securityaffairs.co Open in urlscan Pro
2001:8d8:100f:f000::289 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Submission: On February 28 via manual (February 28th 2020, 8:55:32 pm UTC) from EE

Summary HTTP 166 Redirects Links 25 Behaviour Indicators

Summary

This website contacted 30 IPs in 6 countries across 20 domains to perform 166 HTTP transactions. The main IP is 2001:8d8:100f:f000::289, located in Germany and belongs to ONEANDONE-AS Brauerstrasse 48, DE. The main domain is securityaffairs.co.

This is the only time securityaffairs.co was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
40	2001:8d8:100f... 2001:8d8:100f:f000::289	8560 (ONEANDONE...) (ONEANDONE-AS Brauerstrasse 48)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3b	20446 (HIGHWINDS3) (HIGHWINDS3)
5	2a00:1450:400... 2a00:1450:4001:815::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:205... 2600:9000:2057:4a00:3:c04e:c780:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:205... 2600:9000:2057:1200:1c:8a07:5e80:93a1	16509 (AMAZON-02) (AMAZON-02)
16	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1 30	92.122.253.103 92.122.253.103	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2600:9000:205... 2600:9000:2057:c200:c:abe:f440:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:303... 2606:4700:3032::681b:bd6c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
1	2600:9000:214... 2600:9000:214f:2000:c:a9b7:ddc0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2.16.106.193 2.16.106.193	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:2638::1c 2a02:2638::1c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
1	23.62.140.165 23.62.140.165	16625 (AKAMAI-AS) (AKAMAI-AS)
1 3	18.195.176.77 18.195.176.77	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
8	216.58.206.2 216.58.206.2	15169 (GOOGLE) (GOOGLE)
8	52.20.172.27 52.20.172.27	14618 (AMAZON-AES) (AMAZON-AES)
2	2.16.186.67 2.16.186.67	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
12	2a00:1450:400... 2a00:1450:4001:818::2001	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:820::2001	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:825::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:825::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:821::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:820::2002	15169 (GOOGLE) (GOOGLE)
2	52.9.163.168 52.9.163.168	16509 (AMAZON-02) (AMAZON-02)
166	30

40 2001:8d8:100f:f000::289 (Germany)

ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE)

securityaffairs.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3b (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:815::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:4a00:3:c04e:c780:93a1 (United States)

ASN16509 (AMAZON-02, US)

w.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:1200:1c:8a07:5e80:93a1 (United States)

ASN16509 (AMAZON-02, US)

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i0.wp.com

i1.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i2.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

30 92.122.253.103 (Ascension Island) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a92-122-253-103.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
lg3.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
hblg.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

0.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:c200:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)

buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3032::681b:bd6c (United States)

ASN13335 (CLOUDFLARENET, US)

seguranca-informatica.pt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:2000:c:a9b7:ddc0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.sharethis.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.16.106.193 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-106-193.deploy.static.akamaitechnologies.com

pxlclnmdecom-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638::1c (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.62.140.165 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-62-140-165.deploy.static.akamaitechnologies.com

adservetx.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.195.176.77 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-176-77.eu-central-1.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 216.58.206.2 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra16s20-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 52.20.172.27 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-172-27.compute-1.amazonaws.com

dt.clnmde.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.16.186.67 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-67.deploy.static.akamaitechnologies.com

qsearch.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
qsearch-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:818::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:820::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:825::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:821::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.9.163.168 (San Jose, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-9-163-168.us-west-1.compute.amazonaws.com

navvy.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
40	securityaffairs.co securityaffairs.co	1 MB
34	media.net 1 redirects contextual.media.net adservetx.media.net lg3.media.net qsearch.media.net hblg.media.net navvy.media.net	321 KB
18	wp.com i1.wp.com i2.wp.com i0.wp.com stats.wp.com pixel.wp.com	398 KB
15	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	48 KB
9	doubleclick.net securepubads.g.doubleclick.net googleads.g.doubleclick.net	183 KB
8	clnmde.com dt.clnmde.com	4 KB
7	gstatic.com fonts.gstatic.com	129 KB
6	ampproject.org cdn.ampproject.org	111 KB
6	sharethis.com 1 redirects w.sharethis.com platform-api.sharethis.com buttons-config.sharethis.com l.sharethis.com	37 KB
5	googleapis.com fonts.googleapis.com	5 KB
4	googletagservices.com www.googletagservices.com	84 KB
3	google.com 1 redirects adservice.google.com www.google.com	615 B
3	akamaihd.net pxlclnmdecom-a.akamaihd.net qsearch-a.akamaihd.net	33 KB
2	google.de adservice.google.de	342 B
2	seguranca-informatica.pt seguranca-informatica.pt
2	facebook.net connect.facebook.net	115 KB
1	criteo.com gum.criteo.com	341 B
1	consensu.org c.sharethis.mgr.consensu.org
1	gravatar.com 0.gravatar.com	2 KB
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	6 KB
166	20

	Domain	Requested by
40	securityaffairs.co	securityaffairs.co
17	contextual.media.net	1 redirects securityaffairs.co contextual.media.net
12	tpc.googlesyndication.com	securepubads.g.doubleclick.net securityaffairs.co cdn.ampproject.org tpc.googlesyndication.com
8	dt.clnmde.com	pxlclnmdecom-a.akamaihd.net securityaffairs.co
8	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net securityaffairs.co
8	lg3.media.net	securityaffairs.co contextual.media.net
7	fonts.gstatic.com	securityaffairs.co
7	i1.wp.com	securityaffairs.co
6	cdn.ampproject.org	securepubads.g.doubleclick.net
5	hblg.media.net
5	i2.wp.com	securityaffairs.co
5	fonts.googleapis.com	securityaffairs.co securepubads.g.doubleclick.net
4	www.googletagservices.com	securityaffairs.co securepubads.g.doubleclick.net
4	i0.wp.com	securityaffairs.co
3	pagead2.googlesyndication.com	securepubads.g.doubleclick.net
3	l.sharethis.com	1 redirects securityaffairs.co
2	navvy.media.net	contextual.media.net
2	adservice.google.com	www.googletagservices.com
2	adservice.google.de	www.googletagservices.com
2	pxlclnmdecom-a.akamaihd.net	contextual.media.net pxlclnmdecom-a.akamaihd.net
2	seguranca-informatica.pt	securityaffairs.co
2	connect.facebook.net	securityaffairs.co connect.facebook.net
1	qsearch-a.akamaihd.net
1	googleads.g.doubleclick.net	securityaffairs.co
1	www.google.com	1 redirects
1	qsearch.media.net	securityaffairs.co
1	pixel.wp.com	securityaffairs.co
1	adservetx.media.net	contextual.media.net
1	gum.criteo.com	contextual.media.net
1	c.sharethis.mgr.consensu.org	w.sharethis.com
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	stats.wp.com	securityaffairs.co
1	0.gravatar.com	securityaffairs.co
1	platform-api.sharethis.com	securityaffairs.co
1	w.sharethis.com	securityaffairs.co
1	maxcdn.bootstrapcdn.com	securityaffairs.co
166	36

This site contains links to these domains. Also see Links.

Domain
seguranca-informatica.pt
i1.wp.com
i2.wp.com
i0.wp.com
www.linkedin.com
www.facebook.com
twitter.com
reddit.com
www.pinterest.com
plus.google.com
www.tumblr.com
blog.yoroi.company
miniorange.com

Subject Issuer	Validity	Valid
www.securityaffairs.co GeoTrust RSA CA 2018	`2019-02-21` - `2020-03-22`	a year	crt.sh
*.wp.com Go Daddy Secure Certificate Authority - G2	`2018-04-10` - `2020-05-11`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-01-16` - `2020-04-15`	3 months	crt.sh
*.media.net DigiCert SHA2 Secure Server CA	`2020-02-25` - `2021-05-26`	a year	crt.sh
*.sharethis.com Go Daddy Secure Certificate Authority - G2	`2017-09-26` - `2020-09-29`	3 years	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-01-31` - `2020-10-09`	8 months	crt.sh
*.sharethis.mgr.consensu.org Go Daddy Secure Certificate Authority - G2	`2018-05-21` - `2020-05-21`	2 years	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2019-08-13` - `2020-08-12`	a year	crt.sh
*.criteo.com DigiCert ECC Secure Server CA	`2019-12-05` - `2021-04-08`	a year	crt.sh
*.google.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
misc-sni.google.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh

This page contains 19 frames:

Primary Page: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Frame ID: 801DCB01F116536D8BBC8C2096C59C4B
Requests: 108 HTTP requests in this frame

Frame: https://seguranca-informatica.pt/lampion-malware-v2-february-2020/embed/
Frame ID: 4B91F04068025565A56717CDAE13E956
Requests: 1 HTTP requests in this frame

Frame: https://seguranca-informatica.pt/lampion-malware-origin-servers-geolocated-in-turkey/embed/
Frame ID: D3748C656B5017F279EA4E3913C188FD
Requests: 1 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Frame ID: 12783EE58A2E225F0C42047C80EFC0E1
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HB41O6BH&prvid=80%2C82%2C97%2C109%2C148%2C175%2C178%2C192%2C193%2C3008&rtime=5&usp_status=0&usp_consent=1
Frame ID: 0351E4DFDCA3578FD11605AA1E6FD9DD
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/fcmdynet.js?&gdpr=0&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&size=300x250&cc=CH&https=1&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&nse=3&vi=1582923313107055206&lw=1&ugd=4&rtbs=1&hlt=1&dfp=1&ntv=1&nb=1
Frame ID: 581737FA1DEE21DD88AED6477CD5FE83
Requests: 2 HTTP requests in this frame

