
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/privacy/use-of-cookies.html
Title: Use of cookies

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/personal-data-rights.html
Title: Personal data rights

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/terms-of-use.html
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/privacy/limited_warranty.html
Title: Limited warranty statement

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/shop/cv/termsandconditions?jumpid=re_r11662_redirect_ETR&ts=20151012014516_LIymYBM9Ho1W
Title: Terms & conditions of sales & service

Search URL Search Domain Scan URL

URL: https://www.hp.com/us-en/privacy/privacy.html#section=What-Data-We-Collect
Title: (What data we collect)

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://www8.hp.com/us/en/scripts/framework/jquery/v-1-8/jquery.js HTTP 301
https://www.hp.com/us-en/scripts/framework/jquery/v-1-8/jquery.js

Request Chain 1

https://www8.hp.com/us/en/scripts/framework/jquery/v-1-8/can.jquery.js HTTP 301
https://www.hp.com/us-en/scripts/framework/jquery/v-1-8/can.jquery.js

189 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/ 1 MB
150 KB 529ms
8ms Document
text/html 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

93d8e449cf5588f81cdf7f5906b7fce641d7693deac6efc27aa7ac9b1e38f6bf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
content-encoding: br
content-security-policy: upgrade-insecure-requests;
content-type: text/html; charset=UTF-8
date: Mon, 19 Dec 2022 10:56:26 GMT
host-header: 8441280b0c35cbc1147f8ba998a563a7
link: <https://threatresearch.ext.hp.com/wp-json/>; rel="https://api.w.org/", <https://threatresearch.ext.hp.com/wp-json/wp/v2/posts/22511>; rel="alternate"; type="application/json", <https://threatresearch.ext.hp.com/?p=22511>; rel=shortlink
server: nginx
vary: Accept-Encoding
x-cache-enabled: True
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-httpd: 1
x-proxy-cache: HIT
x-sucuri-cache: HIT
x-sucuri-id: 15009
x-xss-protection: 1; mode=block

GET
H2

200

jquery.js Show response
www.hp.com/us-en/scripts/framework/jquery/v-1-8/
Redirect Chain

https://www8.hp.com/us/en/scripts/framework/jquery/v-1-8/jquery.js
https://www.hp.com/us-en/scripts/framework/jquery/v-1-8/jquery.js

141 KB
41 KB

193ms
28ms

Script
application/javascript

2a02:26f0:6c00::210:ba99
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.hp.com/us-en/scripts/framework/jquery/v-1-8/jquery.js

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Server

2a02:26f0:6c00::210:ba99 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

42c9bbf0bfd51db9c2f857c01784e8be555ac102a251f51823fd6b25960ccc12

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-dispatcher: dispatcher2westus2
date: Mon, 19 Dec 2022 10:56:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=600
akamai-grn: , , 0.95ba1002.1671447387.2d5afa7b
x-vhost: publish
content-length: 41470
last-modified: Wed, 26 Jan 2022 20:34:30 GMT
server: Apache
etag: "23521-5d68220ec4180-gzip"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN, SAMEORIGIN, SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Tue, 20 Dec 2022 10:56:27 GMT

Redirect headers

location: https://www.hp.com/us-en/scripts/framework/jquery/v-1-8/jquery.js
pragma: no-cache
date: Mon, 19 Dec 2022 10:56:27 GMT
cache-control: max-age=0, no-cache, no-store
server: AkamaiGHost
content-length: 0
expires: Mon, 19 Dec 2022 10:56:27 GMT

GET
H2

200

can.jquery.js Show response
www.hp.com/us-en/scripts/framework/jquery/v-1-8/
Redirect Chain

https://www8.hp.com/us/en/scripts/framework/jquery/v-1-8/can.jquery.js
https://www.hp.com/us-en/scripts/framework/jquery/v-1-8/can.jquery.js

49 KB
16 KB

182ms
21ms

Script
application/javascript

2a02:26f0:6c00::210:ba99
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.hp.com/us-en/scripts/framework/jquery/v-1-8/can.jquery.js

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Server

2a02:26f0:6c00::210:ba99 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

a8706f9a07813ae80582404c482cba9754150066c9f04ffcdcd9e549632d16be

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-dispatcher: dispatcher2eastus2
date: Mon, 19 Dec 2022 10:56:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=600
akamai-grn: , , , , 0.95ba1002.1671447387.2d5afa7c
x-vhost: publish
content-length: 15442
last-modified: Wed, 26 Jan 2022 20:26:35 GMT
server: Apache
etag: "c49d-5d682049c54c0-gzip"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN, SAMEORIGIN, SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Tue, 20 Dec 2022 10:56:27 GMT

Redirect headers

location: https://www.hp.com/us-en/scripts/framework/jquery/v-1-8/can.jquery.js
pragma: no-cache
date: Mon, 19 Dec 2022 10:56:27 GMT
cache-control: max-age=0, no-cache, no-store
server: AkamaiGHost
content-length: 0
expires: Mon, 19 Dec 2022 10:56:27 GMT

GET
H2 200 latest.r Show response
www8.hp.com/caas/header-footer/us/en/default/ 350 KB
28 KB 139ms
13ms Script
application/javascript 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www8.hp.com/caas/header-footer/us/en/default/latest.r?contentType=js

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-109-56-104.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

89b7e1d2019680a8953887a355e38c66f0c25b898eac8487ac69f95f9bdc6e3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=600, max-age=600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-dispatcher: dispatcher1eastus2
strict-transport-security: max-age=600, max-age=600
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 19 Dec 2022 10:56:27 GMT
akamai-grn: ,
x-vhost: globalnav
content-length: 28015
last-modified: Thu, 15 Dec 2022 20:20:20 GMT
server: Apache
etag: "579c3-5efe3950c1fa2-gzip"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=297501
accept-ranges: bytes
expires: Thu, 22 Dec 2022 21:34:48 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 112 KB
44 KB 160ms
4ms Script
application/javascript 2a00:1450:4001:803::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-197588716-1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bc9884b8678b7c60e4380d9373becaadeede44e4fdd14d170971f60595f4dcff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 44684
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 19 Dec 2022 10:56:27 GMT

GET
H2 200 blocks.style.build.css
threatresearch.ext.hp.com/wp-content/plugins/social-warfare/assets/js/post-editor/dist/ 2 KB
1 KB 20ms
11ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/social-warfare/assets/js/post-editor/dist/blocks.style.build.css?ver=6.1.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

4834aa58000857ce42bdc4ae2322104fbbb5c0e96a7dbd4deab73900ae9d23a7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Fri, 27 Aug 2021 01:59:25 GMT
server: nginx
etag: W/"8a1-5ca80d536d39a"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 layerslider.css
threatresearch.ext.hp.com/wp-content/plugins/LayerSlider/assets/static/layerslider/css/ 25 KB
5 KB 20ms
12ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/LayerSlider/assets/static/layerslider/css/layerslider.css?ver=7.5.3

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

feeb150a3bd16c65fc36dca51f686a254645a5d60adb4a37aaaa797339013816

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:52:09 GMT
server: nginx
etag: W/"63de-5eb94f7d8b4cb"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 css
fonts.googleapis.com/ 47 KB
2 KB 100ms
35ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i,900,900i%7COpen+Sans:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i,900,900i%7CIndie+Flower:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i,900,900i%7COswald:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i,900,900i

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

56ad6f73cd42c34973f5903add0b80f25ab64da518ab7b779a5d62b0f8f71d2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 19 Dec 2022 10:56:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 19 Dec 2022 09:40:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 19 Dec 2022 10:56:27 GMT

GET
H2 200 mediaelementplayer-legacy.min.css
threatresearch.ext.hp.com/wp-includes/js/mediaelement/ 11 KB
3 KB 21ms
13ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Fri, 30 Apr 2021 03:10:53 GMT
server: nginx
etag: W/"2bf8-5c127f5aab452"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wp-mediaelement.min.css
threatresearch.ext.hp.com/wp-includes/js/mediaelement/ 4 KB
1 KB 22ms
14ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.1.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Tue, 17 Dec 2019 03:59:47 GMT
server: nginx
etag: W/"105a-599de5bea507f"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 views-frontend.css
threatresearch.ext.hp.com/wp-content/plugins/wp-views/public/css/ 23 KB
4 KB 23ms
15ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/wp-views/public/css/views-frontend.css?ver=3.6.3

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

b062f2232e3094e4cfbd9543fdf9f043d560f92f8f064813e7a71f80b35ce1fa

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Thu, 19 May 2022 22:31:36 GMT
server: nginx
etag: W/"5db6-5df64efcc4927"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 classic-themes.min.css
threatresearch.ext.hp.com/wp-includes/css/ 217 B
600 B 24ms
17ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/css/classic-themes.min.css?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:35:46 GMT
server: nginx
etag: W/"d9-5ee7de3f810ce"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 styles.css
threatresearch.ext.hp.com/wp-content/plugins/ditty-news-ticker/legacy/inc/static/libs/fontastic/ 5 KB
1 KB 25ms
18ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/ditty-news-ticker/legacy/inc/static/libs/fontastic/styles.css?ver=3.0.30

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

578332cd14c1c8f1c9ea7cc966ca50ae73945b7de3055e07f06dc099d4feeee0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:22:29 GMT
server: nginx
etag: W/"1421-5ee7db47056b7"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.css
threatresearch.ext.hp.com/wp-content/plugins/ditty-news-ticker/legacy/inc/static/css/ 10 KB
2 KB 26ms
18ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/ditty-news-ticker/legacy/inc/static/css/style.css?ver=3.0.30

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

e19a0e64789068d756a1b250084e54bb0ef77da66685e3dd9eafdc9a71ea1406

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:22:29 GMT
server: nginx
etag: W/"2678-5ee7db4702bbe"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 ditty.css
threatresearch.ext.hp.com/wp-content/plugins/ditty-news-ticker/includes/css/ 37 KB
6 KB 26ms
19ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/ditty-news-ticker/includes/css/ditty.css?ver=3.0.30

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

9e9b2b2d98bb21ba98a3e7d0166f2de7bae986b81a727c7804a44f4f81b09737

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:22:29 GMT
server: nginx
etag: W/"9417-5ee7db471cdbe"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 all.css
threatresearch.ext.hp.com/wp-content/plugins/ditty-news-ticker//includes/libs/fontawesome-6.2.0/css/ 136 KB
22 KB 27ms
20ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/ditty-news-ticker//includes/libs/fontawesome-6.2.0/css/all.css?ver=6.2.0

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

83c5ebd47131aa8aeef9d7ace04d313c997b67934791fa92c366e78e99242329

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:22:29 GMT
server: nginx
etag: W/"220f1-5ee7db4722798"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.css
threatresearch.ext.hp.com/wp-content/plugins/thumbs-rating/css/ 859 B
675 B 28ms
22ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/thumbs-rating/css/style.css?ver=4.0.3

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

ee991e02add6bbe26b55d521d8f83e94031eb9f9f636b30756d4e3fc09a3cff4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Fri, 30 Apr 2021 02:10:54 GMT
server: nginx
etag: W/"35b-5c1271f2f1cab"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 ult_marketo_forms-public.css
threatresearch.ext.hp.com/wp-content/plugins/ultimate-marketo-forms/public/css/ 35 B
494 B 29ms
23ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/ultimate-marketo-forms/public/css/ult_marketo_forms-public.css?ver=1.0.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

7a109bbaf31b60ea0c1182758f73e7e2050aeabc9d37913ebc0c72030a48cf23

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 17 Dec 2018 17:45:47 GMT
server: nginx
etag: W/"23-57d3b59d188c0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wonderplugin3dcarousel.css
threatresearch.ext.hp.com/wp-content/plugins/wonderplugin-3dcarousel/engine/ 24 KB
2 KB 30ms
24ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/wonderplugin-3dcarousel/engine/wonderplugin3dcarousel.css?ver=4.3.1PRO

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

62855a25508bf218a96a1179788320756ce0ae0346a586cca1fc5a6b5e7a4668

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:40:00 GMT
server: nginx
etag: W/"61f9-5eb94cc6a08e7"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wonderpluginsliderengine.css
threatresearch.ext.hp.com/wp-content/plugins/wonderplugin-slider/engine/ 16 KB
1 KB 30ms
24ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/wonderplugin-slider/engine/wonderpluginsliderengine.css?ver=13.5.1PRO

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

c3ef28a4f156c353239b74328046126175c702be2d89b9a24c8527a8b53ee0e4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:24:40 GMT
server: nginx
etag: W/"4039-5ee7dbc45fb0c"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 frontend.min.css
threatresearch.ext.hp.com/wp-content/plugins/wp-user-avatar/assets/css/ 99 KB
14 KB 31ms
25ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/wp-user-avatar/assets/css/frontend.min.css?ver=4.4.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

c74e09e98dae6e3a87e561dc5a65603f5eee4b9d6d38729a4799c201b50d17da

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Sun, 18 Dec 2022 23:03:10 GMT
server: nginx
etag: W/"18ad0-5f02234df70e4"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 flatpickr.min.css
threatresearch.ext.hp.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/ 14 KB
3 KB 32ms
26ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/flatpickr.min.css?ver=4.4.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

3668f6d335416599574fb1f336cbd2b9bb2f8fcff63e63a9ca3b68df4d0c6165

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Sun, 18 Dec 2022 23:03:10 GMT
server: nginx
etag: W/"3601-5f02234e02c68"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 select2.min.css
threatresearch.ext.hp.com/wp-content/plugins/wp-user-avatar/assets/select2/ 15 KB
2 KB 32ms
27ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/wp-user-avatar/assets/select2/select2.min.css?ver=6.1.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

044efea78208376302aad3808aaabdf3c2f7bdd80ba9d55c9e0e4d3baa7a3908

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:24:27 GMT
server: nginx
etag: W/"3a75-5ee7dbb828816"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.min.css
threatresearch.ext.hp.com/wp-content/plugins/social-warfare/assets/css/ 87 KB
10 KB 34ms
29ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/social-warfare/assets/css/style.min.css?ver=4.3.0

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

f975207e21041e251c165009f22311cc20b0acf1477d309fd62538beb50e0eb6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Fri, 27 Aug 2021 01:59:25 GMT
server: nginx
etag: W/"15c19-5ca80d536bc29"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.css
threatresearch.ext.hp.com/wp-content/themes/Avada/ 507 B
742 B 35ms
29ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/style.css?ver=6.1.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

472cf661f1007ee950af6a88f55e240f93c279b5b0960ff218c95b864b52a68f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"1fb-5eb94f0f37025"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.min.css
threatresearch.ext.hp.com/wp-content/themes/Avada/assets/css/ 84 KB
15 KB 41ms
16ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/assets/css/style.min.css?ver=7.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