Frame: http://www.googletagservices.com/tag/js/gpt.js
Frame ID: 2C695406D1FF551EFEBC82CAF842D2D0
Requests: 12 HTTP requests in this frame

Frame: https://contextual.media.net/fcmdynet.js?&gdpr=0&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=CH&https=1&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&nse=3&vi=1582923313425037551&lw=1&ugd=4&rtbs=1&ntv=1&nb=1
Frame ID: EC47E7D26426A6FBDF98EF9B414647A5
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/fcmdynet.js?&gdpr=0&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&size=300x600&cc=CH&https=1&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&nse=3&vi=1582923313678722137&lw=1&ugd=4&rtbs=1&hlt=1&dfp=1&ntv=1&nb=1
Frame ID: 0F444F5932B8C9DE4CC71237D9322854
Requests: 1 HTTP requests in this frame

Frame: http://www.googletagservices.com/tag/js/gpt.js
Frame ID: 2B9367FD565A18322E76DF4F9C2EA726
Requests: 8 HTTP requests in this frame

Frame: https://pxlclnmdecom-a.akamaihd.net/javascripts/bfp_ssn.js?templateId=3
Frame ID: 9CBBAB18404630C3ABB258003AA6AD9B
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&pid=8PO5M70HK&size=300x600&cpnet=yVb1sHm-0KIh29BOFTjjrOMbY3Wy7OSYfNFL7sC0vVY%3D&cme=auTgd-6jz2Z4bACDRdo45ZvP7JuGgYF5kBoI5_LcBkDhTKAaIXOYkys-W_SyGzGBJLaCGEHs_r9k7CrDwoOBfNjkZQKK0rF8wWuaZjQgrRupjr0yzVqrCOf03Reqgj-5jz09YE71aOA%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CygJDWuih5otg1sflNsIQ2jvfmNfrbgWtJjawETPEjASZd4dsrgrjJfTOlR1z96K-hwAeciOmbKapm7nSzYkvlps85OI6MMeY1_I0syMjHj8%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=CH&bf=0&staticIframe=1&vif=1&nse=3&vi=1582923313678722137&lw=1&ugd=4&ib=0&bid=265598&katid=801835331&katbid=-21&katen=1&nb=1
Frame ID: 44E10389D722F0EB7FD61BBEAC7073B4
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012002141856310/amp4ads-v0.js
Frame ID: 4570C7112CF2EA9F5FCDD7566C3D67CF
Requests: 17 HTTP requests in this frame

Frame: https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&pid=8PO5M70HK&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrEBbIZGw_v2fXpyZXRW3WVE%3D&cme=hmi3FHRUKMmbg7S1za9RrgUwPcWgA-5rHMNJEPFQuzUVLkrdVMv8-oVOyRAFvxfUNqonVoHZo5pmXdFR_QujpmK0x59gKKMgHl7urD31dViSBd6L5RXiqrMavI-JqMKYTeUIdk2MGXM%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CygJDWuih5otg1sflNsIQ2jvfmNfrbgWtJjawETPEjASZd4dsrgrjJfTOlR1z96K-hwAeciOmbKapm7nSzYkvlps85OI6MMeY1_I0syMjHj8%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=CH&bf=0&staticIframe=1&vif=1&nse=3&vi=1582923313107055206&lw=1&ugd=4&ib=0&bid=265598&katid=801338173&katbid=-21&katen=1&nb=1
Frame ID: 977BAB23AEB1796735D8854C5D58A83C
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&pid=8PO5M70HK&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrHvHwrQGlpByWaOO1vn303s%3D&cme=B8QTkEAJekI0Te_VLkXv4TiqmM_QnWTuqacVqQmM3O1f52e5nPnfZatUe3-eCgBiElBJRPLfxuT1y42pCHDh9hMmplUUQOrIWiipr66hToNgwsE2dy13osR4WJ6E7G_Ax8YpUEMQ0ww%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CygJDWuih5otg1sflNsIQ2jvfmNfrbgWtJjawETPEjASZd4dsrgrjJfTOlR1z96K-hwAeciOmbKapm7nSzYkvlps85OI6MMeY1_I0syMjHj8%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=CH&bf=0&staticIframe=1&vif=1&nse=3&vi=1582923313425037551&lw=1&ugd=4&ib=0&bid=265596&katid=801353038&katbid=-21&katen=1&nb=1
Frame ID: 09D608D18920A7C6C3512CCD41A6F8C4
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/nrrV92300.js
Frame ID: 68308217A3D2510C8154BD694005AA18
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst3wr3Pa3enkHIUydXGE14l08_dey2sEih08WBM40L5O1IObm_zNGiizCvusLr7JnBs8gTma8Bypi3Ru7iBbcqabbxZ7bBeXjQ2iKIJxkyw4qi1xJUnOZ2RnskVqHQp0hZchiF-J-0YMocR_XHR4cNcD5EsKbnqxoBXxtD_2It43P169KNUND7QDYIwocX6bUN2fbPuuByVO67uU1bzeiGM83cz15QGyDw_ZmJqgkFNckxXd0T_d-rRGlPHa3onHSPnbK5th9VxpjCZjY_nya25M02KUf7mN5Dlqx0gEueSR62F3tTu&sig=Cg0ArKJSzDKIFR0xV615EAE&urlfix=1&adurl=
Frame ID: 99416E0111C5D2D27735F916D7ECA805
Requests: 2 HTTP requests in this frame

Frame: https://contextual.media.net/nrrV92300.js
Frame ID: 82BE8396C7A8CDB3DA3DA554FE81DD1D
Requests: 6 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 3EB51C4FB25FC1FA4B15344D496FF4CC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Page Statistics

166
Requests

60 %
HTTPS

67 %
IPv6

20
Domains

36
Subdomains

30
IPs

6
Countries

2799 kB
Transfer

4752 kB
Size

19
Cookies

25 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

URL: https://seguranca-informatica.pt/lampion-malware-v2-february-2020/#.XleiJ3X7TVM
Title: DPD

Search URL Search Domain Scan URL

URL: https://i1.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/lampion_email_27_february_2020.png?ssl=1

Search URL Search Domain Scan URL

URL: https://i2.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/portaldasfinancas_server.png?ssl=1

Search URL Search Domain Scan URL

URL: https://i1.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/portaldasfinancas_server2.png?ssl=1

Search URL Search Domain Scan URL

URL: https://i2.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/server_lampion.png?ssl=1

Search URL Search Domain Scan URL

URL: https://i2.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/lampion-campaign.png?ssl=1

Search URL Search Domain Scan URL

URL: https://i0.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/burpsuite_poc.png?ssl=1

Search URL Search Domain Scan URL

URL: https://i2.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/burp2.png?ssl=1

Search URL Search Domain Scan URL

URL: https://i0.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/result.png?ssl=1

Search URL Search Domain Scan URL

URL: https://seguranca-informatica.pt/targeting-portugal-a-new-trojan-lampion-has-spread-using-template-emails-from-the-portuguese-government-finance-tax
Title: https://seguranca-informatica.pt/targeting-portugal-a-new-trojan-lampion-has-spread-using-template-emails-from-the-portuguese-government-finance-tax

Search URL Search Domain Scan URL

URL: https://seguranca-informatica.pt/lampion-malware-origin-servers-geolocated-in-turkey/
Title: Lampion malware origin servers geolocated in Turkey

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/pub/pierluigi-paganini/b/742/559
Title: Pierluigi Paganini

Search URL Search Domain Scan URL

URL: http://www.facebook.com/sharer.php?u=https://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Title: Facebook

Search URL Search Domain Scan URL

URL: http://twitter.com/share?url=https://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html&text=Lampion%20malware%20origin%20servers%20geolocated%20in%20Turkey%20
Title: Twitter

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Title: Linkedin

Search URL Search Domain Scan URL

URL: http://reddit.com/submit?url=https://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html&title=Lampion%20malware%20origin%20servers%20geolocated%20in%20Turkey
Title: Reddit

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html

Search URL Search Domain Scan URL

URL: http://www.pinterest.com/pin/create/button/?url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&media=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2Fwp-includes%2Fimages%2Fmedia%2Fdefault.png

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html

Search URL Search Domain Scan URL

URL: http://www.tumblr.com/share/link?url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html

Search URL Search Domain Scan URL

URL: https://blog.yoroi.company/

Search URL Search Domain Scan URL

URL: http://miniorange.com/cyber-security
Title: Secured By miniOrange

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 29

http://connect.facebook.net/en_US/sdk.js HTTP 307
https://connect.facebook.net/en_US/sdk.js

Request Chain 36

http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW HTTP 302
https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Request Chain 94

https://securityaffairs.co/wordpress?ga_action=googleanalytics_get_script HTTP 301
https://securityaffairs.co/wordpress/?ga_action=googleanalytics_get_script

Request Chain 96

https://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&fpc=6f69f6a-1708d94f112-73a0af9d-1&sessionID=1582923313426.32724&hostname=securityaffairs.co&location=%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&product=simpleshare&fcmp=false&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&consentDomain=.consensu.org&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&sharURL=&buttonType=ERROR&destination=ERROR&source=ERROR&title=Lampion%20malware%20origin%20servers%20geolocated%20in%20TurkeySecurity%20Affairs&ts1582923313426.0=&sop=false HTTP 301
https://l.sharethis.com/sc?cm=CicACl5ZfjEAAAASGw0mAw%3D%3D&uid=true&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&sop=false

Request Chain 128

http://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

166 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request lampion-malware-origin.html Show response
securityaffairs.co/wordpress/98597/malware/ 78 KB
21 KB 62ms
54ms Document
text/html 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache / PHP/7.2.27
Resource Hash: 9dfd881b8dce6557fa028ba7c9f0e76759898ffb09833ecb0adf9a5b34d91bcd

Request headers

Host: securityaffairs.co
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=15
Date: Fri, 28 Feb 2020 20:55:12 GMT
Server: Apache
X-Powered-By: PHP/7.2.27
Vary: Accept-Encoding,Cookie
Cache-Control: max-age=3, must-revalidate
Content-Encoding: gzip

GET
H/1.1 200
OK style.css
securityaffairs.co/wordpress/wp-includes/css/dist/block-library/ 49 KB
49 KB 15ms
11ms Stylesheet
text/css 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-includes/css/dist/block-library/style.css?ver=70a115690565af9faf7a8d28f4104d24
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 2975d809361999f5926fbaf69f7b14667583ec967271ac73edb32d47a2307e4d

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 13 Nov 2019 23:52:08 GMT
Server: Apache
ETag: "c46f-597430d783269"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 50287

GET
H/1.1 200
OK cookie-law-info-public.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/ 3 KB
3 KB 19ms
10ms Stylesheet
text/css 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=1.8.3
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 81e82457fb12ef9a7b3981eceba4363763a703fd04bbe4da183903fd74e2cbcd

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Tue, 11 Feb 2020 22:18:17 GMT
Server: Apache
ETag: "b26-59e543b90ebd8"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 2854

GET
H/1.1 200
OK cookie-law-info-gdpr.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/ 23 KB
23 KB 19ms
10ms Stylesheet
text/css 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=1.8.3
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 1423f118a35dc9c99fff8faa25d7dc1872bf55c5e4d3298b28ee0fc361a4ca5d

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Tue, 11 Feb 2020 22:18:17 GMT
Server: Apache
ETag: "5c8b-59e543b90ebd8"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 23691

GET
H/1.1 200
OK font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/ 23 KB
6 KB 15ms
7ms Stylesheet
text/css 2001:4de0:ac19::1:b:3b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: http://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css?ver=70a115690565af9faf7a8d28f4104d24
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: /
Resource Hash: 541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Dec 2018 18:35:19 GMT
X-Hello-Human: Say hello back! @getBootstrapCDN on Twitter
ETag: "1544639719"
Vary: Accept-Encoding
X-Cache: HIT
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
cache-control: public, max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
timing-allow-origin: *
Content-Length: 5442

GET
H/1.1 200
OK custom.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/ 19 KB
20 KB 20ms
11ms Stylesheet
text/css 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/custom.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 13:54:59 GMT
Server: Apache
ETag: "4d92-52704407f72c0"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 19858

GET
H/1.1 200
OK tipsy.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 539 B
799 B 20ms
10ms Stylesheet
text/css 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/tipsy.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:04 GMT
Server: Apache
ETag: "21b-526fe6d7cd700"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 539

GET
H/1.1 200
OK flexslider.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/ 6 KB
6 KB 20ms
10ms Stylesheet
text/css 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/flexslider.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 13:55:09 GMT
Server: Apache
ETag: "1851-5270441180940"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 6225

GET
H/1.1 200
OK mediaelementplayer-legacy.min.css
securityaffairs.co/wordpress/wp-includes/js/mediaelement/ 11 KB
11 KB 30ms
10ms Stylesheet
text/css 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.13-9993131
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: b834a80037718e3da7f92199034dc59611ed774af41f1e84fa1e0d97c4261192

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 13 Nov 2019 23:52:08 GMT
Server: Apache
ETag: "2ca1-597430d7ee92b"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 11425

GET
H/1.1 200
OK animation.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 2 KB
2 KB 30ms
10ms Stylesheet
text/css 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/animation.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:02 GMT
Server: Apache
ETag: "6b4-526fe6d5e5280"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 1716

GET
H/1.1 200
OK font-awesome.min.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 17 KB
18 KB 30ms
9ms Stylesheet
text/css 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:02 GMT
Server: Apache
ETag: "4574-526fe6d5e5280"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 17780

GET
H/1.1 200
OK swipebox.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 4 KB
5 KB 34ms
10ms Stylesheet
text/css 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/swipebox.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:18 GMT
Server: Apache
ETag: "118d-526fe6e527680"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 4493

GET
H/1.1 200
OK jquery.circliful.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 334 B
594 B 35ms
9ms Stylesheet
text/css 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jquery.circliful.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:02 GMT
Server: Apache
ETag: "14e-526fe6d5e5280"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 334

GET
H/1.1 200
OK screen.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 110 KB
110 KB 37ms
11ms Stylesheet
text/css 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/screen.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:04 GMT
Server: Apache
ETag: "1b844-526fe6d7cd700"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 112708

GET
H/1.1 200
OK custom-css.php
securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/ 12 KB
12 KB 67ms
37ms Stylesheet
text/css 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/custom-css.php?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache / PHP/7.2.27
Resource Hash: 18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Server: Apache
Connection: keep-alive
X-Powered-By: PHP/7.2.27
Transfer-Encoding: chunked
Keep-Alive: timeout=15
Content-Type: text/css; charset: UTF-8;charset=UTF-8

GET
H/1.1 200
OK css
fonts.googleapis.com/ 11 KB
1 KB 24ms
16ms Stylesheet
text/css 2a00:1450:4001:815::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Roboto+Condensed%3A400italic%2C700italic%2C400%2C700&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Cgreek%2Ccyrillic%2Clatin-ext%2Cvietnamese&ver=70a115690565af9faf7a8d28f4104d24

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:815::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7040011c9ed547b38418a696ba843b65c2a24e466dc651941c24b8848ead1527

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Feb 2020 20:55:12 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Fri, 28 Feb 2020 20:55:12 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 3 KB
1 KB 22ms
14ms Stylesheet
text/css 2a00:1450:4001:815::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=70a115690565af9faf7a8d28f4104d24

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:815::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4cda38f3885dc3ed94fd7074ba106f5e92289d4a99ca163c01060328806b9945

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Feb 2020 20:55:12 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Fri, 28 Feb 2020 20:55:12 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 4 KB
1 KB 25ms
17ms Stylesheet
text/css 2a00:1450:4001:815::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Playfair+Display%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=70a115690565af9faf7a8d28f4104d24

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:815::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1a64c45342cbefaa822150ebedceb88e20e287e663025b6df063b31619fc6249

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Feb 2020 20:55:12 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Fri, 28 Feb 2020 20:55:12 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 3 KB
1 KB 25ms
17ms Stylesheet
text/css 2a00:1450:4001:815::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=70a115690565af9faf7a8d28f4104d24

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:815::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

51ba1b1d5ca3db43a92c894bda906efe86e3e929452f4f25ce431d77d49234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 28 Feb 2020 20:55:12 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Fri, 28 Feb 2020 20:55:12 GMT

GET
H/1.1 200
OK grid.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 49 KB
50 KB 40ms
10ms Stylesheet
text/css 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/grid.css?ver=70a115690565af9faf7a8d28f4104d24
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:03 GMT
Server: Apache
ETag: "c5f2-526fe6d6d94c0"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 50674

GET
H/1.1 200
OK jquery.js Show response
securityaffairs.co/wordpress/wp-includes/js/jquery/ 95 KB
95 KB 42ms
10ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Tue, 21 May 2019 21:49:10 GMT
Server: Apache
ETag: "17a69-5896cd1a361be"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 96873

GET
H/1.1 200
OK jquery-migrate.js Show response
securityaffairs.co/wordpress/wp-includes/js/jquery/ 23 KB
23 KB 43ms
9ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: dce50148adaff4dccd1d95c9b25563011436e398272d530e974193b8685340a2

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Thu, 21 Feb 2019 22:56:38 GMT
Server: Apache
ETag: "5bdb-5826f63145921"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 23515

GET
H/1.1 200
OK cookie-law-info-public.js Show response
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/ 21 KB
22 KB 46ms
11ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=1.8.3
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: f0dc5a104ad07a87dec3f36b5ff8eb24b974cf484e1d378fdf7d4578ea9f4b9d

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Tue, 11 Feb 2020 22:18:17 GMT
Server: Apache
ETag: "553f-59e543b90ebd8"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 21823

GET
H/1.1 200
OK st_insights.js Show response
w.sharethis.com/button/ 23 KB
7 KB 20ms
6ms Script
application/javascript 2600:9000:2057:4a00:3:c04e:c780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://w.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2600:9000:2057:4a00:3:c04e:c780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: a5752b3be278ea4c2aa9ec45787cb633e83315c19e379220b6df8a1fe62196eb