8da3130463864da4b9e900c389edfa7488c93fca573e18766e9660a7b721aea2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"14fe2-5eb94f0f3e16f"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 toolset-common-es-frontend.js Show response
threatresearch.ext.hp.com/wp-content/plugins/wp-views/vendor/toolset/common-es/public/ 4 KB
2 KB 68ms
5ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/wp-views/vendor/toolset/common-es/public/toolset-common-es-frontend.js?ver=163000

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

7c356a9d56062296d80aaa7faa72446bedb5e783aa6a9c557e1efddaa6055258

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Thu, 19 May 2022 22:31:36 GMT
server: nginx
etag: W/"10f5-5df64efcd626d"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.min.js Show response
threatresearch.ext.hp.com/wp-includes/js/jquery/ 88 KB
30 KB 42ms
17ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:35:46 GMT
server: nginx
etag: W/"15e54-5ee7de3f87278"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-migrate.min.js Show response
threatresearch.ext.hp.com/wp-includes/js/jquery/ 11 KB
4 KB 69ms
6ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Fri, 30 Apr 2021 03:10:53 GMT
server: nginx
etag: W/"2bd8-5c127f5aa6e01"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 layerslider.utils.js Show response
threatresearch.ext.hp.com/wp-content/plugins/LayerSlider/assets/static/layerslider/js/ 120 KB
39 KB 70ms
8ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/LayerSlider/assets/static/layerslider/js/layerslider.utils.js?ver=7.5.3

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

919fecd4dc7f498339d04030c87de7f4db63cc2f08be69148562b14dc3a415a6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:52:09 GMT
server: nginx
etag: W/"1e049-5eb94f7d8c46b"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 layerslider.kreaturamedia.jquery.js Show response
threatresearch.ext.hp.com/wp-content/plugins/LayerSlider/assets/static/layerslider/js/ 144 KB
51 KB 73ms
10ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/LayerSlider/assets/static/layerslider/js/layerslider.kreaturamedia.jquery.js?ver=7.5.3

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

0556c9c3691f4d98501088fade814d01213830b5fe9eeb68e7e9a65f68f9c8f1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:52:09 GMT
server: nginx
etag: W/"241c3-5eb94f7d8c46b"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 layerslider.transitions.js Show response
threatresearch.ext.hp.com/wp-content/plugins/LayerSlider/assets/static/layerslider/js/ 23 KB
4 KB 90ms
28ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/LayerSlider/assets/static/layerslider/js/layerslider.transitions.js?ver=7.5.3

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

0ad75b71fbe2be4806d58d482067535f7789abfda5e4eaa18971278e30c70f3e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:52:09 GMT
server: nginx
etag: W/"5ca7-5eb94f7d8c46b"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 frontend-gtag.min.js Show response
threatresearch.ext.hp.com/wp-content/plugins/google-analytics-for-wordpress/assets/js/ 12 KB
3 KB 91ms
29ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/google-analytics-for-wordpress/assets/js/frontend-gtag.min.js?ver=8.10.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

abc9faa4970e07db7d506d6b2a98e4c86223be305c7541ced54ea2e15f99a76e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:22:40 GMT
server: nginx
etag: W/"2e7a-5ee7db51ea71e"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 rbtools.min.js Show response
threatresearch.ext.hp.com/wp-content/plugins/revslider/public/assets/js/ 161 KB
58 KB 92ms
30ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/revslider/public/assets/js/rbtools.min.js?ver=6.6.7

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

c4596b16b126326b0d8fc2fb8bf91389ad3dc4671a269187913c19a8f2ad1094

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:34:06 GMT
server: nginx
etag: W/"285db-5ee7dddfe22f0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 rs6.min.js Show response
threatresearch.ext.hp.com/wp-content/plugins/revslider/public/assets/js/ 399 KB
96 KB 96ms
35ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/revslider/public/assets/js/rs6.min.js?ver=6.6.7

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

208d013c583899ce6bb2fe281662492caa32a1edd39924f7e5760233c22c7f69

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:34:06 GMT
server: nginx
etag: W/"63b18-5ee7dddfe22f0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 general.js Show response
threatresearch.ext.hp.com/wp-content/plugins/thumbs-rating/js/ 2 KB
1 KB 97ms
36ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/thumbs-rating/js/general.js?ver=4.0.3

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

0a3364d1f00ceab070910d588e47e47a584e60e0dc2b235270195f8bbf5a36d1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Fri, 30 Apr 2021 02:10:54 GMT
server: nginx
etag: W/"6c2-5c1271f2f2c4c"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 forms2.min.js Show response
threatresearch.ext.hp.com/wp-content/plugins/ultimate-marketo-forms/public/js/ 164 KB
54 KB 43ms
4ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/ultimate-marketo-forms/public/js/forms2.min.js?ver=1.0.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

de5ba330570616401d1840de0075059a65e62280b8d2524334be84290f43a4d7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 17 Dec 2018 17:45:47 GMT
server: nginx
etag: W/"29076-57d3b59d188c0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 ult_marketo_forms-public.js Show response
threatresearch.ext.hp.com/wp-content/plugins/ultimate-marketo-forms/public/js/ 2 KB
1 KB 45ms
6ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/ultimate-marketo-forms/public/js/ult_marketo_forms-public.js?ver=1.0.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

4463996b808a043a2091ce400b56adcdb7407264272e6d2e389075e143e1c901

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 17 Dec 2018 17:45:47 GMT
server: nginx
etag: W/"6fb-57d3b59d188c0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
2 KB 114ms
20ms Script
application/x-javascript 23.45.104.85
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js?ver=1.0.1
Requested by: Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.104.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-104-85.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Mon, 19 Dec 2022 10:56:27 GMT
Content-Encoding: gzip
Last-Modified: Fri, 09 Sep 2022 01:18:39 GMT
Server: AkamaiNetStorage
ETag: "92b41a298690c047b0c4602dd843cba4:1662686319.691662"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 728

GET
H2 200 wp3dcarousellightbox.js Show response
threatresearch.ext.hp.com/wp-content/plugins/wonderplugin-3dcarousel/engine/ 124 KB
25 KB 97ms
36ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/wonderplugin-3dcarousel/engine/wp3dcarousellightbox.js?ver=4.3.1PRO

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

bbc9f84967a6306b0db8bfc4c80cd5aa2b7733b1a312c684ade35a2972f86edd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:40:00 GMT
server: nginx
etag: W/"1ef75-5eb94cc69f176"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wonderplugin3dcarousel.js Show response
threatresearch.ext.hp.com/wp-content/plugins/wonderplugin-3dcarousel/engine/ 60 KB
11 KB 97ms
37ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/wonderplugin-3dcarousel/engine/wonderplugin3dcarousel.js?ver=4.3.1PRO

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

9209a89d1d74bc0ff6b779bc341ee5e40a72698f078bd4a0ea224e20466b616b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:40:00 GMT
server: nginx
etag: W/"f15e-5eb94cc6a2ff7"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wonderpluginsliderskins.js Show response
threatresearch.ext.hp.com/wp-content/plugins/wonderplugin-slider/engine/ 175 KB
7 KB 47ms
8ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/wonderplugin-slider/engine/wonderpluginsliderskins.js?ver=13.5.1PRO

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

ef8e48e37e4317aa7063a4a2e7056620681b2e69073f922dc8c0d27de3e4cef2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:24:40 GMT
server: nginx
etag: W/"2bb07-5ee7dbc45d3fc"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wonderpluginslider.js Show response
threatresearch.ext.hp.com/wp-content/plugins/wonderplugin-slider/engine/ 318 KB
50 KB 48ms
9ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/wonderplugin-slider/engine/wonderpluginslider.js?ver=13.5.1PRO

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

21593e36fb12916f2fbfe2e3140894e00c0c9757b03c6987aab38d0cd8cdf2c8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:26 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:24:40 GMT
server: nginx
etag: W/"4f9a7-5ee7dbc45e39c"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 flatpickr.min.js Show response
threatresearch.ext.hp.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/ 49 KB
14 KB 98ms
37ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/flatpickr.min.js?ver=4.4.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

1f77f1c60435921cb2d68ccfb3bf2da81dd35f274014c4cd5a5b9c20c4a46a27

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Sun, 18 Dec 2022 23:03:10 GMT
server: nginx
etag: W/"c5ad-5f02234e03050"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 select2.min.js Show response
threatresearch.ext.hp.com/wp-content/plugins/wp-user-avatar/assets/select2/ 69 KB
18 KB 98ms
38ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/wp-user-avatar/assets/select2/select2.min.js?ver=4.4.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

00501810e93307a8882a74d864e7547fd1458deea539361dc1124ac133799a4b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Sun, 18 Dec 2022 23:03:10 GMT
server: nginx
etag: W/"114c3-5f02234df78b5"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 109 KB
43 KB 152ms
0ms Script
application/javascript 2a00:1450:4001:803::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-31745238-1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b6a250b8aee397372a3fb2947076c9d5fbc1cf8578310af151d2f57b81bbfe7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43595
x-xss-protection: 0
last-modified: Mon, 19 Dec 2022 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 19 Dec 2022 10:56:27 GMT

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 83 KB
32 KB 186ms
11ms Script
application/x-javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/scripts/bizible.js
Requested by: Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BA7) /
Resource Hash: 3511de47d3250e54206caa8bfd8b2401d7ae512f821258d06a52d5e9584690f9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:27 GMT
content-encoding: gzip
last-modified: Mon, 12 Dec 2022 18:11:12 GMT
server: ECS (amb/6BA7)
age: 34304
etag: "b32e51e55ed91:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 32316

GET
H/1.1 200
OK privacy-banner.js Show response
hp.com/cma/ng/lib/exceptions/ 16 KB
9 KB 887ms
144ms Script
text/javascript 15.72.164.74
HP-INTERNET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://hp.com/cma/ng/lib/exceptions/privacy-banner.js

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

15.72.164.74 , United States, ASN71 (HP-INTERNET-AS, US),

Reverse DNS

hpdownloads.com

Software

Apache /

Resource Hash

56daa473cc200622ef8ef8c20eb3ded1d19a583b2e0810f8d459326b04f11463

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Mon, 19 Dec 2022 10:56:28 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
ETag: "5ec1a6b6a80c0"
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript
Cache-Control: max-age=7200
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 8374
Expires: Mon, 19 Dec 2022 12:56:28 GMT

GET
H2 200 BromiumBlog_Images_0010.jpg
threatresearch.ext.hp.com/wp-content/uploads/2021/05/ 2 MB
2 MB 98ms
38ms Image
image/jpeg 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2021/05/BromiumBlog_Images_0010.jpg

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

8b625a6ed2cfde39e761f2e9fc10ad83f2d4305c942471f911fcff9e4bb98808

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
content-length: 2094385
x-xss-protection: 1; mode=block
last-modified: Wed, 12 May 2021 10:25:17 GMT
server: nginx
etag: "1ff531-5c21f6d54bdd4"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 magniber_01.png
threatresearch.ext.hp.com/wp-content/uploads/2022/10/ 21 KB
22 KB 98ms
39ms Image
image/png 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2022/10/magniber_01.png

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

a26bbb2fb16ca3717c4690a816e25c43be2ad4fcb45adb878b3c98b6b01fbeb9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

expires: Thu, 31 Dec 2037 23:55:55 GMT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
content-length: 21803
x-xss-protection: 1; mode=block
last-modified: Thu, 13 Oct 2022 10:16:08 GMT
server: nginx
etag: "552b-5eae7cc429ae2"
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
x-proxy-cache: HIT

GET
H2 200 magniber_02.png
threatresearch.ext.hp.com/wp-content/uploads/2022/10/ 101 KB
102 KB 98ms
39ms Image
image/png 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2022/10/magniber_02.png

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

5a4f9b81ce5e4dc3bb3fa525cd250753923aa7474a9d5bbf8801048a3fb10c24

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

expires: Thu, 31 Dec 2037 23:55:55 GMT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
content-length: 103785
x-xss-protection: 1; mode=block
last-modified: Thu, 13 Oct 2022 10:16:10 GMT
server: nginx
etag: "19569-5eae7cc63c7b4"
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
x-proxy-cache: HIT

GET
H2 200 magniber_03.png
threatresearch.ext.hp.com/wp-content/uploads/2022/10/ 59 KB
59 KB 98ms
40ms Image
image/png 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2022/10/magniber_03.png

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

9db372bd5a5d506904ce7fda178ece352bfe33dd38292f8d398e613eb4a7968a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

expires: Thu, 31 Dec 2037 23:55:55 GMT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
content-length: 60430
x-xss-protection: 1; mode=block
last-modified: Thu, 13 Oct 2022 10:16:13 GMT
server: nginx
etag: "ec0e-5eae7cc8c862b"
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
x-proxy-cache: HIT

GET
H2 200 magniber_04.png
threatresearch.ext.hp.com/wp-content/uploads/2022/10/ 73 KB
73 KB 98ms
40ms Image
image/png 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2022/10/magniber_04.png

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

192a450bdc8200b9df998cd74c4295d01acd74430375452983b4de474375829d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

expires: Thu, 31 Dec 2037 23:55:55 GMT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
content-length: 74370
x-xss-protection: 1; mode=block
last-modified: Thu, 13 Oct 2022 10:08:56 GMT
server: nginx
etag: "12282-5eae7b28260d6"
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
x-proxy-cache: HIT

GET
H2 200 magniber_05.png
threatresearch.ext.hp.com/wp-content/uploads/2022/10/ 45 KB
45 KB 821ms
764ms Image
image/png 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2022/10/magniber_05.png

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

527d982dd4e2527fafe888adec2c719929a6476b2106952464a65ea02dee7893

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

expires: Thu, 31 Dec 2037 23:55:55 GMT
date: Mon, 19 Dec 2022 10:56:28 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-sucuri-cache: MISS
host-header: 8441280b0c35cbc1147f8ba998a563a7
content-length: 46106
x-xss-protection: 1; mode=block
last-modified: Thu, 13 Oct 2022 10:16:25 GMT
server: nginx
etag: "b41a-5eae7cd3c68f5"
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
x-proxy-cache: HIT

GET
H2 200 magniber_06.png
threatresearch.ext.hp.com/wp-content/uploads/2022/10/ 32 KB
32 KB 808ms
751ms Image
image/png 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2022/10/magniber_06.png

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

a81c390548502ac446b8c2eabdc6ea07a8bc43b23e206a9c232d3ceaef3cae9a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

expires: Thu, 31 Dec 2037 23:55:55 GMT
date: Mon, 19 Dec 2022 10:56:28 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-sucuri-cache: MISS
host-header: 8441280b0c35cbc1147f8ba998a563a7
content-length: 32687
x-xss-protection: 1; mode=block
last-modified: Thu, 13 Oct 2022 10:16:27 GMT
server: nginx
etag: "7faf-5eae7cd5e60eb"
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
x-proxy-cache: HIT