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Feb 2020 05:29:29 GMT
Content-Encoding: gzip
Age: 228343
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 6765
Server: nginx/1.16.1
ETag: W/"5e55b83e-5aca"
Vary: Accept-Encoding
Content-Type: application/javascript
Via: 1.1 c26b8e74df43cd99786e716221463d0c.cloudfront.net (CloudFront)
Cache-Control: max-age=259200
X-Amz-Cf-Pop: FRA6-C1
X-Robots-Tag: noindex, nofollow
X-Amz-Cf-Id: LYcEO8EjyKefvTdzSbnR_pY8p-YfE6EaaJ-8dDupcLlFngwyoNNTvw==
Expires: Sat, 29 Feb 2020 05:29:29 GMT

GET
H/1.1 200
OK sharethis.js Show response
platform-api.sharethis.com/js/ 90 KB
28 KB 14ms
6ms Script
text/javascript 2600:9000:2057:1200:1c:8a07:5e80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://platform-api.sharethis.com/js/sharethis.js
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2600:9000:2057:1200:1c:8a07:5e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 9e93647793dfed19dabe4f90cbe14907b06b3df688da169cac3439cf38bb1b69

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:50:02 GMT
Content-Encoding: gzip
X-Amz-Cf-Pop: FRA6-C1
Age: 310
ETag: W/"16950-6+yiq/KIbKXP1kHJrrrvlFxddpQ"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/javascript; charset=utf-8
Via: 1.1 1b412557b82dda96e078541f9ee8dfb2.cloudfront.net (CloudFront)
Edge-control: cache-maxage=60m,downstream-ttl=60m
Cache-Control: max-age=600, public
Transfer-Encoding: chunked
Connection: keep-alive
X-Amz-Cf-Id: xDRL0IgWdrTXN0t7Pc0pzzWGrFUYl3Kc6Y64G45iIP6fTkLLZJF0lQ==

GET
H2 200 logo_SecurityAffairs.png
securityaffairs.co/wordpress/wp-content/uploads/2015/12/ 44 KB
44 KB 18ms
16ms Image
image/png 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.co/wordpress/wp-content/uploads/2015/12/logo_SecurityAffairs.png
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 20:55:12 GMT
last-modified: Wed, 16 Dec 2015 17:30:42 GMT
server: Apache
etag: "b0e9-5270743f5f480"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 45289

GET
H2 200 lampion_email_27_february_2020.png
i1.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/ 44 KB
44 KB 90ms
37ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/lampion_email_27_february_2020.png?ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

226d604cdc1373a906bae5698538fcb46a51ddd79d3838e32fa32270cd9ad604

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-nc: HIT ams 1
date: Fri, 28 Feb 2020 20:55:12 GMT
x-content-type-options: nosniff
x-bytes-saved: 38264
last-modified: Thu, 27 Feb 2020 19:17:06 GMT
server: nginx
etag: "009e24268ae29b15"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://seguranca-informatica.pt/wp-content/uploads/2020/02/lampion_email_27_february_2020.png>; rel="canonical"
content-length: 45070
expires: Sun, 27 Feb 2022 07:17:06 GMT

GET
H2 200 portaldasfinancas_server.png
i2.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/ 83 KB
84 KB 29ms
27ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/portaldasfinancas_server.png?ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

65941e51aae35a3de796e434dd8f5ed90f7469ddb3855f45850375c7b7abc069

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-nc: HIT ams 4
date: Fri, 28 Feb 2020 20:55:12 GMT
x-content-type-options: nosniff
x-bytes-saved: 88657
last-modified: Thu, 27 Feb 2020 18:57:38 GMT
server: nginx
etag: "785ada5363af7ea0"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://seguranca-informatica.pt/wp-content/uploads/2020/02/portaldasfinancas_server.png>; rel="canonical"
content-length: 85434
expires: Sun, 27 Feb 2022 06:57:38 GMT

GET
H2 200 portaldasfinancas_server2.png
i1.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/ 61 KB
61 KB 45ms
44ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/portaldasfinancas_server2.png?ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

51aee7d0b125131db0a989aedb86c115390f3dc7f54b007a6ce087505da23e81

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-nc: HIT ams 8
date: Fri, 28 Feb 2020 20:55:12 GMT
x-content-type-options: nosniff
x-bytes-saved: 70449
last-modified: Thu, 27 Feb 2020 19:17:06 GMT
server: nginx
etag: "46d05b5a298ea046"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://seguranca-informatica.pt/wp-content/uploads/2020/02/portaldasfinancas_server2.png>; rel="canonical"
content-length: 62690
expires: Sun, 27 Feb 2022 07:17:06 GMT

GET
H2 200 server_lampion.png
i2.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/ 31 KB
31 KB 27ms
27ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/server_lampion.png?ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

3cfd539b9f38739f22f2ee725cdef0de152c31b83da0ff715eaf82c2efc62258

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-nc: HIT ams 5
date: Fri, 28 Feb 2020 20:55:12 GMT
x-content-type-options: nosniff
x-bytes-saved: 31341
last-modified: Thu, 27 Feb 2020 18:57:38 GMT
server: nginx
etag: "b1841c9ada64ed5a"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://seguranca-informatica.pt/wp-content/uploads/2020/02/server_lampion.png>; rel="canonical"
content-length: 31466
expires: Sun, 27 Feb 2022 06:57:38 GMT

GET
H2

200

sdk.js Show response
connect.facebook.net/en_US/
Redirect Chain

http://connect.facebook.net/en_US/sdk.js
https://connect.facebook.net/en_US/sdk.js

3 KB
2 KB

6ms
6ms

Script
application/x-javascript

2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

85af764caf1a06ae6a5157778f0948982feda127210fea8b9cbd9c8e411addf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: fmX1aCGPW4b4WEx7nxFE7A==
status: 200
date: Fri, 28 Feb 2020 20:55:12 GMT, Fri, 28 Feb 2020 20:55:12 GMT
expires: Fri, 28 Feb 2020 21:05:11 GMT
alt-svc: h3-24=":443"; ma=3600
content-length: 1779
x-fb-debug: kJL6TKEcZaaNFS5qobLZhNd7BdWBJUD9MUtDiBHiDThuTbkmBmAVcTAezMaIOjIaHmqpm5YNC2vcZ/DMlYVlRQ==
x-fb-trip-id: 1850256238
x-fb-content-md5: 530cda858b1b5170f9eb2989b3e531c7
etag: "f07f0817e4d6bd75a52ad9b1d557110f"
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

Redirect headers

Location: https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v2.6
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK twemoji.js Show response
securityaffairs.co/wordpress/wp-includes/js/ 27 KB
27 KB 10ms
10ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-includes/js/twemoji.js?ver=70a115690565af9faf7a8d28f4104d24
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: fd503ca2cb350bd8ecec266730289fd8a519faffe250b976f7963dc10bfd829c

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 13 Nov 2019 23:52:08 GMT
Server: Apache
ETag: "6c11-597430d810c0b"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 27665

GET
H/1.1 200
OK wp-emoji.js Show response
securityaffairs.co/wordpress/wp-includes/js/ 9 KB
9 KB 10ms
10ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-includes/js/wp-emoji.js?ver=70a115690565af9faf7a8d28f4104d24
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: ff538454ee741443627ee05b3c79b2763b2db0daa7d984c650691cdbe540d27c

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 13 Nov 2019 23:52:08 GMT
Server: Apache
ETag: "231e-597430d80eccb"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 8990

GET
H2 200 lampion-campaign.png
i2.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/ 43 KB
43 KB 25ms
25ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/lampion-campaign.png?ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

74a4357c090bbffc845e0948dd038fe5bcbacdc3488e55217e559b6831e92f9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-nc: HIT ams 6
date: Fri, 28 Feb 2020 20:55:13 GMT
x-content-type-options: nosniff
x-bytes-saved: 41884
last-modified: Thu, 27 Feb 2020 19:17:06 GMT
server: nginx
etag: "9498400ea87016bb"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://seguranca-informatica.pt/wp-content/uploads/2020/02/lampion-campaign.png>; rel="canonical"
content-length: 43946
expires: Sun, 27 Feb 2022 07:17:06 GMT

GET
H2 200 burpsuite_poc.png
i0.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/ 50 KB
50 KB 27ms
26ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/burpsuite_poc.png?ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

e51ea3ce40f201a8fef72890cdadaf5263ed1064ad535a030c1d4a797fa8cf1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-nc: HIT ams 6
date: Fri, 28 Feb 2020 20:55:13 GMT
x-content-type-options: nosniff
x-bytes-saved: 52417
last-modified: Thu, 27 Feb 2020 19:17:06 GMT
server: nginx
etag: "a45109b495e5d845"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://seguranca-informatica.pt/wp-content/uploads/2020/02/burpsuite_poc.png>; rel="canonical"
content-length: 51458
expires: Sun, 27 Feb 2022 07:17:06 GMT

GET
H2 200 burp2.png
i2.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/ 19 KB
19 KB 26ms
25ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/burp2.png?ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

83738d24b1739f2bb3ea037e29b153ecf43bdc15c75eeb8cec9f73aa174b774e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-nc: HIT ams 5
date: Fri, 28 Feb 2020 20:55:13 GMT
x-content-type-options: nosniff
x-bytes-saved: 17679
last-modified: Thu, 27 Feb 2020 19:17:06 GMT
server: nginx
etag: "e6cc08bd12a4136a"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://seguranca-informatica.pt/wp-content/uploads/2020/02/burp2.png>; rel="canonical"
content-length: 19564
expires: Sun, 27 Feb 2022 07:17:06 GMT

GET
H2 200 result.png
i0.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/ 31 KB
31 KB 30ms
30ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/seguranca-informatica.pt/wp-content/uploads/2020/02/result.png?ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

6629c7906bec8dde5bec5816dd5070bfceb9e84713facb874580ed50d98c2f3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-nc: HIT ams 3
date: Fri, 28 Feb 2020 20:55:13 GMT
x-content-type-options: nosniff
x-bytes-saved: 39139
last-modified: Thu, 27 Feb 2020 19:17:06 GMT
server: nginx
etag: "267e6b0f824374cc"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://seguranca-informatica.pt/wp-content/uploads/2020/02/result.png>; rel="canonical"
content-length: 31884
expires: Sun, 27 Feb 2022 07:17:06 GMT

GET
H2

200

dmedianet.js Show response
contextual.media.net/
Redirect Chain

http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

397 KB
126 KB

166ms
94ms

Script
text/javascript

92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-253-103.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

1e02d63e11bf8f905451979939a09d0c4f6974de2484e630bb25814d6f380886

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-mnt-h: 8-15
content-encoding: gzip
server: Apache
date: Fri, 28 Feb 2020 20:55:13 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
status: 200
cache-control: max-age=2400
strict-transport-security: max-age=604800
x-mnt-w: 8-20
expires: Fri, 28 Feb 2020 21:35:13 GMT

Redirect headers

Location: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Date: Fri, 28 Feb 2020 20:55:13 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0
Strict-Transport-Security: max-age=604800

GET
H2 200 facebook.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 830 B
1 KB 25ms
25ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

c067a7d5bc50ed4ba554421966d6c4b0140ff2ed4574640fd5abcfa1ab35be11

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-nc: HIT ams 5
date: Fri, 28 Feb 2020 20:55:13 GMT
x-content-type-options: nosniff
x-bytes-saved: 290
last-modified: Sun, 09 Jun 2019 09:59:37 GMT
server: nginx
etag: "e076e158ac718305"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png>; rel="canonical"
content-length: 830
expires: Tue, 08 Jun 2021 21:59:37 GMT

GET
H2 200 twitter.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 1 KB
1 KB 25ms
25ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

7a8cf6b7fce01f318e416ae1904132265526ca2b6ef3003f7fe831186a7380a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-nc: HIT ams 1
date: Fri, 28 Feb 2020 20:55:13 GMT
x-content-type-options: nosniff
x-bytes-saved: 815
last-modified: Tue, 05 Feb 2019 06:25:34 GMT
server: nginx
etag: "53b6f71a9c0f1a7d"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png>; rel="canonical"
content-length: 1082
expires: Thu, 04 Feb 2021 18:25:34 GMT

GET
H2 200 linkedin.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 1 KB
1 KB 26ms
26ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

00a4c9aeb6f61ae7f260eea51d5d19a651544c01d202363463375992ef021960

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-nc: HIT ams 2
date: Fri, 28 Feb 2020 20:55:13 GMT
x-content-type-options: nosniff
x-bytes-saved: 442
last-modified: Tue, 05 Feb 2019 06:25:34 GMT
server: nginx
etag: "2a93de08dbecd1ae"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png>; rel="canonical"
content-length: 1182
expires: Thu, 04 Feb 2021 18:25:34 GMT

GET
H2 200 reddit.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 2 KB
2 KB 26ms
26ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/reddit.png

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

56159a7fa211c042c8da7005984653715f938917383f74292247f7b271469fb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-nc: HIT ams 6
date: Fri, 28 Feb 2020 20:55:13 GMT
x-content-type-options: nosniff
last-modified: Tue, 24 Dec 2019 19:01:59 GMT
server: nginx
etag: "7618b43b68cccd0f"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/reddit.png>; rel="canonical"
content-length: 1566
expires: Fri, 24 Dec 2021 07:01:59 GMT

GET
H2 200 pinterest.png
i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 1 KB
2 KB 26ms
25ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/pinterest.png

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

936c3e0cfba7a07ab55be383aeca9d39dcde7b4e9cddbfd973f78e34d3cc7078

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-nc: HIT ams 2
date: Fri, 28 Feb 2020 20:55:13 GMT
x-content-type-options: nosniff
last-modified: Tue, 18 Feb 2020 08:55:05 GMT
server: nginx
etag: "449340653837e585"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/pinterest.png>; rel="canonical"
content-length: 1498
expires: Thu, 17 Feb 2022 20:55:05 GMT

GET
H/1.1 200
OK f00db26378ef7df7c440a8ee60ead62b
0.gravatar.com/avatar/ 1 KB
2 KB 23ms
11ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://0.gravatar.com/avatar/f00db26378ef7df7c440a8ee60ead62b?s=60&d=mm&r=g
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 643a860832456b5a74825b79d625434b5c4c2a344b8f9bef3614b327bea52646

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-nc: HIT ams 1
Date: Fri, 28 Feb 2020 20:55:13 GMT
Last-Modified: Wed, 11 Jan 1984 08:00:00 GMT
Server: nginx
Source-Age: 2045363
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Cache-Control: max-age=300
Content-Disposition: inline; filename="f00db26378ef7df7c440a8ee60ead62b.png"
Connection: keep-alive
Accept-Ranges: bytes
Link: <https://www.gravatar.com/avatar/f00db26378ef7df7c440a8ee60ead62b?s=60&d=mm&r=g>; rel="canonical"
Content-Length: 1186
Expires: Fri, 28 Feb 2020 21:00:13 GMT

GET
H2 200 turkey-social-media-block-idlib-timeline-2020-02-27-1024x599-1.png
securityaffairs.co/wordpress/wp-content/uploads/2020/02/ 375 KB
375 KB 16ms
16ms Image
image/png 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.co/wordpress/wp-content/uploads/2020/02/turkey-social-media-block-idlib-timeline-2020-02-27-1024x599-1.png
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: a461001c96496bb9955465a16ab189790b03aaae47533d69a346a62f780d7a13

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 20:55:13 GMT
last-modified: Fri, 28 Feb 2020 14:01:05 GMT
server: Apache
etag: "5dbaf-59fa344c5fc6e"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 383919

GET
H2 200 malicious-app-stores.png
securityaffairs.co/wordpress/wp-content/uploads/2020/02/ 83 KB
83 KB 16ms
16ms Image
image/png 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.co/wordpress/wp-content/uploads/2020/02/malicious-app-stores.png
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 71419dc0ae1b7f134eac1039537251d178812408a89ee40b6d9f65ee29f5e01c

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 20:55:13 GMT
last-modified: Fri, 28 Feb 2020 12:47:51 GMT
server: Apache
etag: "14c69-59fa23ed8fd1f"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 85097

GET
H2 200 Digging-The-Deep-Web.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/ 6 KB
6 KB 26ms
25ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png?resize=236%2C300&ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

2cbb8dfc4483c9ce680df342866531ac656e8bed029dcd37a1872327023da5f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-nc: HIT ams 6
date: Fri, 28 Feb 2020 20:55:13 GMT
x-content-type-options: nosniff
x-bytes-saved: 54471
last-modified: Sat, 08 Jun 2019 18:27:09 GMT
server: nginx
etag: "9b0a533bb91198de"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png>; rel="canonical"
content-length: 6390
expires: Tue, 08 Jun 2021 06:27:09 GMT

GET
H2 200 yoroi.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2017/06/ 6 KB
7 KB 31ms
31ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2017/06/yoroi.png?resize=300%2C286&ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

aecbb7494580f4902d9b6686614623951c0d599a7a21fe0f855491b0f52987a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-nc: HIT ams 3
date: Fri, 28 Feb 2020 20:55:13 GMT
x-content-type-options: nosniff
x-bytes-saved: 13492
last-modified: Mon, 04 Feb 2019 05:58:07 GMT
server: nginx
etag: "0f8e82c107049c26"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2017/06/yoroi.png>; rel="canonical"
content-length: 6494
expires: Wed, 03 Feb 2021 17:58:07 GMT

GET
H2 200 coronavirus-7.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/02/ 10 KB
11 KB 28ms
28ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/02/coronavirus-7.png?resize=300%2C300&ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i0.wp.com

Software

nginx /

Resource Hash

03093d2dae94f2cc640097a3c00fe0fc95ef47f37e8b12ee4d6eeb0ecad93d23

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-nc: HIT ams 2
date: Fri, 28 Feb 2020 20:55:13 GMT
x-content-type-options: nosniff
x-bytes-saved: 51853
last-modified: Thu, 27 Feb 2020 15:58:46 GMT
server: nginx
etag: "7d1488796f013fc6"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2020/02/coronavirus-7.png>; rel="canonical"
content-length: 10640
expires: Sun, 27 Feb 2022 03:58:46 GMT

GET
H/1.1 200
OK ssba.css
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/ 105 KB
105 KB 11ms
11ms Stylesheet
text/css 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/ssba.css?ver=70a115690565af9faf7a8d28f4104d24
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 8630a5e9b221470e4baf94299937bbe590b50a2f8340c7a16533cddf9288224b

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 02 Oct 2019 22:58:45 GMT
Server: Apache
ETag: "1a4c9-593f56942fc53"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 107721