GET
H2 200 magniber_07.png
threatresearch.ext.hp.com/wp-content/uploads/2022/10/ 10 KB
10 KB 732ms
675ms Image
image/png 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2022/10/magniber_07.png

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

af810e2b2886d81e6225b34eb2391f15be48f95f5ce80bd04f7b25b6e15eb7c8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

expires: Thu, 31 Dec 2037 23:55:55 GMT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-sucuri-cache: MISS
host-header: 8441280b0c35cbc1147f8ba998a563a7
content-length: 9734
x-xss-protection: 1; mode=block
last-modified: Thu, 13 Oct 2022 10:09:00 GMT
server: nginx
etag: "2606-5eae7b2ba1b86"
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
x-proxy-cache: HIT

GET
H2 200 magniber_08.png
threatresearch.ext.hp.com/wp-content/uploads/2022/10/ 18 KB
18 KB 828ms
771ms Image
image/png 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2022/10/magniber_08.png

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

5d9e229dde2a12fae04e5a3e85eb93f8ef6a7541c0384152901b4d9dec29ef29

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

expires: Thu, 31 Dec 2037 23:55:55 GMT
date: Mon, 19 Dec 2022 10:56:28 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-sucuri-cache: MISS
host-header: 8441280b0c35cbc1147f8ba998a563a7
content-length: 18462
x-xss-protection: 1; mode=block
last-modified: Thu, 13 Oct 2022 10:09:02 GMT
server: nginx
etag: "481e-5eae7b2d6d78a"
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
x-proxy-cache: HIT

GET
H2 200 magniber_09.png
threatresearch.ext.hp.com/wp-content/uploads/2022/10/ 84 KB
85 KB 820ms
764ms Image
image/png 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2022/10/magniber_09.png

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

a537306122d97954096b0591324fdc7f3d8b54a518b20e30714459b3584e6782

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

expires: Thu, 31 Dec 2037 23:55:55 GMT
date: Mon, 19 Dec 2022 10:56:28 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-sucuri-cache: MISS
host-header: 8441280b0c35cbc1147f8ba998a563a7
content-length: 86034
x-xss-protection: 1; mode=block
last-modified: Thu, 13 Oct 2022 10:16:38 GMT
server: nginx
etag: "15012-5eae7ce0c383b"
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
x-proxy-cache: HIT

GET
H2 200 magniber_10.png
threatresearch.ext.hp.com/wp-content/uploads/2022/10/ 52 KB
53 KB 815ms
759ms Image
image/png 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2022/10/magniber_10.png

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

f9060ef4ed91de78998d5f9b15592b736dd9b62f02ecae043dffd6ebca7dd894

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

expires: Thu, 31 Dec 2037 23:55:55 GMT
date: Mon, 19 Dec 2022 10:56:28 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-sucuri-cache: MISS
host-header: 8441280b0c35cbc1147f8ba998a563a7
content-length: 53312
x-xss-protection: 1; mode=block
last-modified: Thu, 13 Oct 2022 10:09:03 GMT
server: nginx
etag: "d040-5eae7b2ef8083"
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
x-proxy-cache: HIT

GET
H2 200 profile_img-150x150.jpg
threatresearch.ext.hp.com/wp-content/uploads/2021/01/ 8 KB
8 KB 96ms
41ms Image
image/jpeg 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2021/01/profile_img-150x150.jpg

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

6eb52a97833a253a404e06ef580bfc474b9883681a2e7abf223b1a9434201bae

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

expires: Thu, 31 Dec 2037 23:55:55 GMT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
content-length: 8242
x-xss-protection: 1; mode=block
last-modified: Tue, 19 Jan 2021 12:52:40 GMT
server: nginx
etag: "2032-5b940505ef0ed"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
x-proxy-cache: HIT

GET
H2 200 BromiumBlog_Images_0008.jpg
threatresearch.ext.hp.com/wp-content/uploads/2021/05/ 2 MB
2 MB 96ms
41ms Image
image/jpeg 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2021/05/BromiumBlog_Images_0008.jpg

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

0df6356a9dd9333fe8a139307f90de62efc5bba4dcb4e8007be03e596f4c2f77

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
content-length: 2045815
x-xss-protection: 1; mode=block
last-modified: Wed, 12 May 2021 10:25:13 GMT
server: nginx
etag: "1f3777-5c21f6d12fcb2"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 blogImage__b6.jpg
threatresearch.ext.hp.com/wp-content/uploads/2021/05/ 2 MB
2 MB 97ms
42ms Image
image/jpeg 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2021/05/blogImage__b6.jpg

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

c85d4f64101e48851e2a89069e50aefd6aeb901c535c7aa39986903d4baf1353

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
content-length: 2050865
x-xss-protection: 1; mode=block
last-modified: Wed, 12 May 2021 11:13:55 GMT
server: nginx
etag: "1f4b31-5c2201b3ceea5"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 blogImage__b9.jpg
threatresearch.ext.hp.com/wp-content/uploads/2021/05/ 2 MB
2 MB 97ms
42ms Image
image/jpeg 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2021/05/blogImage__b9.jpg

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

9a19f69eb87e131998e91350c4eb6f55a44de97614261b1af11694576949ac39

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
content-length: 2098561
x-xss-protection: 1; mode=block
last-modified: Wed, 12 May 2021 11:13:43 GMT
server: nginx
etag: "200581-5c2201a89aceb"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 blogImage__b2.jpg
threatresearch.ext.hp.com/wp-content/uploads/2021/05/ 2 MB
2 MB 98ms
43ms Image
image/jpeg 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2021/05/blogImage__b2.jpg

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

d68605f97c0c27101ea06a1276a2e55c2bf65f0e07e8e0c11be145addde1344b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
content-length: 2112187
x-xss-protection: 1; mode=block
last-modified: Wed, 12 May 2021 11:13:47 GMT
server: nginx
etag: "203abb-5c2201ac87831"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 blogImage_refresh_001.jpg
threatresearch.ext.hp.com/wp-content/uploads/2021/10/ 110 KB
110 KB 98ms
44ms Image
image/jpeg 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2021/10/blogImage_refresh_001.jpg

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

100c3577372983a9ae444d3a1fcecec6525dae128e75a396bf38bd23eb972c5c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

expires: Thu, 31 Dec 2037 23:55:55 GMT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
content-length: 112333
x-xss-protection: 1; mode=block
last-modified: Thu, 28 Oct 2021 10:38:17 GMT
server: nginx
etag: "1b6cd-5cf674f0171cb"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
x-proxy-cache: HIT

GET
H2 200 profile_img.jpg
threatresearch.ext.hp.com/wp-content/uploads/2021/01/ 15 KB
15 KB 99ms
45ms Image
image/jpeg 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://threatresearch.ext.hp.com/wp-content/uploads/2021/01/profile_img.jpg

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

08de3edfa1e71b1c4ddc7fde8cbdad1e98a05222d7fdf1f9321313d821d20cfa

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

expires: Thu, 31 Dec 2037 23:55:55 GMT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
content-length: 15350
x-xss-protection: 1; mode=block
last-modified: Tue, 19 Jan 2021 12:52:40 GMT
server: nginx
etag: "3bf6-5b940505b56fe"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
accept-ranges: bytes
x-proxy-cache: HIT

GET
H2 200 style.min.css
threatresearch.ext.hp.com/wp-includes/css/dist/block-library/ 93 KB
12 KB 10ms
10ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/css/dist/block-library/style.min.css?ver=6.1.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

c324ef26b20264369e4568dc9ef1c5cb1f325f6bc4e8b7c01f7fe93fa353276a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:35:46 GMT
server: nginx
etag: W/"172a9-5ee7de3f7da1d"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 rs6.css
threatresearch.ext.hp.com/wp-content/plugins/revslider/public/assets/css/ 57 KB
12 KB 23ms
10ms Stylesheet
text/css 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.6.7

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

95f59f9a4a19697496edc01bb55011ea4056f90625cc816a7f18256f056a6258

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:34:06 GMT
server: nginx
etag: W/"e394-5ee7dddfe1b20"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 swiped-events.min.js Show response
threatresearch.ext.hp.com/wp-content/plugins/ditty-news-ticker/legacy/inc/static/js/ 2 KB
1 KB 99ms
45ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/ditty-news-ticker/legacy/inc/static/js/swiped-events.min.js?ver=1.1.4

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

db0fe819895d07af230d0f21f183ae4c9ecdec27664f004c6ac8844deaf55adc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:22:29 GMT
server: nginx
etag: W/"6e8-5ee7db4704aff"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 imagesloaded.min.js Show response
threatresearch.ext.hp.com/wp-includes/js/ 5 KB
2 KB 99ms
46ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/imagesloaded.min.js?ver=4.1.4

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Wed, 19 Aug 2020 23:51:51 GMT
server: nginx
etag: W/"15fd-5ad43b00c07ef"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 effect.min.js Show response
threatresearch.ext.hp.com/wp-includes/js/jquery/ui/ 17 KB
7 KB 100ms
46ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/jquery/ui/effect.min.js?ver=1.13.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

4471f0e0712693e37d562bb4981a7da17248062fc39140f3df05826943879fb7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:35:46 GMT
server: nginx
etag: W/"43ba-5ee7de3f8b0f9"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 ditty-news-ticker.min.js Show response
threatresearch.ext.hp.com/wp-content/plugins/ditty-news-ticker/legacy/inc/static/js/ 14 KB
3 KB 101ms
47ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/ditty-news-ticker/legacy/inc/static/js/ditty-news-ticker.min.js?ver=3.0.30

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

9808e9a37df4741d8a212c739cae654d1e935e3d3f9251c9eef6be7bb24b1eab

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:22:29 GMT
server: nginx
etag: W/"362b-5ee7db4704ee7"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 frontend.min.js Show response
threatresearch.ext.hp.com/wp-content/plugins/wp-user-avatar/assets/js/ 19 KB
4 KB 101ms
48ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/wp-user-avatar/assets/js/frontend.min.js?ver=4.4.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

255bbdc2a44e99169f7196982ff3155cf5631bdc043a1a431e5ea8f51297bb73

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: HIT
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-sucuri-cache: HIT
host-header: 8441280b0c35cbc1147f8ba998a563a7
x-xss-protection: 1; mode=block
last-modified: Sun, 18 Dec 2022 23:03:10 GMT
server: nginx
etag: W/"4a87-5f02234e00557"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 script.min.js Show response
threatresearch.ext.hp.com/wp-content/plugins/social-warfare/assets/js/ 21 KB
6 KB 101ms
48ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/social-warfare/assets/js/script.min.js?ver=4.3.0

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

824881cb24a4442381024afdf51da2932d717bb59cb549edc4cad3e00394bdce

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Fri, 27 Aug 2021 01:59:25 GMT
server: nginx
etag: W/"550b-5ca80d536cbc9"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 new-tab.js Show response
threatresearch.ext.hp.com/wp-content/plugins/page-links-to/dist/ 24 KB
9 KB 101ms
48ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/page-links-to/dist/new-tab.js?ver=3.3.6

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

d455ab882af3a742e6c9680578e6a590681bda99e34847f550f1f41a7d167969

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Wed, 19 Jan 2022 02:30:56 GMT
server: nginx
etag: W/"609e-5d5e62ce6cc0e"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cssua.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 3 KB
2 KB 101ms
49ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/cssua.js?ver=2.1.28

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

daf181ab9ead5372eefb6fe5d87704d7abdbfa6c09e4c79a2a2f688c6fac5ada

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"d10-5eb94f0f84e55"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-animations.js Show response
threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/general/ 2 KB
1 KB 101ms
49ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/general/fusion-animations.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

2e52dea09005063c3ff69fc36c11c7008b8efa5d4a97e38e7161ffaf0b0aedb6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:51:12 GMT
server: nginx
etag: W/"70c-5eb94f46d7924"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-vertical-menu-widget.js Show response
threatresearch.ext.hp.com/wp-content/plugins/fusion-core/js/min/ 1 KB
880 B 101ms
49ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/fusion-core/js/min/fusion-vertical-menu-widget.js?ver=5.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

93a897eedca2d924b738067a03528933e4eb07d4c2f78d65276b6576b7f4d370

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:51:17 GMT
server: nginx
etag: W/"572-5eb94f4c4e99f"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 modernizr.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 18 KB
7 KB 101ms
49ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/modernizr.js?ver=3.3.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

072d2a46607c107cdd7f20d3e5410963b281151df62444ad775ade8361cfa6cc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"4670-5eb94f0f84685"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/ 5 KB
2 KB 101ms
50ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/fusion.js?ver=3.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

760fe5e9d4fdf4fe5962edc3926816d8051faf168aa36ea467cdf7a80e09ede2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"1281-5eb94f0f83acd"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bootstrap.transition.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 741 B
787 B 101ms
50ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/bootstrap.transition.js?ver=3.3.6

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

bd6def1ae1509946499390f95acaa1fd39a76452c8312f165d2bc0b791c9e0ef

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"2e5-5eb94f0f84e55"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bootstrap.tooltip.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 11 KB
4 KB 111ms
60ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/bootstrap.tooltip.js?ver=3.3.5

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

23263a19c0dc4b29036a56f858a2b6f915ea0e415ed7c46071a071f170626c88

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"2a6e-5eb94f0f84a6d"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bootstrap.modal.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 4 KB
2 KB 112ms
61ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/bootstrap.modal.js?ver=3.1.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

9a2d11b76feb7a9e531a9d055fae88e495017645e5c823a010c818a7744b2c45

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"f86-5eb94f0f84a6d"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.requestAnimationFrame.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 695 B
759 B 112ms
61ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/jquery.requestAnimationFrame.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

980aba21181e373e49d5e2602223454f0bb78ccb263eabcfb850abb14ad8c904

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"2b7-5eb94f0f84685"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.easing.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 2 KB
1 KB 112ms
62ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/jquery.easing.js?ver=1.3

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

c8c066c331d08eaf858338789a0499c5ad85cfc6325d7685ea8a9463750d8684

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"8eb-5eb94f0f84e55"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.fitvids.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 2 KB
1 KB 112ms
62ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/jquery.fitvids.js?ver=1.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

233cb2b905dec5df68df039e52e26980f674880fee51a8f6b7f75486760f1f3e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"6e7-5eb94f0f8429d"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.flexslider.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 22 KB
6 KB 112ms
62ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/jquery.flexslider.js?ver=2.7.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

f2d424362aca158ad49da19b48c212e687fbed93ece9fed06fcf8871f5f64c5f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"57ca-5eb94f0f84e55"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.ilightbox.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 81 KB
24 KB 112ms
63ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/jquery.ilightbox.js?ver=2.2.3

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

990f2544353261a345a25a88644c6b30411fdbb6163358bf8872787908e275e6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"14287-5eb94f0f84a6d"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.mousewheel.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 3 KB
1 KB 113ms
63ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/jquery.mousewheel.js?ver=3.0.6