GET
H/1.1 200
OK photon.js Show response
securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/ 2 KB
2 KB 12ms
12ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/photon.js?ver=20191001
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: c255d6cac869be47d929ac6aa30d708482b94258921f91d90e9740b7650354ba

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Sun, 23 Feb 2020 23:48:22 GMT
Server: Apache
ETag: "6da-59f46e3d4f5a7"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 1754

GET
H/1.1 200
OK jquery.adrotate.clicktracker.js Show response
securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/ 1 KB
1 KB 11ms
11ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/jquery.adrotate.clicktracker.js
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: ad86827a35f33f44cfb9a95286a520b728d4cf9a277e17a8e25239ec04edb04f

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 12 Feb 2020 22:18:21 GMT
Server: Apache
ETag: "416-59e6859a330a4"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 1046

GET
H/1.1 200
OK ssba.js Show response
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/ 2 KB
2 KB 10ms
10ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/ssba.js?ver=70a115690565af9faf7a8d28f4104d24
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 76a18f5f0637e0d73ce1afece898ce8b0fa75bb6b1c1990ae4a7ac6b083045ce

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 02 Oct 2019 22:58:45 GMT
Server: Apache
ETag: "792-593f569432b33"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 1938

GET
H/1.1 200
OK hint.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 987 B
1 KB 11ms
10ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/hint.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:17 GMT
Server: Apache
ETag: "3db-526fe6e433440"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 987

GET
H/1.1 200
OK jquery.tipsy.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 4 KB
5 KB 10ms
10ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.tipsy.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:17 GMT
Server: Apache
ETag: "1113-526fe6e433440"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 4371

GET
H/1.1 200
OK jquery.easing.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 8 KB
8 KB 11ms
10ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.easing.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:17 GMT
Server: Apache
ETag: "1fa1-526fe6e433440"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 8097

GET
H/1.1 200
OK browser.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 3 KB
3 KB 10ms
10ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/browser.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:16 GMT
Server: Apache
ETag: "a36-526fe6e33f200"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 2614

GET
H/1.1 200
OK jquery.flexslider-min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/ 21 KB
21 KB 10ms
10ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/jquery.flexslider-min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 13:55:10 GMT
Server: Apache
ETag: "53ae-5270441274b80"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 21422

GET
H/1.1 200
OK waypoints.min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 8 KB
8 KB 10ms
10ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/waypoints.min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:18 GMT
Server: Apache
ETag: "1f6c-526fe6e527680"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 8044

GET
H/1.1 200
OK mediaelement-and-player.min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/ 69 KB
70 KB 11ms
10ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/mediaelement-and-player.min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 13:55:14 GMT
Server: Apache
ETag: "11571-5270441645480"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 71025

GET
H/1.1 200
OK jquery.swipebox.min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 11 KB
11 KB 10ms
9ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.swipebox.min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:17 GMT
Server: Apache
ETag: "2a67-526fe6e433440"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 10855

GET
H/1.1 200
OK jquery.circliful.min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 3 KB
3 KB 11ms
11ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.circliful.min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:17 GMT
Server: Apache
ETag: "c18-526fe6e433440"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 3096

GET
H/1.1 200
OK jquery.smarticker.min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 13 KB
13 KB 10ms
10ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.smarticker.min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:17 GMT
Server: Apache
ETag: "3225-526fe6e433440"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 12837

GET
H/1.1 200
OK custom.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 12 KB
13 KB 11ms
10ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/custom.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:16 GMT
Server: Apache
ETag: "31d4-526fe6e33f200"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 12756

GET
H/1.1 200
OK wp-embed.js Show response
securityaffairs.co/wordpress/wp-includes/js/ 3 KB
3 KB 10ms
10ms Script
application/javascript 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-includes/js/wp-embed.js?ver=70a115690565af9faf7a8d28f4104d24
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: d931ba2089021a1357761939c18bcc09aa856d39be2a707ea450333f5b3443c4

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:12 GMT
Last-Modified: Thu, 21 Feb 2019 22:56:38 GMT
Server: Apache
ETag: "c8e-5826f6315ef61"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 3214

GET
H2 200 e-202009.js Show response
stats.wp.com/ 9 KB
3 KB 65ms
21ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202009.js
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 20:55:13 GMT
content-encoding: gzip
server: nginx
etag: W/"5c6340e3-350a"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
expires: Mon, 15 Feb 2021 23:27:58 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 389 KB
113 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=a7890c3ea02ed112c11702008829e911&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ba11dcc61e68732fda7216c2317e162c29e0982620ac3ee673c8a491bcba3c47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Origin: http://securityaffairs.co
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: s6CrcsJZq6VJwz/hiUAK4Q==
status: 200
date: Fri, 28 Feb 2020 20:55:13 GMT, Fri, 28 Feb 2020 20:55:13 GMT
expires: Sat, 27 Feb 2021 20:52:29 GMT
alt-svc: h3-24=":443"; ma=3600
content-length: 115313
x-fb-debug: uhdFZQVzxfTIKHhRImXirVbI3ns9zEGEGSaCVEvHzHHfptPYoJ9mIUbZJF/y5sWDAZmj0qCV1CG5O4L4f2e86Q==
x-fb-trip-id: 2047048586
x-fb-content-md5: bd96fea334f9d5ffb9eab987bbe092e3
etag: "672a47d96da14177390960a1f626991e"
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 5b71b64b04b9a500117b1015.js Show response
buttons-config.sharethis.com/js/ 30 B
374 B 7ms
7ms Script
text/javascript 2600:9000:2057:c200:c:abe:f440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://buttons-config.sharethis.com/js/5b71b64b04b9a500117b1015.js
Requested by: Host: platform-api.sharethis.com
URL: http://platform-api.sharethis.com/js/sharethis.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2057:c200:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 17:29:47 GMT
via: 1.1 7ce1191b390045e05b9cc74f7514b77b.cloudfront.net (CloudFront)
last-modified: Mon, 13 Aug 2018 16:48:12 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
etag: "e6e1643313740711175f51662a65b42f"
x-cache: Hit from cloudfront
content-type: text/javascript
status: 200
cache-control: max-age=60,public
accept-ranges: bytes
content-length: 30
x-amz-cf-id: xSIqDEf1rjDLlu7rO6fzR-Sox4pidBKDCWwcRT2kP-UmT3XvU2YJZA==

GET
H2 200 /
seguranca-informatica.pt/lampion-malware-v2-february-2020/embed/ Frame 4B91 0
0 1778ms
1778ms Document
text/html 2606:4700:3032::681b:bd6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://seguranca-informatica.pt/lampion-malware-v2-february-2020/embed/

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::681b:bd6c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/7.4.3

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: seguranca-informatica.pt
:scheme: https
:path: /lampion-malware-v2-february-2020/embed/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Response headers

status: 200
date: Fri, 28 Feb 2020 20:55:15 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d903e1a8fe82cf56dbdb357c6677687ed1582923313; expires=Sun, 29-Mar-20 20:55:13 GMT; path=/; domain=.seguranca-informatica.pt; HttpOnly; SameSite=Lax; Secure
x-powered-by: PHP/7.4.3
x-pingback: https://seguranca-informatica.pt/xmlrpc.php
link: <https://seguranca-informatica.pt/wp-json/>; rel="https://api.w.org/", <https://seguranca-informatica.pt/?p=6979>; rel=shortlink
x-wp-embed: true
vary: Accept-Encoding
referrer-policy
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 56c54c54f92f3240-FRA
content-encoding: br

GET
H2 200 /
seguranca-informatica.pt/lampion-malware-origin-servers-geolocated-in-turkey/embed/ Frame D374 0
0 1591ms
1590ms Document
text/html 2606:4700:3032::681b:bd6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://seguranca-informatica.pt/lampion-malware-origin-servers-geolocated-in-turkey/embed/

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::681b:bd6c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/7.4.3

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: seguranca-informatica.pt
:scheme: https
:path: /lampion-malware-origin-servers-geolocated-in-turkey/embed/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Response headers

status: 200
date: Fri, 28 Feb 2020 20:55:15 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d903e1a8fe82cf56dbdb357c6677687ed1582923313; expires=Sun, 29-Mar-20 20:55:13 GMT; path=/; domain=.seguranca-informatica.pt; HttpOnly; SameSite=Lax; Secure
x-powered-by: PHP/7.4.3
x-pingback: https://seguranca-informatica.pt/xmlrpc.php
link: <https://seguranca-informatica.pt/wp-json/>; rel="https://api.w.org/", <https://seguranca-informatica.pt/?p=7011>; rel=shortlink
x-wp-embed: true
vary: Accept-Encoding
referrer-policy
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 56c54c54f9313240-FRA
content-encoding: br

GET
H/1.1 200
OK TK3iWkUHHAIjg752GT8Gl-1PKw.woff2
fonts.gstatic.com/s/oswald/v30/ 25 KB
25 KB 11ms
5ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/oswald/v30/TK3iWkUHHAIjg752GT8Gl-1PKw.woff2

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e747521bc9729c30f06bda6471e77ad26ce0e05b104743e93fe14c8ef3b559a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://securityaffairs.co
Referer: http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=70a115690565af9faf7a8d28f4104d24
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 05 Feb 2020 00:23:24 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 04 Feb 2020 23:33:17 GMT
Server: sffe
Age: 2061109
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 25376
X-XSS-Protection: 0
Expires: Thu, 04 Feb 2021 00:23:24 GMT