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

cce83fa2c5096e414c0e32c9fc07ba011e2f4d67a51f9c4155651122329ec0dc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"a41-5eb94f0f8523d"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.placeholder.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 2 KB
1 KB 115ms
65ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/jquery.placeholder.js?ver=2.0.7

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

fa34de993dea91eb0120c3745378192fa1177ba8ec5772e08632318d1d5e1267

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"880-5eb94f0f84a6d"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.fade.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 1 KB
861 B 115ms
66ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/jquery.fade.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

836e98f92408ccb7250927acef9b494fbacc18678ef18888f835101557bddd37

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"48a-5eb94f0f84e55"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-equal-heights.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/ 1 KB
992 B 115ms
66ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/fusion-equal-heights.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

d3d1fc3b726f87e9440670838b6d33dc22ee1c854274724b27de90be75d1069c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"55b-5eb94f0f836e4"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-parallax.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 12 KB
3 KB 115ms
66ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/fusion-parallax.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

a1e265af7b140bf70ba7a061b8ddee61e32ced0c50d985f0b05cdfe061112cb5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"2ef3-5eb94f0f84685"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-video-general.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 3 KB
1 KB 115ms
67ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/fusion-video-general.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

ea2dd31704608166bfd31e6c1b54027061ea568cd9aa1163656843a5907ac45d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"d31-5eb94f0f84685"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-video-bg.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 4 KB
2 KB 116ms
67ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/fusion-video-bg.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

46af13bd348d946968c6bd1c844dccbca02856ecdcaa8dcb35969e99d1399562

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"1192-5eb94f0f84a6d"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-lightbox.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/ 7 KB
2 KB 116ms
68ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/fusion-lightbox.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

93d5f2281324f8a87ce2bdf811d8d1fd5ca4781618754a490a0fce0f166d479c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"1c46-5eb94f0f83acd"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-tooltip.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/ 849 B
742 B 116ms
68ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/fusion-tooltip.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

4ea735c25bb36d6130e169c43dd545f9ab091b791672b1538046ebedef3308f6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"351-5eb94f0f83acd"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-sharing-box.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/ 945 B
755 B 116ms
69ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/fusion-sharing-box.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

45a6eea93903fe37410887ca5eb4605572ecfaf1968387365ec9ed9331a36487

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"3b1-5eb94f0f83eb5"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.sticky-kit.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 6 KB
2 KB 116ms
69ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/jquery.sticky-kit.js?ver=1.1.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

19e2b8ef435756c4dc18bc450f4ec0fbe6db2ceb7b99a7d656877bc49eb342ec

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"17d5-5eb94f0f84a6d"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-youtube.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 4 KB
2 KB 116ms
69ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/fusion-youtube.js?ver=2.2.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

828ef7357ef25a04a505c7f21b1418620b4c13faec1ac0d562e2127400c751fb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"10c3-5eb94f0f84e55"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 vimeoPlayer.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/ 16 KB
6 KB 116ms
69ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/library/vimeoPlayer.js?ver=2.2.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

501c8b7edd85aa5b93a52254d40cf04d754018292b113caf7f76441701d30a0a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"40bd-5eb94f0f84a6d"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 avada-general-footer.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/ 413 B
626 B 116ms
70ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/avada-general-footer.js?ver=7.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

61e7bb6d0210c308eb1f6153f18b4063eb715fde885b7d20b4d209d3fcb5a217

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"19d-5eb94f0f4eefc"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 avada-quantity.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/ 2 KB
1 KB 117ms
70ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/avada-quantity.js?ver=7.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

893ed74f27210911877234fad64cae770cf4af4b2b9b2c75b80d401c43f281d1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"7b6-5eb94f0f4f6cd"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 avada-crossfade-images.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/ 418 B
627 B 117ms
70ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/avada-crossfade-images.js?ver=7.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

80e9a74251b9a8f1f7e72a0ea7cbd8905e4777b931e92b09f545087161fa0b37

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"1a2-5eb94f0f4f6cd"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 avada-select.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/ 886 B
754 B 117ms
71ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/avada-select.js?ver=7.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

bf3722b93fa395dc556c14f331f86a9d5e31fa813e46f0cfcb8afd19fae33034

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"376-5eb94f0f4eefc"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 avada-tabs-widget.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/ 503 B
668 B 117ms
71ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/avada-tabs-widget.js?ver=7.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

6afaae08a9346fc9ca891d0d80f8483905c1421bca9f918506150566d3912e9a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"1f7-5eb94f0f4fab5"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 avada-rev-styles.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/ 3 KB
975 B 117ms
72ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/avada-rev-styles.js?ver=7.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

68bec0121363230f259b5abcfe8287100777c0e3b3d7bfb619d18273a6aa4728

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"ad6-5eb94f0f4f6cd"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.elasticslider.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/library/ 4 KB
2 KB 117ms
72ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/library/jquery.elasticslider.js?ver=7.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

11f4df8462b2edc6add3928ab5f30dcab77f69c29c0e175b1888f4cb6275823c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"11c1-5eb94f0f4fe9d"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 avada-live-search.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/ 3 KB
1 KB 117ms
72ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/avada-live-search.js?ver=7.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

c9bf057820b3b0223c468e08beb0d41a12b451e224308149bc05f0d4a607fcab

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"bfd-5eb94f0f4f6cd"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-alert.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/ 260 B
618 B 117ms
73ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/fusion-alert.js?ver=6.1.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

eb6481e44617b3e40d345b2df5e20965503b4ab87c9346a43894f93a601ccde7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"104-5eb94f0f83acd"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 awb-off-canvas.js Show response
threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/general/ 12 KB
4 KB 118ms
73ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/general/awb-off-canvas.js?ver=3.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

d8c519e27f603a4eb131526c2a93cdade281348b8efc845a1007e9a29ffdfef4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:51:12 GMT
server: nginx
etag: W/"3149-5eb94f46d80f4"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-flexslider.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/ 6 KB
2 KB 118ms
73ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/fusion-flexslider.js?ver=6.1.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

cb56816d72e7289b2aab8ba19bd1bdb4708cbbc7e70d7f38f9138a4dd10215a5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"195e-5eb94f0f83eb5"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-column-legacy.js Show response
threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/general/ 2 KB
837 B 118ms
74ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/general/fusion-column-legacy.js?ver=6.1.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

bc7b145a0eb35703d5ce10b9204920b9d09e4454bc2288addc9ed5142862f9cd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:51:12 GMT
server: nginx
etag: W/"619-5eb94f46d80f4"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.textillate.js Show response
threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/library/ 6 KB
2 KB 118ms
74ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/library/jquery.textillate.js?ver=2.0

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

e8b416c2f2a14bb138209a5ce434802a742d3de53ce668445485e5423efa1fb2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:51:12 GMT
server: nginx
etag: W/"1717-5eb94f46d9094"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-title.js Show response
threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/general/ 4 KB
2 KB 118ms
74ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/general/fusion-title.js?ver=6.1.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

fb84c55756f2946fd5d5c6c6d3f7a62079c1d7a7123b6c817832835e82b3270c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:51:12 GMT
server: nginx
etag: W/"e85-5eb94f46d80f4"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-modal.js Show response
threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/general/ 3 KB
1 KB 118ms
75ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/general/fusion-modal.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

0e19faf0a539d09a276473d2e2b1604a7343e56557f1c1b06b3c6f227ac4db9c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:51:12 GMT
server: nginx
etag: W/"a92-5eb94f46d7d0c"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-container.js Show response
threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/general/ 16 KB
3 KB 119ms
75ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/general/fusion-container.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

65347e16a9383e200a2e32223e7471f8add0c899f24ddee20bca454c6f7de583

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:51:12 GMT
server: nginx
etag: W/"3e81-5eb94f46d7d0c"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 avada-elastic-slider.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/ 565 B
661 B 119ms
76ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/avada-elastic-slider.js?ver=7.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

3647d841b21197b1efa74e92c861a3bf4cebef0f9a33f5a4c0ea276d74c768b0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"235-5eb94f0f4f2e5"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 avada-drop-down.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/ 6 KB
1 KB 119ms
76ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/avada-drop-down.js?ver=7.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

579683e317a76a9a6758e42680b394e80957cbdd2863c25abac9a875852abfc7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"17b6-5eb94f0f4eefc"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 avada-to-top.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/ 1017 B
865 B 119ms
76ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/avada-to-top.js?ver=7.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

2b2c2f9810fbe4d8643c2f6b9359daa7dd67b78cffa63e6746202c76d068547e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"3f9-5eb94f0f4eefc"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 avada-header.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/ 31 KB
4 KB 120ms
77ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/avada-header.js?ver=7.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

80669a9bb1655e529ea0f150945f879706df8fc3957bc1c02d07cdbb6862f60b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"7d2b-5eb94f0f4f2e5"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 avada-menu.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/ 39 KB
7 KB 120ms
78ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/avada-menu.js?ver=7.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

11181d395c0be8cd6705515ab1e773e64dadf2eb342badf535ebe21d3825897f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"9ac5-5eb94f0f4f2e5"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bootstrap.scrollspy.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/library/ 3 KB
1 KB 120ms
78ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/library/bootstrap.scrollspy.js?ver=3.3.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

5c569522330e4e6b040229701ae98650839c5baa9912e15f821ffef8341187f5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"a9a-5eb94f0f4fab5"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 avada-scrollspy.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/ 845 B
756 B 120ms
78ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/assets/min/js/general/avada-scrollspy.js?ver=7.8.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

b66b53112e230d6a90572fd4af0506b89a3021fedad6e9395ad85dc7a3b32094

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:13 GMT
server: nginx
etag: W/"34d-5eb94f0f4f2e5"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-responsive-typography.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/ 3 KB
1 KB 117ms
79ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/fusion-responsive-typography.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

4cb4122592bfa905b2f19c491d0beb0f47a6e609694998e2f002e5e5d403b521

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"dd8-5eb94f0f83acd"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-scroll-to-anchor.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/ 6 KB
2 KB 117ms
79ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/fusion-scroll-to-anchor.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

0925ff0405f3cdb2fa37bbd7fe7431e77451c294cf8b2e28c9497a18dc7894a9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"17bf-5eb94f0f836e4"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-general-global.js Show response
threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/ 496 B
663 B 117ms
80ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/themes/Avada/includes/lib/assets/min/js/general/fusion-general-global.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

709432d669fa084fba23a097defbdecc8097a07717c30ac6f915314bf2a05933

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: W/"1f0-5eb94f0f83acd"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-video.js Show response
threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/general/ 2 KB
1 KB 117ms
80ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/general/fusion-video.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

9a0a34bc67f5d3623591214473ac2d449be18a8ce1cb5e531b185ef22a09b31f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:51:12 GMT
server: nginx
etag: W/"815-5eb94f46d84dc"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fusion-column.js Show response
threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/general/ 1 KB
849 B 118ms
80ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/fusion-builder/assets/js/min/general/fusion-column.js?ver=1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

0db4581da25e31921f01cc132b22a55b140c1b6e4291dbe0b74e18cbc1499b54

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:51:12 GMT
server: nginx
etag: W/"42a-5eb94f46d84dc"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 core.min.js Show response
threatresearch.ext.hp.com/wp-includes/js/jquery/ui/ 21 KB
7 KB 118ms
81ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

ca7154cdda62b535ceaba9ad2a2b2217ff49de94c069a2c4e89733f3f06b3651

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:35:46 GMT
server: nginx
etag: W/"53c0-5ee7de3f8bcb1"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 datepicker.min.js Show response
threatresearch.ext.hp.com/wp-includes/js/jquery/ui/ 36 KB
11 KB 118ms
81ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/jquery/ui/datepicker.min.js?ver=1.13.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

8821cd10861112ac07254592b0b332abd02cfb6ac32c0ac71378be0fb58c309f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:35:46 GMT
server: nginx
etag: W/"8f7b-5ee7de3f8ad11"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mouse.min.js Show response
threatresearch.ext.hp.com/wp-includes/js/jquery/ui/ 3 KB
1 KB 118ms
81ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/jquery/ui/mouse.min.js?ver=1.13.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

809ec973a018b6bf8ac18e74bfffc3d25182e6f44df00128d531cf3e07570ee6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:35:46 GMT
server: nginx
etag: W/"d4a-5ee7de3f89989"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 slider.min.js Show response
threatresearch.ext.hp.com/wp-includes/js/jquery/ui/ 10 KB
3 KB 118ms
82ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/jquery/ui/slider.min.js?ver=1.13.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

5a95ac55c7f0f440eb1984d8da5d548f23ae0cbbb1babf81d985d810346c9dbf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:35:46 GMT
server: nginx
etag: W/"29e8-5ee7de3f8a541"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.ui.touch-punch.js Show response
threatresearch.ext.hp.com/wp-includes/js/jquery/ 1 KB
975 B 117ms
82ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/jquery/jquery.ui.touch-punch.js?ver=0.2.2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

196bed4faf0fe38b89a496b1f41319b2a8077263f85819f8ad42933e0a2e2e52

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 17 Dec 2018 17:45:39 GMT
server: nginx
etag: W/"49b-57d3b595776c0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mediaelement-and-player.min.js Show response
threatresearch.ext.hp.com/wp-includes/js/mediaelement/ 154 KB
35 KB 118ms
83ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/mediaelement/mediaelement-and-player.min.js?ver=4.2.17

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

b15c3ea03d50c2430490e7416733a254feea4237bb60b54181bd3473ebe4149f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:35:46 GMT
server: nginx
etag: W/"26935-5ee7de3f8fb32"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mediaelement-migrate.min.js Show response
threatresearch.ext.hp.com/wp-includes/js/mediaelement/ 1 KB
944 B 128ms
93ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/mediaelement/mediaelement-migrate.min.js?ver=6.1.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

6d161e98e47ae150b51211443eef37040fb6269dcf85ad2048548066dca99e6f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Thu, 23 Jun 2022 08:46:12 GMT
server: nginx
etag: W/"4a7-5e2197c5c7e81"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wp-mediaelement.min.js Show response
threatresearch.ext.hp.com/wp-includes/js/mediaelement/ 906 B
858 B 128ms
94ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/mediaelement/wp-mediaelement.min.js?ver=6.1.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

3e6131330963c472b950b8aaf544ba3829735b8ccb103d614ba7793e3a786550

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Fri, 30 Apr 2021 03:10:53 GMT
server: nginx
etag: W/"38a-5c127f5aab452"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 underscore.min.js Show response
threatresearch.ext.hp.com/wp-includes/js/ 18 KB
7 KB 128ms
94ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/underscore.min.js?ver=1.13.4

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

726b820e44f6ab90ad991d30a4bf26d3a5d71493cbcd1fb1efd0d14e89b9df2a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:35:46 GMT
server: nginx
etag: W/"4991-5ee7de3f86e90"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wp-util.min.js Show response
threatresearch.ext.hp.com/wp-includes/js/ 1 KB
1 KB 129ms
95ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/wp-util.min.js?ver=6.1.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