GET
H/1.1 200
OK S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v16/ 14 KB
14 KB 11ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://securityaffairs.co
Referer: http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=70a115690565af9faf7a8d28f4104d24
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 22 Jan 2020 06:19:44 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 23 Jul 2019 03:45:55 GMT
Server: sffe
Age: 3249329
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 14044
X-XSS-Protection: 0
Expires: Thu, 21 Jan 2021 06:19:44 GMT

GET
H/1.1 200
OK fontawesome-webfont.woff
securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/ 43 KB
44 KB 12ms
11ms Font
application/font-woff 2001:8d8:100f:f000::289
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/fontawesome-webfont.woff?v=4.0.3
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache /
Resource Hash: 0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849

Request headers

Origin: http://securityaffairs.co
Referer: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:13 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:09 GMT
Server: Apache
ETag: "ad90-526fe6dc92240"
Content-Type: application/font-woff
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 44432

GET
H/1.1 200
OK nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgEM86xQ.woff2
fonts.gstatic.com/s/playfairdisplay/v20/ 32 KB
33 KB 12ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/playfairdisplay/v20/nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgEM86xQ.woff2

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb7d97eb19604573681684dfe0fef40692a943c29f59d11e7ba9eb39242e4e3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://securityaffairs.co
Referer: http://fonts.googleapis.com/css?family=Playfair+Display%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=70a115690565af9faf7a8d28f4104d24
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 05 Feb 2020 03:28:22 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 04 Feb 2020 22:41:36 GMT
Server: sffe
Age: 2050011
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 33256
X-XSS-Protection: 0
Expires: Thu, 04 Feb 2021 03:28:22 GMT

GET
H/1.1 200
OK S6u_w4BMUTPHjxsI5wq_Gwftx9897g.woff2
fonts.gstatic.com/s/lato/v16/ 14 KB
15 KB 12ms
7ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/lato/v16/S6u_w4BMUTPHjxsI5wq_Gwftx9897g.woff2

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f4eb73e4854117bf7bf9da7dc0c17740b03b5db6eb7ee6ffc20aeb35c1ea48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://securityaffairs.co
Referer: http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=70a115690565af9faf7a8d28f4104d24
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 24 Feb 2020 19:22:58 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 23 Jul 2019 03:45:44 GMT
Server: sffe
Age: 351135
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 14836
X-XSS-Protection: 0
Expires: Tue, 23 Feb 2021 19:22:58 GMT

GET
H/1.1 200
OK S6u8w4BMUTPHjxsAXC-qNiXg7Q.woff2
fonts.gstatic.com/s/lato/v16/ 15 KB
15 KB 11ms
5ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/lato/v16/S6u8w4BMUTPHjxsAXC-qNiXg7Q.woff2

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fe4bbdad1d6dff75cde79f8afc07f29502bd4708cb0ce5f552083c3d81ba8382

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://securityaffairs.co
Referer: http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=70a115690565af9faf7a8d28f4104d24
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 05 Feb 2020 04:41:03 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 23 Jul 2019 03:45:51 GMT
Server: sffe
Age: 2045650
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 14864
X-XSS-Protection: 0
Expires: Thu, 04 Feb 2021 04:41:03 GMT

GET
H/1.1 200
OK S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v16/ 14 KB
14 KB 12ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/lato/v16/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://securityaffairs.co
Referer: http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=70a115690565af9faf7a8d28f4104d24
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 00:20:02 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 23 Jul 2019 03:45:54 GMT
Server: sffe
Age: 333311
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 14176
X-XSS-Protection: 0
Expires: Wed, 24 Feb 2021 00:20:02 GMT

GET
H2 200 portal.html
c.sharethis.mgr.consensu.org/v1.0/cmp/ Frame 1278 0
0 8ms
7ms Document
text/html 2600:9000:214f:2000:c:a9b7:ddc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Requested by: Host: w.sharethis.com
URL: http://w.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:214f:2000:c:a9b7:ddc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: c.sharethis.mgr.consensu.org
:scheme: https
:path: /v1.0/cmp/portal.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Response headers

status: 200
content-type: text/html; charset=utf-8
edge-control: cache-maxage=60m,downstream-ttl=60m
accept-ranges: bytes
last-modified: Mon, 27 Jan 2020 20:26:17 GMT
content-encoding: gzip
date: Fri, 28 Feb 2020 20:47:54 GMT
cache-control: max-age=600, public
etag: W/"3802-16fe8aef228"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 269bfdd288bfea5423a4e9e701777da6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: uutxM6uFmauQpr1n7fldhimzEPczSI6TChL0Kf0f_HqQbxeB9liGMA==
age: 457

GET
H/1.1 200
OK browserfp.min.js Show response
pxlclnmdecom-a.akamaihd.net/javascripts/ 102 KB
32 KB 88ms
42ms Script
text/javascript 2.16.106.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU5BD6EW
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.106.193 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-106-193.deploy.static.akamaitechnologies.com
Software: / Express
Resource Hash: 201990824355061c17611846b716b0a15e2cedecd07ec6b90aaf2a7113eda5b0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Fri, 28 Feb 2020 20:55:13 GMT
Content-Encoding: gzip
X-Powered-By: Express
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Cache-Control: max-age=1800
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Content-Length: 32686
Expires: Fri, 28 Feb 2020 21:25:13 GMT

GET
H2 200 checksync.php
contextual.media.net/ Frame 0351 0
0 53ms
52ms Document
text/html 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HB41O6BH&prvid=80%2C82%2C97%2C109%2C148%2C175%2C178%2C192%2C193%2C3008&rtime=5&usp_status=0&usp_consent=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-253-103.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

:method: GET
:authority: contextual.media.net
:scheme: https
:path: /checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HB41O6BH&prvid=80%2C82%2C97%2C109%2C148%2C175%2C178%2C192%2C193%2C3008&rtime=5&usp_status=0&usp_consent=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Response headers

status: 200
server: Apache
content-type: text/html; charset=UTF-8
set-cookie: visitor-id=2259249137947826000V10; Expires=Sat, 27 Feb 2021 20:55:13 GMT; domain=.media.net; Path=/; sameSite=none; secure=true
x-mnet-hl2: E
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=28253
expires: Sat, 29 Feb 2020 04:46:06 GMT
date: Fri, 28 Feb 2020 20:55:13 GMT
content-length: 6949

GET
H2 200 sync Show response
gum.criteo.com/ 62 B
341 B 15ms
15ms Script
text/javascript 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?r=2&c=321&j=window.hbCMBidxc.mnetRtusId

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

949a74d5c9b30adeb638aed4ee5d24f5249c15761f8e82451fe0e9966a978324

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 20:55:12 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
status: 200
cache-control: private, max-age=3600
strict-transport-security: max-age=31536000
content-length: 177
expires: 60

GET
H2 200 rtbsmpubs.php Show response
contextual.media.net/ 5 KB
2 KB 349ms
349ms Script
text/javascript 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/rtbsmpubs.php?&gdpr=0&gdprconsent=1&usp_enf=1&usp_status=0&cid=8HB41O6BH&region=nv&ptrid=8PREB0781&requestString=170605770*4%7C300x250%7C8CU5BD6EW%7C762221962%40170605770*80%7C300x250%7C8CU5BD6EW%7C762221962%40170605770*109%7C300x250%7C8CU5BD6EW%7C762221962%40170605770*175%7C300x250%7C8CU5BD6EW%7C762221962%40170605770*178%7C300x250%7C8CU5BD6EW%7C762221962&crid=170605770&sd=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&bl=1&rt=5&dn=http://securityaffairs.co&https=0&act=headerBid&prvReqId=142982757051678711582923313516&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.8392064957993937&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1585%2C%22vh%22%3A1200%2C%22ph%22%3A8001%7D&itype=HB-CM&cc=CH&rc=ZH&ct=ZURICH&bt=1&isRefresh=0&callback=window.hbCMBidxc.rtbsheaderBid3S0

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-253-103.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e66106b9a3496eefb769d801bdff9ea5cc468c6e76015d560ce192ff3a555db2

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
date: Fri, 28 Feb 2020 20:55:13 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: max-age=0, no-cache, no-store
timing-allow-origin: *
content-length: 1512
x-mnet-hl2: E
expires: Fri, 28 Feb 2020 20:55:13 GMT

GET
H2 200 rtbsmpubs.php Show response
contextual.media.net/ 974 B
794 B 775ms
775ms Script
text/javascript 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/rtbsmpubs.php?&gdpr=0&gdprconsent=1&usp_enf=1&usp_status=0&cid=8HB41O6BH&region=nv&ptrid=8PREB0781&requestString=170605770*3008%7C1x1__1%7C8CU5BD6EW%7C762221962&crid=170605770&sd=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&bl=1&rt=5&dn=http://securityaffairs.co&https=0&act=headerBid&prvReqId=218750040284903561582923313530&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.03006191555515003&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1585%2C%22vh%22%3A1200%2C%22ph%22%3A8001%7D&itype=HB-CM&cc=CH&rc=ZH&ct=ZURICH&at=3&bt=1&callback=window.hbCMBidxc.rtbsnativeheaderBid3S0

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-253-103.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