3bc6467a95cec8fa516c6f5f69e1301e37e16f9bb1046fe7756729249f901b95

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:35:46 GMT
server: nginx
etag: W/"592-5ee7de3f906eb"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 backbone.min.js Show response
threatresearch.ext.hp.com/wp-includes/js/ 23 KB
8 KB 129ms
95ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/backbone.min.js?ver=1.4.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

a714d3e7cd0751a5f1428881d65043743826415dbdcf7b3f3bc3f938180f18da

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:35:46 GMT
server: nginx
etag: W/"5d28-5ee7de3f8c099"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wp-playlist.min.js Show response
threatresearch.ext.hp.com/wp-includes/js/mediaelement/ 3 KB
1 KB 129ms
95ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-includes/js/mediaelement/wp-playlist.min.js?ver=6.1.1

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

a0ee283f00bfe45c9bc531f8cc7ae149f4bab2d212f6904b9eb64df0f6b71e24

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Nov 2022 01:35:46 GMT
server: nginx
etag: W/"d75-5ee7de3f8fb32"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 views-frontend.js Show response
threatresearch.ext.hp.com/wp-content/plugins/wp-views/public/js/ 76 KB
13 KB 129ms
96ms Script
application/javascript 192.124.249.59
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://threatresearch.ext.hp.com/wp-content/plugins/wp-views/public/js/views-frontend.js?ver=3.6.3

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.59 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10059.sucuri.net

Software

nginx /

Resource Hash

14d05a8eaa240594562514e267d5dc4578cbb84a27b020345334c2a335fa2242

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: MISS
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
content-encoding: br
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
x-xss-protection: 1; mode=block
last-modified: Thu, 19 May 2022 22:31:36 GMT
server: nginx
etag: W/"1316a-5df64efcc5cb0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15009
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
2 KB 87ms
20ms Script
application/x-javascript 23.45.104.85
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.104.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-104-85.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Mon, 19 Dec 2022 10:56:27 GMT
Content-Encoding: gzip
Last-Modified: Fri, 09 Sep 2022 01:18:39 GMT
Server: AkamaiNetStorage
ETag: "92b41a298690c047b0c4602dd843cba4:1662686319.691662"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 728

GET
H2 200 awb-icons.woff
www.bromium.com/wp-content/themes/Avada/includes/lib/assets/fonts/icomoon/ 20 KB
20 KB 123ms
12ms Font
font/woff 2a02:fe80:1010::17:8
SUCURI-SEC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bromium.com/wp-content/themes/Avada/includes/lib/assets/fonts/icomoon/awb-icons.woff

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:fe80:1010::17:8 , United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

nginx /

Resource Hash

370c8c8b69b06cb4193000e87c36d9efb2d55dcf1ef270cdea0ecc47d1aa3a61

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatresearch.ext.hp.com/
Origin: https://threatresearch.ext.hp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-proxy-cache: EXPIRED
date: Mon, 19 Dec 2022 10:56:27 GMT
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-proxy-cache-info: 0 NC:000000 UP:
x-sucuri-cache: HIT
host-header: 6b7412fb82ca5edfd0917e3957f05d89
content-length: 20336
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Oct 2022 00:50:14 GMT
server: nginx
etag: "4f70-5eb94f0f8235c"
x-frame-options: SAMEORIGIN
content-type: font/woff
access-control-allow-origin: *
x-httpd: 1
cache-control: max-age=315360000
x-sucuri-id: 15017
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ 13 KB
13 KB 437ms
25ms Font
font/woff2 2a00:1450:400d:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatresearch.ext.hp.com/
Origin: https://threatresearch.ext.hp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 21:55:38 GMT
x-content-type-options: nosniff
age: 306050
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 21:55:38 GMT

GET
H2 200 Qw3aZQNVED7rKGKxtqIqX5EUDXx4.woff2
fonts.gstatic.com/s/josefinsans/v25/ 26 KB
26 KB 438ms
27ms Font
font/woff2 2a00:1450:400d:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/josefinsans/v25/Qw3aZQNVED7rKGKxtqIqX5EUDXx4.woff2

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3701f4ae604d8fccb4ddca393e076a456aebfb06c1a9d94c1c13089293f55716

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatresearch.ext.hp.com/
Origin: https://threatresearch.ext.hp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Thu, 15 Dec 2022 09:16:23 GMT
x-content-type-options: nosniff
age: 351605
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26592
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 20:56:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Dec 2023 09:16:23 GMT

GET
H2 200 clientlib-hf-fontface.b22705a833161152e97e23aed2dba7ff.css
www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlibs-fonts/us/en/ 2 KB
610 B 13ms
12ms Stylesheet
text/css 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlibs-fonts/us/en/clientlib-hf-fontface.b22705a833161152e97e23aed2dba7ff.css

Requested by

Host: www8.hp.com
URL: https://www8.hp.com/us/en/scripts/framework/jquery/v-1-8/jquery.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-109-56-104.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

bf7c1ee4ea1d4db7943015c49b30ba3fd16e656409476c693213cc0899995a54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-dispatcher: dispatcher1westus2
date: Mon, 19 Dec 2022 10:56:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-vhost: globalnav
content-length: 327
last-modified: Thu, 15 Dec 2022 19:08:43 GMT
server: Apache
etag: "983-5efe294e164c0-gzip"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=293618
accept-ranges: bytes
expires: Thu, 22 Dec 2022 20:30:06 GMT

GET
H2 200 clientlib-hpi-hf-r-css.b22705a833161152e97e23aed2dba7ff.css
www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/ 99 KB
13 KB 16ms
15ms Stylesheet
text/css 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-r-css.b22705a833161152e97e23aed2dba7ff.css

Requested by

Host: www8.hp.com
URL: https://www8.hp.com/us/en/scripts/framework/jquery/v-1-8/jquery.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-109-56-104.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

3f0c35c186a443edd70777b18f9dc725baf2952a24466697f3123b56a60b6668

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-dispatcher: dispatcher2eastus2
date: Mon, 19 Dec 2022 10:56:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-vhost: globalnav
content-length: 12634
last-modified: Thu, 15 Dec 2022 19:15:26 GMT
server: Apache
etag: "18c9e-5efe2ace6af80-gzip"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=292930
accept-ranges: bytes
expires: Thu, 22 Dec 2022 20:18:38 GMT

GET
H2 200 clientlib-hf-js.51c2c2e74d1424e6ddae709ba9728d3e.js Show response
www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/ 205 KB
46 KB 10ms
10ms Script
application/javascript 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hf-js.51c2c2e74d1424e6ddae709ba9728d3e.js

Requested by

Host: www8.hp.com
URL: https://www8.hp.com/us/en/scripts/framework/jquery/v-1-8/jquery.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-109-56-104.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

b4fd3d2682af09e6cbec0df0e6e487ce412b96c5dfbc4c8abe9e0a6e4ac9e2dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-dispatcher: dispatcher1westus2
date: Mon, 19 Dec 2022 10:56:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-vhost: globalnav
content-length: 47056
last-modified: Thu, 15 Dec 2022 19:08:42 GMT
server: Apache
etag: "33437-5efe294d22280-gzip"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=291591
accept-ranges: bytes
expires: Thu, 22 Dec 2022 19:56:19 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 484 KB
117 KB 24ms
16ms Script
application/javascript 2a00:1450:4001:803::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PDHM2PK

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d4bb873fd33dea61b0e6d647b7811d3eaee8d0f45f3623f0c9b483e8ad595358

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 119391
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 19 Dec 2022 10:56:28 GMT

GET
H2 200 Group%2011990@2x.png
www.hp.com/content/dam/sites/worldwide/dems/search/support/ 983 B
1 KB 41ms
33ms Image
image/png 2a02:26f0:6c00::210:ba99
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.hp.com/content/dam/sites/worldwide/dems/search/support/Group%2011990@2x.png

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba99 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Akamai Image Manager /

Resource Hash

0a4e5a184816d1a7d02aef64b08929cdc9e75657382b77aeeb7fa5decd975dd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:28 GMT
strict-transport-security: max-age=600
last-modified: Wed, 31 Aug 2022 20:19:29 GMT
x-serial: 1341
server: Akamai Image Manager
x-check-cacheable: YES
akamai-grn: , , , , , , , , , 0.95ba1002.1671447388.2d5aff64
etag: "9cd-5e78d541ac9c0"
x-frame-options: SAMEORIGIN, SAMEORIGIN, SAMEORIGIN
content-type: image/png
cache-control: private, no-transform, max-age=49232
content-length: 983
expires: Tue, 20 Dec 2022 00:37:00 GMT

GET
H2 200 Group%2011991@2x.png
www.hp.com/content/dam/sites/worldwide/dems/search/support/ 921 B
1 KB 62ms
55ms Image
image/png 2a02:26f0:6c00::210:ba99
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.hp.com/content/dam/sites/worldwide/dems/search/support/Group%2011991@2x.png

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba99 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Akamai Image Manager /

Resource Hash

b16f7ee66e29b27d1f14719cefc0e67211523787cc1729be52322583175d0cec

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:28 GMT
strict-transport-security: max-age=600
last-modified: Wed, 31 Aug 2022 20:37:49 GMT
server: Akamai Image Manager
akamai-grn: , , , , , , , , 0.95ba1002.1671447388.2d5aff73
etag: "992-5e78d540b8780"
x-frame-options: SAMEORIGIN, SAMEORIGIN, SAMEORIGIN
content-type: image/png
cache-control: private, no-transform, max-age=48131
content-length: 921
expires: Tue, 20 Dec 2022 00:18:39 GMT

GET
H2 200 Group%2011992@2x.png
www.hp.com/content/dam/sites/worldwide/dems/search/support/ 1023 B
1 KB 40ms
34ms Image
image/png 2a02:26f0:6c00::210:ba99
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.hp.com/content/dam/sites/worldwide/dems/search/support/Group%2011992@2x.png

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba99 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Akamai Image Manager /

Resource Hash

04b7e0e82e49247408274fb7bb56b942d8d3e5b8233fe00590b22411e390d237

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:28 GMT
strict-transport-security: max-age=600
last-modified: Wed, 31 Aug 2022 20:26:51 GMT
x-serial: 448
server: Akamai Image Manager
x-check-cacheable: YES
akamai-grn: , , , , , 0.95ba1002.1671447388.2d5aff76
etag: "9ff-5e78d540b8780"
x-frame-options: SAMEORIGIN, SAMEORIGIN, SAMEORIGIN
content-type: image/png
cache-control: private, no-transform, max-age=48788
content-length: 1023
expires: Tue, 20 Dec 2022 00:29:36 GMT

GET
H2 200 black-logo-hp.png
www8.hp.com/content/dam/sites/worldwide/galactic-nav/ 894 B
1 KB 43ms
38ms Image
image/webp 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www8.hp.com/content/dam/sites/worldwide/galactic-nav/black-logo-hp.png
Requested by: Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-56-104.deploy.static.akamaitechnologies.com
Software: Akamai Image Manager /
Resource Hash: 3ff29527b86595610b0b3281abfbf51f6e38c7d9c1afa8e877ea993a2e8cd799

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:28 GMT
last-modified: Sun, 11 Dec 2022 14:12:25 GMT
server: Akamai Image Manager
etag: "111e-5d9418d94e3c0"
content-type: image/webp
cache-control: private, no-transform, max-age=64240
content-length: 894
expires: Tue, 20 Dec 2022 04:47:08 GMT

GET
H2 200 z-by-hp-new.png
www8.hp.com/content/dam/sites/worldwide/galactic-nav/ 584 B
772 B 44ms
38ms Image
image/png 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www8.hp.com/content/dam/sites/worldwide/galactic-nav/z-by-hp-new.png
Requested by: Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-56-104.deploy.static.akamaitechnologies.com
Software: Akamai Image Manager /
Resource Hash: a3bee7ffc1e0104eef9846229b8d875f7125fcbb23fc6930ef2f830c28741bbc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:28 GMT
last-modified: Sun, 17 Jul 2022 13:09:43 GMT
server: Akamai Image Manager
etag: "88f-5d5e04edc3c00"
content-type: image/png
cache-control: private, no-transform, max-age=54856
content-length: 584
expires: Tue, 20 Dec 2022 02:10:44 GMT

GET
H2 200 OMEN-logo3.png
www8.hp.com/content/dam/sites/worldwide/galactic-nav/ 1 KB
2 KB 44ms
39ms Image
image/png 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www8.hp.com/content/dam/sites/worldwide/galactic-nav/OMEN-logo3.png
Requested by: Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-56-104.deploy.static.akamaitechnologies.com
Software: Akamai Image Manager /
Resource Hash: 5dc4132c6d0e42b159c7574181aaa98129b445c3f9569548c61d36873f8d23b2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:28 GMT
last-modified: Sat, 11 Jun 2022 18:41:51 GMT
server: Akamai Image Manager
etag: "16b5-5d4dabdfd33c0"
content-type: image/png
cache-control: private, no-transform, max-age=24794
content-length: 1396
expires: Mon, 19 Dec 2022 17:49:42 GMT

GET
H2 200 HYPER-X-logo7.png
www8.hp.com/content/dam/sites/worldwide/galactic-nav/ 3 KB
3 KB 64ms
59ms Image
image/webp 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www8.hp.com/content/dam/sites/worldwide/galactic-nav/HYPER-X-logo7.png
Requested by: Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-56-104.deploy.static.akamaitechnologies.com
Software: Akamai Image Manager /
Resource Hash: 68a1b82779788f93c7b77702d5fef83c9f8dfc089f72beb4d7629f5d4ade180b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:28 GMT
last-modified: Wed, 05 Jan 2022 19:18:10 GMT
server: Akamai Image Manager
etag: "2dcc-5d4da979a8ac0"
content-type: image/webp
cache-control: private, no-transform, max-age=52912
content-length: 3126
expires: Tue, 20 Dec 2022 01:38:20 GMT

GET
H2 200 arize-hp-logo2.png
www8.hp.com/content/dam/sites/worldwide/galactic-nav/ 2 KB
2 KB 68ms
63ms Image
image/webp 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www8.hp.com/content/dam/sites/worldwide/galactic-nav/arize-hp-logo2.png
Requested by: Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-56-104.deploy.static.akamaitechnologies.com
Software: Akamai Image Manager /
Resource Hash: a75e8ab5771af0ea36e62f66d3edbe0ec14657b04e87bf99a46a891e652c1add

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:28 GMT
last-modified: Tue, 02 Aug 2022 22:01:00 GMT
server: Akamai Image Manager
etag: "1bb2-5d58fff4f9b00"
content-type: image/webp
cache-control: private, no-transform, max-age=9402
content-length: 2330
expires: Mon, 19 Dec 2022 13:33:10 GMT

GET
H2 200 poly@3x.png
www8.hp.com/content/dam/sites/worldwide/galactic-nav/ 2 KB
2 KB 43ms
39ms Image
image/png 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www8.hp.com/content/dam/sites/worldwide/galactic-nav/poly@3x.png
Requested by: Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-56-104.deploy.static.akamaitechnologies.com
Software: Akamai Image Manager /
Resource Hash: f305193707707d5489946d5960934e9d86d50dbc57fd76f927f134f0129e313d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:28 GMT
last-modified: Fri, 28 Oct 2022 15:37:42 GMT
server: Akamai Image Manager
etag: "d2a-5e9486f503d80"
content-type: image/png
cache-control: private, no-transform, max-age=66138
content-length: 1824
expires: Tue, 20 Dec 2022 05:18:46 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/162/ 11 KB
5 KB 18ms
18ms Script
application/x-javascript 23.45.104.85
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/162/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js?ver=1.0.1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.104.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-104-85.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Mon, 19 Dec 2022 10:56:28 GMT
Content-Encoding: gzip
Last-Modified: Fri, 01 Jul 2022 00:59:12 GMT
Server: AkamaiNetStorage
ETag: "75daf56f6191efe42577301908659c29:1656637152.894482"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4677
Expires: Wed, 29 Mar 2023 10:56:28 GMT

GET
H2 200 ipv
cdn.bizible.com/m/ 43 B
326 B 62ms
61ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=2bce521f6efb41a8c48e21eb2ccef318&_biz_s=8a1f0e&_biz_l=https%3A%2F%2Fthreatresearch.ext.hp.com%2Fmagniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates%2F&_biz_t=1671447388342&_biz_i=Magniber%20Ransomware%20Adopts%20JavaScript%2C%20Targeting%20Home%20Users%20with%20Fake%20Software%20Updates%20%7C%20HP%20Wolf%20Security&_biz_n=0&rnd=316704&cdn_o=a&_biz_z=1671447388344
Requested by: Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6B75) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 19 Dec 2022 10:56:28 GMT
last-modified: Wed, 14 Dec 2022 18:20:29 GMT
server: ECS (amb/6B75)
age: 405359
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: Image/GIF
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H2 200 u
cdn.bizibly.com/ 43 B
202 B 62ms
30ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizibly.com/u?_biz_u=2bce521f6efb41a8c48e21eb2ccef318&_biz_s=8a1f0e&_biz_l=https%3A%2F%2Fthreatresearch.ext.hp.com%2Fmagniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates%2F&_biz_t=1671447388346&_biz_i=Magniber%20Ransomware%20Adopts%20JavaScript%2C%20Targeting%20Home%20Users%20with%20Fake%20Software%20Updates%20%7C%20HP%20Wolf%20Security&rnd=189769&cdn_o=a&_biz_z=1671447388346
Requested by: Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6B97) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 19 Dec 2022 10:56:28 GMT
last-modified: Sun, 18 Dec 2022 01:20:56 GMT
server: ECS (amb/6B97)
age: 120932
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: Image/GIF
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H2 200 HPSimplifiedRegular.woff
www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlibs-fonts/clientlib-hf-fontface-core/resources/fonts/ 44 KB
43 KB 55ms
31ms Font
application/x-font-woff 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlibs-fonts/clientlib-hf-fontface-core/resources/fonts/HPSimplifiedRegular.woff

Requested by

Host: www8.hp.com
URL: https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlibs-fonts/us/en/clientlib-hf-fontface.b22705a833161152e97e23aed2dba7ff.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-109-56-104.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) Communique/4.3.2 /

Resource Hash

24719977091e8bcc0071cf9d6515c874e8c2f1b96695367c1141aeba7710e1c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlibs-fonts/us/en/clientlib-hf-fontface.b22705a833161152e97e23aed2dba7ff.css
Origin: https://threatresearch.ext.hp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-dispatcher: dispatcher1eastus2
date: Mon, 19 Dec 2022 10:56:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-vhost: globalnav
content-length: 43688
last-modified: Mon, 17 Aug 2020 19:53:29 GMT
server: Apache/2.4.6 (Red Hat Enterprise Linux) Communique/4.3.2
etag: "af90-5ad181fddc040-gzip"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-font-woff
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Tue, 20 Dec 2022 10:56:28 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 36ms
9ms Script
text/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-31745238-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 19 Dec 2022 09:24:37 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 5511
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Mon, 19 Dec 2022 11:24:37 GMT

GET
H2 200 xdc.js Show response
cdn.bizible.com/ 84 B
494 B 119ms
116ms Script
text/javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/xdc.js?_biz_u=2bce521f6efb41a8c48e21eb2ccef318&_biz_h=-1906410348&cdn_o=a&jsVer=4.22.11.18
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BBB) /
Resource Hash: 6d22e660ead72f14b0aa8e3dfc8de1da35f17e3559b489e00692f15f50faa1a6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:28 GMT
content-encoding: gzip
server: ECS (amb/6BBB)
etag: EFEDFBC3
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: text/javascript; charset=utf-8
cache-control: private, must-revalidate, max-age=21600
content-length: 186

GET
H2 200 privacy-banner.js Show response
www.hp.com/cma/ng/lib/exceptions/ 16 KB
8 KB 32ms
29ms Script
text/javascript 2a02:26f0:6c00::210:ba99
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.hp.com/cma/ng/lib/exceptions/privacy-banner.js

Requested by

Host: www8.hp.com
URL: https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hf-js.51c2c2e74d1424e6ddae709ba9728d3e.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba99 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

56daa473cc200622ef8ef8c20eb3ded1d19a583b2e0810f8d459326b04f11463

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=600
server: Apache
akamai-grn: , , , 0.95ba1002.1671447388.2d5b01d2
etag: "5ec1a6b6a80c0"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=7200
accept-ranges: bytes
content-length: 8374
expires: Mon, 19 Dec 2022 12:56:28 GMT

GET
H2 200 newhplogo.ttf
www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-css/resources/fonts/ 1 KB
1 KB 22ms
17ms Font
application/x-font-ttf 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-css/resources/fonts/newhplogo.ttf

Requested by

Host: www8.hp.com
URL: https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-r-css.b22705a833161152e97e23aed2dba7ff.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-109-56-104.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) Communique/4.3.2 /

Resource Hash

d075070aee6fff82f826766497e5141a38f5ae89ec2d91600c7ba9da58191e35

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-r-css.b22705a833161152e97e23aed2dba7ff.css
Origin: https://threatresearch.ext.hp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-dispatcher: dispatcher1eastus2
date: Mon, 19 Dec 2022 10:56:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-vhost: globalnav
content-length: 737
last-modified: Thu, 01 Oct 2020 18:02:05 GMT
server: Apache/2.4.6 (Red Hat Enterprise Linux) Communique/4.3.2
etag: "4c0-5b09fd053e140-gzip"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Tue, 20 Dec 2022 10:56:28 GMT

GET
H2 200 united_states.gif
www8.hp.com/content/dam/hpit-aem-globalnav/flags/ 296 B
502 B 16ms
16ms Image
image/webp 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www8.hp.com/content/dam/hpit-aem-globalnav/flags/united_states.gif
Requested by: Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-56-104.deploy.static.akamaitechnologies.com
Software: Akamai Image Manager /
Resource Hash: 848f5ae901a6db38f9cdb30ad9d2908962b6bad10c6ca2239cc9e5c73040fb2b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

unused62: 8096267
date: Mon, 19 Dec 2022 10:56:28 GMT
last-modified: Tue, 06 Oct 2020 21:30:45 GMT
server: Akamai Image Manager
etag: "253-5ad18c2b4c340"
content-type: image/webp
access-control-allow-origin: *
cache-control: private, no-transform, max-age=20318
content-length: 296
expires: Mon, 19 Dec 2022 16:35:06 GMT

GET
H2 200 footericons.woff
www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-css/resources/fonts/ 8 KB
4 KB 13ms
8ms Font
application/x-font-woff 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-css/resources/fonts/footericons.woff

Requested by

Host: www8.hp.com
URL: https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-r-css.b22705a833161152e97e23aed2dba7ff.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-109-56-104.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) Communique/4.3.2 /

Resource Hash

140b71e7ee1bc50ac88eacc4d1baf755e3799a112cfc8e1dae02ae0f14f26ead

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-r-css.b22705a833161152e97e23aed2dba7ff.css
Origin: https://threatresearch.ext.hp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-dispatcher: dispatcher1eastus2
date: Mon, 19 Dec 2022 10:56:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-vhost: globalnav
content-length: 3860
last-modified: Mon, 17 Aug 2020 19:53:28 GMT
server: Apache/2.4.6 (Red Hat Enterprise Linux) Communique/4.3.2
etag: "2088-5ad181fce7e00-gzip"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-font-woff
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Tue, 20 Dec 2022 10:56:28 GMT

POST
H/1.1 200
OK visitWebPage
497-itq-712.mktoresp.com/webevents/ 2 B
318 B 2802ms
2232ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://497-itq-712.mktoresp.com/webevents/visitWebPage?_mchNc=1671447388795&_mchCn=&_mchId=497-ITQ-712&_mchTk=_mch-hp.com-1671447388786-51100&_mchHo=threatresearch.ext.hp.com&_mchPo=&_mchRu=%2Fmagniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates%2F&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/162/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date: Mon, 19 Dec 2022 10:56:31 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 93892b5a-fb53-4e8f-936b-288aa7bf3d53

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 45ms
14ms XHR
text/plain 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=123130286&t=pageview&_s=1&dl=https%3A%2F%2Fthreatresearch.ext.hp.com%2Fmagniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates%2F&ul=en-us&de=UTF-8&dt=Magniber%20Ransomware%20Adopts%20JavaScript%2C%20Targeting%20Home%20Users%20with%20Fake%20Software%20Updates%20%7C%20HP%20Wolf%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=906393149&gjid=1901438847&cid=1948255108.1671447389&tid=UA-31745238-1&_gid=629511526.1671447389&_r=1&gtm=2oubu0&did=dZGIzZG&gdid=dZGIzZG&z=2033940668

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatresearch.ext.hp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 19 Dec 2022 10:56:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://threatresearch.ext.hp.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 40ms
16ms XHR
text/plain 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=123130286&t=pageview&_s=1&dl=https%3A%2F%2Fthreatresearch.ext.hp.com%2Fmagniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates%2F&ul=en-us&de=UTF-8&dt=Magniber%20Ransomware%20Adopts%20JavaScript%2C%20Targeting%20Home%20Users%20with%20Fake%20Software%20Updates%20%7C%20HP%20Wolf%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAUABAAAAACAAI~&jid=1419809049&gjid=997191213&cid=1948255108.1671447389&tid=UA-197588716-1&_gid=629511526.1671447389&_r=1&gtm=2oubu0&did=dZGIzZG&gdid=dZGIzZG&z=762231023

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatresearch.ext.hp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 19 Dec 2022 10:56:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://threatresearch.ext.hp.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 latest_icons.woff
www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-css/resources/fonts/ 1 KB
1 KB 15ms
14ms Font
application/x-font-woff 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-css/resources/fonts/latest_icons.woff

Requested by

Host: www8.hp.com
URL: https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-r-css.b22705a833161152e97e23aed2dba7ff.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-109-56-104.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) Communique/4.3.2 /

Resource Hash

7a156f2f864432042b65e6a619f067bca03c7eaf855a7dcce14166f2f77a3487

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-r-css.b22705a833161152e97e23aed2dba7ff.css
Origin: https://threatresearch.ext.hp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-dispatcher: dispatcher2eastus2
date: Mon, 19 Dec 2022 10:56:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-vhost: globalnav
content-length: 839
last-modified: Mon, 17 Aug 2020 19:53:28 GMT
server: Apache/2.4.6 (Red Hat Enterprise Linux) Communique/4.3.2
etag: "5a4-5ad181fce7e00-gzip"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-font-woff
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Tue, 20 Dec 2022 10:56:28 GMT

GET
H2 200 mu.js Show response
www.hp.com/cma/ng/lib/exceptions/ 82 KB
33 KB 25ms
25ms Script
text/javascript 2a02:26f0:6c00::210:ba99
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.hp.com/cma/ng/lib/exceptions/mu.js

Requested by

Host: hp.com
URL: https://hp.com/cma/ng/lib/exceptions/privacy-banner.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba99 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

40fe0531af10f8e894b2206b9b54f135e80505b1768b730a93eadf8e1e8af174

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=600
server: Apache
akamai-grn: , , 0.95ba1002.1671447388.2d5b043b
etag: "5eca75b7a7980"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=7200
accept-ranges: bytes
content-length: 33754
expires: Mon, 19 Dec 2022 12:56:28 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
448 B 50ms
17ms XHR
text/plain 2a00:1450:4025:401::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-31745238-1&cid=1948255108.1671447389&jid=906393149&gjid=1901438847&_gid=629511526.1671447389&_u=YEBAAUAAAAAAACAAI~&z=561432780

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4025:401::9d Den Helder, Netherlands, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatresearch.ext.hp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 19 Dec 2022 10:56:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://threatresearch.ext.hp.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 exparrow.ttf
www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-css/resources/fonts/ 1 KB
919 B 13ms
9ms Font
application/x-font-ttf 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-css/resources/fonts/exparrow.ttf

Requested by

Host: www8.hp.com
URL: https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-r-css.b22705a833161152e97e23aed2dba7ff.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-109-56-104.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) Communique/4.3.2 /

Resource Hash

d94db9ce60ff8e6a0e1dcdab83ff6d1f60dd5c28b50d8f027f5fe268f87fa5ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-r-css.b22705a833161152e97e23aed2dba7ff.css
Origin: https://threatresearch.ext.hp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-dispatcher: dispatcher1eastus2
date: Mon, 19 Dec 2022 10:56:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-vhost: globalnav
content-length: 585
last-modified: Mon, 17 Aug 2020 19:53:28 GMT
server: Apache/2.4.6 (Red Hat Enterprise Linux) Communique/4.3.2
etag: "420-5ad181fce7e00-gzip"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Tue, 20 Dec 2022 10:56:28 GMT

GET
H2 200 close.ttf
www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-css/resources/fonts/ 1 KB
927 B 11ms
11ms Font
application/x-font-ttf 104.109.56.104
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-css/resources/fonts/close.ttf

Requested by

Host: www8.hp.com
URL: https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-r-css.b22705a833161152e97e23aed2dba7ff.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.109.56.104 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-109-56-104.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) Communique/4.3.2 /

Resource Hash

7d2949d827d3f71a1a610d17034a34844cc3f2169cb8ce1c4b28665316bc0c0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www8.hp.com/etc.clientlibs/HPIT-AEM-GLOBALNAV/clientlibs-globalnav/clientlib-hpi-hf-r-css.b22705a833161152e97e23aed2dba7ff.css
Origin: https://threatresearch.ext.hp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-dispatcher: dispatcher1eastus2-cm-3
date: Mon, 19 Dec 2022 10:56:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-vhost: globalnav
content-length: 589
last-modified: Mon, 17 Aug 2020 19:53:28 GMT
server: Apache/2.4.6 (Red Hat Enterprise Linux) Communique/4.3.2
etag: "414-5ad181fce7e00-gzip"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Tue, 20 Dec 2022 10:56:29 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 120ms
55ms Image
image/gif 2a00:1450:400d:80c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-31745238-1&cid=1948255108.1671447389&jid=906393149&_u=YEBAAUAAAAAAACAAI~&z=2031888722

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 19 Dec 2022 10:56:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 42ms
20ms Image
image/gif 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-31745238-1&cid=1948255108.1671447389&jid=906393149&_u=YEBAAUAAAAAAACAAI~&z=2031888722

Requested by

Host: threatresearch.ext.hp.com
URL: https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 19 Dec 2022 10:56:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
8 KB 53ms
22ms Script
application/javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.hp.com
URL: https://www.hp.com/cma/ng/lib/exceptions/mu.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 19 Dec 2022 10:56:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: e0VkrpV+7zqDAjQ/RMXPsw==
age: 41640
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 7151
x-ms-lease-status: unlocked
last-modified: Fri, 16 Dec 2022 04:11:39 GMT
server: cloudflare
etag: 0x8DADF1BA184D727
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 26e168d1-b01e-0029-41ac-11aea4000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 77bf9ca61ead9b4c-FRA

GET
H2 200 d8197f25-dce3-4110-addb-f3ffbe70bcbd.json Show response
cdn.cookielaw.org/consent/d8197f25-dce3-4110-addb-f3ffbe70bcbd/ 9 KB
3 KB 43ms
26ms XHR
application/x-javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/d8197f25-dce3-4110-addb-f3ffbe70bcbd/d8197f25-dce3-4110-addb-f3ffbe70bcbd.json

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b97b640e8caf3a6aeb76186fad0057593970b7ce2945add451dae091be04350c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 19 Dec 2022 10:56:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: pA9uKCn2+RsSXb3Q+TxybQ==
age: 66961
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 2608
x-ms-lease-status: unlocked
last-modified: Tue, 22 Nov 2022 09:46:56 GMT
server: cloudflare
etag: 0x8DACC6E7EAAFC6A
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 8d3c4993-601e-002b-6f59-feac5e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 77bf9ca6694abb8f-FRA
expires: Tue, 20 Dec 2022 10:56:29 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 66 B
312 B 73ms
39ms XHR
application/json 2606:4700::6812:1a55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1a55 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://threatresearch.ext.hp.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Mon, 19 Dec 2022 10:56:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 77bf9ca6cf60bb38-FRA
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.39.0/ 372 KB
89 KB 27ms
27ms Script
application/javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ba033e6cb25fa6e20186d6d8113cc3821028b7891c93eebe671b75f6eebc3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 19 Dec 2022 10:56:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Zp/CcrZmK7hQ2S6c/t9Tpw==
age: 41640
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 90454
x-ms-lease-status: unlocked
last-modified: Fri, 26 Aug 2022 16:31:04 GMT
server: cloudflare
etag: 0x8DA87805EB35DE2
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: a98cb099-e01e-0171-4a83-b9ec8a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 77bf9ca709179b4c-FRA

GET
H2 200 en-us.json Show response
cdn.cookielaw.org/consent/d8197f25-dce3-4110-addb-f3ffbe70bcbd/79a7d4b1-1cd6-41c0-98fa-a258972139b8/ 270 KB
47 KB 92ms
91ms Fetch
application/x-javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/d8197f25-dce3-4110-addb-f3ffbe70bcbd/79a7d4b1-1cd6-41c0-98fa-a258972139b8/en-us.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

563747bd06e81569c64a65ce1c5af6126ee888e07072d254687e541dbb8450e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 19 Dec 2022 10:56:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: K5IkOh7BaqoipxujbLEVRQ==
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 47936
x-ms-lease-status: unlocked
last-modified: Tue, 22 Nov 2022 09:46:50 GMT
server: cloudflare
etag: 0x8DACC6E7A9D5FAF
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 3ad6ddfd-201e-0068-325b-fe86b7000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 77bf9ca76b96bb8f-FRA
expires: Tue, 20 Dec 2022 10:56:29 GMT

GET
H2 200 otCenterRounded.json Show response
cdn.cookielaw.org/scripttemplates/6.39.0/assets/ 9 KB
3 KB 46ms
45ms Fetch
application/json 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/otCenterRounded.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d94edd219d965011aa7c423435675f8fc3aba340d1d2a45840c88592b922dbf2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 19 Dec 2022 10:56:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Qf6Hj+Kf+u3YI1ZamXkcOw==
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 2612
x-ms-lease-status: unlocked
last-modified: Fri, 26 Aug 2022 16:30:56 GMT
server: cloudflare
etag: 0x8DA878059EDB228
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: f8e8749e-401e-0051-0278-b9c613000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 77bf9ca89e65bb8f-FRA

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/6.39.0/assets/v2/ 63 KB
14 KB 23ms
22ms Fetch
application/json 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/v2/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0cc5068304cfb22bbddb5a9800f7c59d843824381ad7183f89291ae41a6d09b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 19 Dec 2022 10:56:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: PpYet/3D+UMQBHrd1SR49w==
age: 66959
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 13981
x-ms-lease-status: unlocked
last-modified: Fri, 26 Aug 2022 16:30:58 GMT
server: cloudflare
etag: 0x8DA87805B3CBC97
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 8ec6017a-d01e-0150-6978-b981bb000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 77bf9ca89e6abb8f-FRA

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/6.39.0/assets/ 22 KB
5 KB 64ms
63ms Fetch
text/css 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.39.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.39.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 19 Dec 2022 10:56:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: B55i3ZY9miZIaUrwjufy0w==
x-ms-lease-status: unlocked
last-modified: Fri, 26 Aug 2022 16:31:09 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: a97584b3-e01e-0171-6b78-b9ec8a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 77bf9ca89e6dbb8f-FRA

GET
H2 200 hp_logo.gif
cdn.cookielaw.org/logos/4abb22ef-0e20-458e-be93-e351ad21c465/a3f73d0e-a0d6-4b32-9444-47fc97baefe0/ 1 KB
1 KB 27ms
27ms Image
application/octet-stream 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/4abb22ef-0e20-458e-be93-e351ad21c465/a3f73d0e-a0d6-4b32-9444-47fc97baefe0/hp_logo.gif

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

54ed90f80a10bef5bb9ca48da0a4a97cd75dff3c1fcf220ba3335dcf9aeb576e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 19 Dec 2022 10:56:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: v7jYSLqzJ+a4UzP7TytjRg==
age: 41153
content-length: 1118
x-ms-lease-status: unlocked
last-modified: Wed, 19 Feb 2020 08:36:03 GMT
server: cloudflare
etag: 0x8D7B516C14BEE48
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
x-ms-request-id: 7a35d1e4-e01e-011c-588c-2946a4000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 77bf9ca97de69b4c-FRA

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 7 KB
3 KB 26ms
26ms Image
image/svg+xml 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

99c967c84f5947041a529dd99136e428117246d87dcf40819eae5c3937236c01

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://threatresearch.ext.hp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 19 Dec 2022 10:56:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: nvsqHj63Mt+zbyhgtmGw4w==
age: 40098
x-ms-lease-status: unlocked
last-modified: Thu, 15 Dec 2022 13:30:09 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 72a855b3-101e-0085-3cfa-108f33000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 77bf9ca97de89b4c-FRA

Verdicts & Comments Add Verdict or Comment

310 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

21 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.hp.com/content/dam/sites/worldwide/dems/search/support	1969-12-31 23:59:59	Name: aka_client_code Value: DE-de
www.hp.com/us-en/scripts/framework/jquery/v-1-8	1969-12-31 23:59:59	Name: aka_client_code Value: DE-de
www.hp.com/cma/ng/lib/exceptions	1969-12-31 23:59:59	Name: aka_client_code Value: DE-de
.hp.com/	1970-01-20 17:03:03	Name: _biz_uid Value: 2bce521f6efb41a8c48e21eb2ccef318
.hp.com/	1970-01-20 08:17:29	Name: _biz_sid Value: 8a1f0e
.hp.com/	1970-01-20 17:03:03	Name: _biz_nA Value: 1
.bizible.com/	1970-01-20 17:03:03	Name: _BUID Value: 2bce521f6efb41a8c48e21eb2ccef318
.bizibly.com/	1970-01-20 17:03:03	Name: _BUID Value: 2d0d550a36c2b09277e8a2fc1213c6ed
.hp.com/	1970-01-20 17:03:03	Name: _biz_pendingA Value: %5B%5D
.hp.com/	1970-01-20 17:53:27	Name: _mkto_trk Value: id:497-ITQ-712&token:_mch-hp.com-1671447388786-51100
.hp.com/	1970-01-20 17:53:27	Name: _ga Value: GA1.2.1948255108.1671447389
.hp.com/	1970-01-20 08:18:53	Name: _gid Value: GA1.2.629511526.1671447389
.hp.com/	1970-01-20 08:17:27	Name: _gat_gtag_UA_31745238_1 Value: 1
.hp.com/	1970-01-20 08:17:27	Name: _gat_gtag_UA_197588716_1 Value: 1
.hp.com/	1969-12-31 23:59:59	Name: dcm_s Value: 1671447388898.1874830510
.hp.com/	1970-01-20 17:03:03	Name: _biz_flagsA Value: %7B%22Version%22%3A1%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
threatresearch.ext.hp.com/	1969-12-31 23:59:59	Name: s_p_cnt Value: 1
threatresearch.ext.hp.com/	1969-12-31 23:59:59	Name: hp_pv1_prefs Value: null
.hp.com/	1970-01-20 17:03:03	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Mon+Dec+19+2022+10%3A56%3A29+GMT%2B0000+(GMT)&version=6.39.0&isIABGlobal=false&hosts=&consentId=7b881a3c-0527-4a17-bcc1-26d7883d1d82&interactionCount=0&landingPath=https%3A%2F%2Fthreatresearch.ext.hp.com%2Fmagniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates%2F&groups=1%3A1%2C2%3A0%2C3%3A0%2C4%3A0
.hp.com/	1970-01-20 17:03:03	Name: hpeuck_prefs Value: 1000
.hp.com/	1970-01-20 17:03:03	Name: hpeuck_answ Value: 0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

497-itq-712.mktoresp.com
cdn.bizible.com
cdn.bizibly.com
cdn.cookielaw.org
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
hp.com
munchkin.marketo.net
stats.g.doubleclick.net
threatresearch.ext.hp.com
www.bromium.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.hp.com
www8.hp.com
104.109.56.104
15.72.164.74
152.195.15.58
192.124.249.59
192.28.144.124
23.45.104.85
2606:4700::6810:9540
2606:4700::6812:1a55
2a00:1450:4001:803::2008
2a00:1450:4001:806::200e
2a00:1450:4001:82a::200a
2a00:1450:4001:831::2003
2a00:1450:400d:80c::2003
2a00:1450:400d:80c::2004
2a00:1450:4025:401::9d
2a02:26f0:6c00::210:ba99
2a02:fe80:1010::17:8
00501810e93307a8882a74d864e7547fd1458deea539361dc1124ac133799a4b
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
044efea78208376302aad3808aaabdf3c2f7bdd80ba9d55c9e0e4d3baa7a3908
04b7e0e82e49247408274fb7bb56b942d8d3e5b8233fe00590b22411e390d237
0556c9c3691f4d98501088fade814d01213830b5fe9eeb68e7e9a65f68f9c8f1
072d2a46607c107cdd7f20d3e5410963b281151df62444ad775ade8361cfa6cc
08de3edfa1e71b1c4ddc7fde8cbdad1e98a05222d7fdf1f9321313d821d20cfa
0925ff0405f3cdb2fa37bbd7fe7431e77451c294cf8b2e28c9497a18dc7894a9
0a3364d1f00ceab070910d588e47e47a584e60e0dc2b235270195f8bbf5a36d1
0a4e5a184816d1a7d02aef64b08929cdc9e75657382b77aeeb7fa5decd975dd8
0ad75b71fbe2be4806d58d482067535f7789abfda5e4eaa18971278e30c70f3e
0cc5068304cfb22bbddb5a9800f7c59d843824381ad7183f89291ae41a6d09b8
0db4581da25e31921f01cc132b22a55b140c1b6e4291dbe0b74e18cbc1499b54
0df6356a9dd9333fe8a139307f90de62efc5bba4dcb4e8007be03e596f4c2f77
0e19faf0a539d09a276473d2e2b1604a7343e56557f1c1b06b3c6f227ac4db9c
100c3577372983a9ae444d3a1fcecec6525dae128e75a396bf38bd23eb972c5c
11181d395c0be8cd6705515ab1e773e64dadf2eb342badf535ebe21d3825897f
11f4df8462b2edc6add3928ab5f30dcab77f69c29c0e175b1888f4cb6275823c
140b71e7ee1bc50ac88eacc4d1baf755e3799a112cfc8e1dae02ae0f14f26ead
14d05a8eaa240594562514e267d5dc4578cbb84a27b020345334c2a335fa2242
192a450bdc8200b9df998cd74c4295d01acd74430375452983b4de474375829d
196bed4faf0fe38b89a496b1f41319b2a8077263f85819f8ad42933e0a2e2e52
19e2b8ef435756c4dc18bc450f4ec0fbe6db2ceb7b99a7d656877bc49eb342ec
1f77f1c60435921cb2d68ccfb3bf2da81dd35f274014c4cd5a5b9c20c4a46a27
208d013c583899ce6bb2fe281662492caa32a1edd39924f7e5760233c22c7f69
21593e36fb12916f2fbfe2e3140894e00c0c9757b03c6987aab38d0cd8cdf2c8
23263a19c0dc4b29036a56f858a2b6f915ea0e415ed7c46071a071f170626c88
233cb2b905dec5df68df039e52e26980f674880fee51a8f6b7f75486760f1f3e
24719977091e8bcc0071cf9d6515c874e8c2f1b96695367c1141aeba7710e1c8
255bbdc2a44e99169f7196982ff3155cf5631bdc043a1a431e5ea8f51297bb73
2b2c2f9810fbe4d8643c2f6b9359daa7dd67b78cffa63e6746202c76d068547e
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
2e52dea09005063c3ff69fc36c11c7008b8efa5d4a97e38e7161ffaf0b0aedb6
3511de47d3250e54206caa8bfd8b2401d7ae512f821258d06a52d5e9584690f9
3647d841b21197b1efa74e92c861a3bf4cebef0f9a33f5a4c0ea276d74c768b0
3668f6d335416599574fb1f336cbd2b9bb2f8fcff63e63a9ca3b68df4d0c6165
3701f4ae604d8fccb4ddca393e076a456aebfb06c1a9d94c1c13089293f55716
370c8c8b69b06cb4193000e87c36d9efb2d55dcf1ef270cdea0ecc47d1aa3a61
3bc6467a95cec8fa516c6f5f69e1301e37e16f9bb1046fe7756729249f901b95
3e6131330963c472b950b8aaf544ba3829735b8ccb103d614ba7793e3a786550
3f0c35c186a443edd70777b18f9dc725baf2952a24466697f3123b56a60b6668
3ff29527b86595610b0b3281abfbf51f6e38c7d9c1afa8e877ea993a2e8cd799
40fe0531af10f8e894b2206b9b54f135e80505b1768b730a93eadf8e1e8af174
42c9bbf0bfd51db9c2f857c01784e8be555ac102a251f51823fd6b25960ccc12
4463996b808a043a2091ce400b56adcdb7407264272e6d2e389075e143e1c901
4471f0e0712693e37d562bb4981a7da17248062fc39140f3df05826943879fb7
45a6eea93903fe37410887ca5eb4605572ecfaf1968387365ec9ed9331a36487
46af13bd348d946968c6bd1c844dccbca02856ecdcaa8dcb35969e99d1399562
472cf661f1007ee950af6a88f55e240f93c279b5b0960ff218c95b864b52a68f
4834aa58000857ce42bdc4ae2322104fbbb5c0e96a7dbd4deab73900ae9d23a7
4cb4122592bfa905b2f19c491d0beb0f47a6e609694998e2f002e5e5d403b521
4ea735c25bb36d6130e169c43dd545f9ab091b791672b1538046ebedef3308f6
501c8b7edd85aa5b93a52254d40cf04d754018292b113caf7f76441701d30a0a
527d982dd4e2527fafe888adec2c719929a6476b2106952464a65ea02dee7893
54ed90f80a10bef5bb9ca48da0a4a97cd75dff3c1fcf220ba3335dcf9aeb576e
563747bd06e81569c64a65ce1c5af6126ee888e07072d254687e541dbb8450e9
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56ad6f73cd42c34973f5903add0b80f25ab64da518ab7b779a5d62b0f8f71d2e
56daa473cc200622ef8ef8c20eb3ded1d19a583b2e0810f8d459326b04f11463
578332cd14c1c8f1c9ea7cc966ca50ae73945b7de3055e07f06dc099d4feeee0
579683e317a76a9a6758e42680b394e80957cbdd2863c25abac9a875852abfc7
5a4f9b81ce5e4dc3bb3fa525cd250753923aa7474a9d5bbf8801048a3fb10c24
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5
5a95ac55c7f0f440eb1984d8da5d548f23ae0cbbb1babf81d985d810346c9dbf
5c569522330e4e6b040229701ae98650839c5baa9912e15f821ffef8341187f5
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57
5d9e229dde2a12fae04e5a3e85eb93f8ef6a7541c0384152901b4d9dec29ef29
5dc4132c6d0e42b159c7574181aaa98129b445c3f9569548c61d36873f8d23b2
61e7bb6d0210c308eb1f6153f18b4063eb715fde885b7d20b4d209d3fcb5a217
62855a25508bf218a96a1179788320756ce0ae0346a586cca1fc5a6b5e7a4668
65347e16a9383e200a2e32223e7471f8add0c899f24ddee20bca454c6f7de583
68a1b82779788f93c7b77702d5fef83c9f8dfc089f72beb4d7629f5d4ade180b
68bec0121363230f259b5abcfe8287100777c0e3b3d7bfb619d18273a6aa4728
6afaae08a9346fc9ca891d0d80f8483905c1421bca9f918506150566d3912e9a
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d161e98e47ae150b51211443eef37040fb6269dcf85ad2048548066dca99e6f
6d22e660ead72f14b0aa8e3dfc8de1da35f17e3559b489e00692f15f50faa1a6
6eb52a97833a253a404e06ef580bfc474b9883681a2e7abf223b1a9434201bae
709432d669fa084fba23a097defbdecc8097a07717c30ac6f915314bf2a05933
726b820e44f6ab90ad991d30a4bf26d3a5d71493cbcd1fb1efd0d14e89b9df2a
760fe5e9d4fdf4fe5962edc3926816d8051faf168aa36ea467cdf7a80e09ede2
7a109bbaf31b60ea0c1182758f73e7e2050aeabc9d37913ebc0c72030a48cf23
7a156f2f864432042b65e6a619f067bca03c7eaf855a7dcce14166f2f77a3487
7c356a9d56062296d80aaa7faa72446bedb5e783aa6a9c557e1efddaa6055258
7d2949d827d3f71a1a610d17034a34844cc3f2169cb8ce1c4b28665316bc0c0a
80669a9bb1655e529ea0f150945f879706df8fc3957bc1c02d07cdbb6862f60b
809ec973a018b6bf8ac18e74bfffc3d25182e6f44df00128d531cf3e07570ee6
80e9a74251b9a8f1f7e72a0ea7cbd8905e4777b931e92b09f545087161fa0b37
824881cb24a4442381024afdf51da2932d717bb59cb549edc4cad3e00394bdce
828ef7357ef25a04a505c7f21b1418620b4c13faec1ac0d562e2127400c751fb
836e98f92408ccb7250927acef9b494fbacc18678ef18888f835101557bddd37
83c5ebd47131aa8aeef9d7ace04d313c997b67934791fa92c366e78e99242329
848f5ae901a6db38f9cdb30ad9d2908962b6bad10c6ca2239cc9e5c73040fb2b
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8821cd10861112ac07254592b0b332abd02cfb6ac32c0ac71378be0fb58c309f
893ed74f27210911877234fad64cae770cf4af4b2b9b2c75b80d401c43f281d1
89b7e1d2019680a8953887a355e38c66f0c25b898eac8487ac69f95f9bdc6e3b
8b625a6ed2cfde39e761f2e9fc10ad83f2d4305c942471f911fcff9e4bb98808
8da3130463864da4b9e900c389edfa7488c93fca573e18766e9660a7b721aea2
919fecd4dc7f498339d04030c87de7f4db63cc2f08be69148562b14dc3a415a6
91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc
9209a89d1d74bc0ff6b779bc341ee5e40a72698f078bd4a0ea224e20466b616b
93a897eedca2d924b738067a03528933e4eb07d4c2f78d65276b6576b7f4d370
93d5f2281324f8a87ce2bdf811d8d1fd5ca4781618754a490a0fce0f166d479c
93d8e449cf5588f81cdf7f5906b7fce641d7693deac6efc27aa7ac9b1e38f6bf
95f59f9a4a19697496edc01bb55011ea4056f90625cc816a7f18256f056a6258
9808e9a37df4741d8a212c739cae654d1e935e3d3f9251c9eef6be7bb24b1eab
980aba21181e373e49d5e2602223454f0bb78ccb263eabcfb850abb14ad8c904
990f2544353261a345a25a88644c6b30411fdbb6163358bf8872787908e275e6
99c967c84f5947041a529dd99136e428117246d87dcf40819eae5c3937236c01
9a0a34bc67f5d3623591214473ac2d449be18a8ce1cb5e531b185ef22a09b31f
9a19f69eb87e131998e91350c4eb6f55a44de97614261b1af11694576949ac39
9a2d11b76feb7a9e531a9d055fae88e495017645e5c823a010c818a7744b2c45
9db372bd5a5d506904ce7fda178ece352bfe33dd38292f8d398e613eb4a7968a
9e9b2b2d98bb21ba98a3e7d0166f2de7bae986b81a727c7804a44f4f81b09737
a0ee283f00bfe45c9bc531f8cc7ae149f4bab2d212f6904b9eb64df0f6b71e24
a1e265af7b140bf70ba7a061b8ddee61e32ced0c50d985f0b05cdfe061112cb5
a26bbb2fb16ca3717c4690a816e25c43be2ad4fcb45adb878b3c98b6b01fbeb9
a3bee7ffc1e0104eef9846229b8d875f7125fcbb23fc6930ef2f830c28741bbc
a537306122d97954096b0591324fdc7f3d8b54a518b20e30714459b3584e6782
a714d3e7cd0751a5f1428881d65043743826415dbdcf7b3f3bc3f938180f18da
a75e8ab5771af0ea36e62f66d3edbe0ec14657b04e87bf99a46a891e652c1add
a81c390548502ac446b8c2eabdc6ea07a8bc43b23e206a9c232d3ceaef3cae9a
a8706f9a07813ae80582404c482cba9754150066c9f04ffcdcd9e549632d16be
abc9faa4970e07db7d506d6b2a98e4c86223be305c7541ced54ea2e15f99a76e
af810e2b2886d81e6225b34eb2391f15be48f95f5ce80bd04f7b25b6e15eb7c8
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b062f2232e3094e4cfbd9543fdf9f043d560f92f8f064813e7a71f80b35ce1fa
b15c3ea03d50c2430490e7416733a254feea4237bb60b54181bd3473ebe4149f
b16f7ee66e29b27d1f14719cefc0e67211523787cc1729be52322583175d0cec
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
b4fd3d2682af09e6cbec0df0e6e487ce412b96c5dfbc4c8abe9e0a6e4ac9e2dd
b66b53112e230d6a90572fd4af0506b89a3021fedad6e9395ad85dc7a3b32094
b6a250b8aee397372a3fb2947076c9d5fbc1cf8578310af151d2f57b81bbfe7f
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
b97b640e8caf3a6aeb76186fad0057593970b7ce2945add451dae091be04350c
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
bbc9f84967a6306b0db8bfc4c80cd5aa2b7733b1a312c684ade35a2972f86edd
bc7b145a0eb35703d5ce10b9204920b9d09e4454bc2288addc9ed5142862f9cd
bc9884b8678b7c60e4380d9373becaadeede44e4fdd14d170971f60595f4dcff
bd6def1ae1509946499390f95acaa1fd39a76452c8312f165d2bc0b791c9e0ef
bf3722b93fa395dc556c14f331f86a9d5e31fa813e46f0cfcb8afd19fae33034
bf7c1ee4ea1d4db7943015c49b30ba3fd16e656409476c693213cc0899995a54
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
c324ef26b20264369e4568dc9ef1c5cb1f325f6bc4e8b7c01f7fe93fa353276a
c3ef28a4f156c353239b74328046126175c702be2d89b9a24c8527a8b53ee0e4
c4596b16b126326b0d8fc2fb8bf91389ad3dc4671a269187913c19a8f2ad1094
c74e09e98dae6e3a87e561dc5a65603f5eee4b9d6d38729a4799c201b50d17da
c85d4f64101e48851e2a89069e50aefd6aeb901c535c7aa39986903d4baf1353
c8c066c331d08eaf858338789a0499c5ad85cfc6325d7685ea8a9463750d8684
c9bf057820b3b0223c468e08beb0d41a12b451e224308149bc05f0d4a607fcab
ca7154cdda62b535ceaba9ad2a2b2217ff49de94c069a2c4e89733f3f06b3651
cb56816d72e7289b2aab8ba19bd1bdb4708cbbc7e70d7f38f9138a4dd10215a5
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
cce83fa2c5096e414c0e32c9fc07ba011e2f4d67a51f9c4155651122329ec0dc
d075070aee6fff82f826766497e5141a38f5ae89ec2d91600c7ba9da58191e35
d3d1fc3b726f87e9440670838b6d33dc22ee1c854274724b27de90be75d1069c
d455ab882af3a742e6c9680578e6a590681bda99e34847f550f1f41a7d167969
d4bb873fd33dea61b0e6d647b7811d3eaee8d0f45f3623f0c9b483e8ad595358
d68605f97c0c27101ea06a1276a2e55c2bf65f0e07e8e0c11be145addde1344b
d8c519e27f603a4eb131526c2a93cdade281348b8efc845a1007e9a29ffdfef4
d94db9ce60ff8e6a0e1dcdab83ff6d1f60dd5c28b50d8f027f5fe268f87fa5ef
d94edd219d965011aa7c423435675f8fc3aba340d1d2a45840c88592b922dbf2
daf181ab9ead5372eefb6fe5d87704d7abdbfa6c09e4c79a2a2f688c6fac5ada
db0fe819895d07af230d0f21f183ae4c9ecdec27664f004c6ac8844deaf55adc
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de5ba330570616401d1840de0075059a65e62280b8d2524334be84290f43a4d7
e0ba033e6cb25fa6e20186d6d8113cc3821028b7891c93eebe671b75f6eebc3f
e19a0e64789068d756a1b250084e54bb0ef77da66685e3dd9eafdc9a71ea1406
e8b416c2f2a14bb138209a5ce434802a742d3de53ce668445485e5423efa1fb2
ea2dd31704608166bfd31e6c1b54027061ea568cd9aa1163656843a5907ac45d
eb6481e44617b3e40d345b2df5e20965503b4ab87c9346a43894f93a601ccde7
ee991e02add6bbe26b55d521d8f83e94031eb9f9f636b30756d4e3fc09a3cff4
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef8e48e37e4317aa7063a4a2e7056620681b2e69073f922dc8c0d27de3e4cef2
f2d424362aca158ad49da19b48c212e687fbed93ece9fed06fcf8871f5f64c5f
f305193707707d5489946d5960934e9d86d50dbc57fd76f927f134f0129e313d
f9060ef4ed91de78998d5f9b15592b736dd9b62f02ecae043dffd6ebca7dd894
f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b
f975207e21041e251c165009f22311cc20b0acf1477d309fd62538beb50e0eb6
fa34de993dea91eb0120c3745378192fa1177ba8ec5772e08632318d1d5e1267
fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4
fb84c55756f2946fd5d5c6c6d3f7a62079c1d7a7123b6c817832835e82b3270c
feeb150a3bd16c65fc36dca51f686a254645a5d60adb4a37aaaa797339013816
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

threatresearch.ext.hp.com Open in urlscan Pro 192.124.249.59 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

189 Requests

99 %HTTPS

65 %IPv6

15 Domains

18 Subdomains

17 IPs

4 Countries

12551 kBTransfer

18169 kBSize

21 Cookies

214 Outgoing links

Redirected requests

189 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

threatresearch.ext.hp.com Open in urlscan Pro
192.124.249.59 Public Scan

Screenshot
Live screenshot

Full Image

189
Requests

99 %
HTTPS

65 %
IPv6

15
Domains

18
Subdomains

17
IPs

4
Countries

12551 kB
Transfer

18169 kB
Size

21
Cookies

189 HTTP transactions
0 data transactions