65f006ace0216aee1b87fa240a933bd3e5251c38935540bd77871494301bb2d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
date: Fri, 28 Feb 2020 20:55:14 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: max-age=0, no-cache, no-store
timing-allow-origin: *
content-length: 584
x-mnet-hl2: E
expires: Fri, 28 Feb 2020 20:55:14 GMT

GET
H2 200 fcmdynet.js Show response
contextual.media.net/ Frame 5817 43 KB
16 KB 295ms
294ms Script
text/javascript 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/fcmdynet.js?&gdpr=0&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&size=300x250&cc=CH&https=1&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&nse=3&vi=1582923313107055206&lw=1&ugd=4&rtbs=1&hlt=1&dfp=1&ntv=1&nb=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-253-103.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

7f113eb1e51c742c3d9ac8a34e5f056bce7ec259e37aabe68b6dce50546f215c

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
x-mnt-hl2: 8-8
x-mnt-w: 12-19
vary: Accept-Encoding
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
status: 200
cache-control: max-age=300
date: Fri, 28 Feb 2020 20:55:13 GMT
content-type: text/javascript;charset=UTF-8
content-length: 15584
expires: Fri, 28 Feb 2020 21:00:13 GMT

GET
H/1.1 200
OK gpt.js Show response
www.googletagservices.com/tag/js/ Frame 2C69 43 KB
15 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

538923bc24457b182240d9535564c0037f89fbcf747e27f2d830768dc0b106ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:13 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: sffe
ETag: "442 / 64 of 1000 / last-modified: 1582920924"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: private, max-age=900, stale-while-revalidate=3600
Timing-Allow-Origin: *
Content-Length: 14499
X-XSS-Protection: 0
Expires: Fri, 28 Feb 2020 20:55:13 GMT

GET
H/1.1 200
OK videoAds.js Show response
adservetx.media.net/ 6 KB
3 KB 75ms
46ms Script
text/javascript 23.62.140.165
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://adservetx.media.net/videoAds.js?cid=8CU5BD6EW&crid=126440378&dn=securityaffairs.co
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol: HTTP/1.1
Server: 23.62.140.165 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-140-165.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 781fad3cdbe782cc6489deafdefa128bb3504fd6e3785337b8ac5ab209a6dc28

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:13 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=300
Connection: keep-alive
Content-Length: 2717
Expires: Fri, 28 Feb 2020 21:00:13 GMT

GET
H2 200 bping.php
lg3.media.net/ 35 B
177 B 36ms
34ms Image
image/gif 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lg3.media.net/bping.php?&gdpr=0&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=762221962&vi=1582923313107055206&ugd=4&lf=6&cc=CH&sc=ZH&wsip=2886781337&r=1582923313491&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_uspa=0&hvsid=00001582923313487031043794781784&gdpr=0
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-253-103.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:13 GMT
server: Apache
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 28 Feb 2020 20:55:13 GMT

GET
H2 200 rtbsmpubs.php Show response
contextual.media.net/ 5 KB
2 KB 318ms
317ms Script
text/javascript 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/rtbsmpubs.php?&gdpr=0&gdprconsent=1&usp_enf=1&usp_status=0&cid=8HB41O6BH&region=nv&ptrid=8PREB0781&requestString=512365842*9%7C300x250%7C8CU5BD6EW%7C184323154%40512365842*80%7C300x250%7C8CU5BD6EW%7C184323154%40512365842*109%7C300x250%7C8CU5BD6EW%7C184323154%40512365842*175%7C300x250%7C8CU5BD6EW%7C184323154%40512365842*178%7C300x250%7C8CU5BD6EW%7C184323154&crid=512365842&sd=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&bl=1&rt=5&dn=http://securityaffairs.co&https=0&act=headerBid&prvReqId=388560266715750631582923313545&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.7386179895731948&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1585%2C%22vh%22%3A1200%2C%22ph%22%3A8025%7D&itype=HB-CM&cc=CH&rc=ZH&ct=ZURICH&bt=1&isRefresh=0&callback=window.hbCMBidxc.rtbsheaderBid4S0

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-253-103.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

02c4b43857c2616180338c2ad7a4549e6cdaa2bb25494feb679f2e6ee9f939c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
date: Fri, 28 Feb 2020 20:55:13 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: max-age=0, no-cache, no-store
timing-allow-origin: *
content-length: 1466
x-mnet-hl2: E
expires: Fri, 28 Feb 2020 20:55:13 GMT

GET
H2 200 rtbsmpubs.php Show response
contextual.media.net/ 974 B
793 B 303ms
302ms Script
text/javascript 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/rtbsmpubs.php?&gdpr=0&gdprconsent=1&usp_enf=1&usp_status=0&cid=8HB41O6BH&region=nv&ptrid=8PREB0781&requestString=512365842*3008%7C1x1__1%7C8CU5BD6EW%7C184323154&crid=512365842&sd=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&bl=1&rt=5&dn=http://securityaffairs.co&https=0&act=headerBid&prvReqId=241392680459321551582923313546&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.7509016809321865&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1585%2C%22vh%22%3A1200%2C%22ph%22%3A8025%7D&itype=HB-CM&cc=CH&rc=ZH&ct=ZURICH&at=3&bt=1&callback=window.hbCMBidxc.rtbsnativeheaderBid4S0

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-253-103.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

307b097506408393263fd8f0c6b50d9766e038d0dae73e8c8d49ced5cd2a8ded

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
date: Fri, 28 Feb 2020 20:55:13 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: max-age=0, no-cache, no-store
timing-allow-origin: *
content-length: 583
x-mnet-hl2: E
expires: Fri, 28 Feb 2020 20:55:13 GMT

GET
H2 200 fcmdynet.js Show response
contextual.media.net/ Frame EC47 43 KB
15 KB 300ms
299ms Script
text/javascript 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/fcmdynet.js?&gdpr=0&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=CH&https=1&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&nse=3&vi=1582923313425037551&lw=1&ugd=4&rtbs=1&ntv=1&nb=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-253-103.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0dd9397a0686d401ff156f472666ecd330cb16abff47d5429eec94dc382b476c

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
x-mnt-hl2: 8-8
x-mnt-w: 12-13
vary: Accept-Encoding
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
status: 200
cache-control: max-age=300
date: Fri, 28 Feb 2020 20:55:13 GMT
content-type: text/javascript;charset=UTF-8
content-length: 15453
expires: Fri, 28 Feb 2020 21:00:13 GMT

GET
H2 200 bping.php
lg3.media.net/ 35 B
177 B 32ms
32ms Image
image/gif 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lg3.media.net/bping.php?&gdpr=0&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&vi=1582923313425037551&ugd=4&lf=6&cc=CH&sc=ZH&wsip=2886781337&r=1582923313543&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_uspa=0&hvsid=00001582923313542031043794788783&gdpr=0
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-253-103.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:13 GMT
server: Apache
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 28 Feb 2020 20:55:13 GMT

GET
H2 200 fcmdynet.js Show response
contextual.media.net/ Frame 0F44 43 KB
16 KB 303ms
303ms Script
text/javascript 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/fcmdynet.js?&gdpr=0&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&size=300x600&cc=CH&https=1&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&nse=3&vi=1582923313678722137&lw=1&ugd=4&rtbs=1&hlt=1&dfp=1&ntv=1&nb=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-253-103.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

803cacdc49e9d5149b9ba435022e87f412d10a80337353314d1c5068411ee28a

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
x-mnt-hl2: 8-8
x-mnt-w: 12-13
vary: Accept-Encoding
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
status: 200
cache-control: max-age=300
date: Fri, 28 Feb 2020 20:55:13 GMT
content-type: text/javascript;charset=UTF-8
content-length: 15611
expires: Fri, 28 Feb 2020 21:00:13 GMT

GET
H/1.1 200
OK gpt.js Show response
www.googletagservices.com/tag/js/ Frame 2B93 43 KB
15 KB 45ms
39ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b1040b4870a9503a2b7e81f781ed65e43f668bab13ee4ac0199a040d75d3728c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:13 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: sffe
ETag: "442 / 184 of 1000 / last-modified: 1582920970"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: private, max-age=900, stale-while-revalidate=3600
Timing-Allow-Origin: *
Content-Length: 14499
X-XSS-Protection: 0
Expires: Fri, 28 Feb 2020 20:55:13 GMT

GET
H2 200 bping.php
lg3.media.net/ 35 B
177 B 34ms
33ms Image
image/gif 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lg3.media.net/bping.php?&gdpr=0&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=639665355&vi=1582923313678722137&ugd=4&lf=6&cc=CH&sc=ZH&wsip=2886781337&r=1582923313555&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_uspa=0&hvsid=00001582923313553031043794782070&gdpr=0
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-253-103.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:13 GMT
server: Apache
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 28 Feb 2020 20:55:13 GMT

GET
H/1.1 200
OK ieVj2ZhZI2eCN5jzbjEETS9weq8-19eLDwM9QPFUew.woff2
fonts.gstatic.com/s/robotocondensed/v18/ 12 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/robotocondensed/v18/ieVj2ZhZI2eCN5jzbjEETS9weq8-19eLDwM9QPFUew.woff2

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e58e3184f269e1dbd8e247942242824cf71d306b91b66841f9e119c6af572115

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://securityaffairs.co
Referer: http://fonts.googleapis.com/css?family=Roboto+Condensed%3A400italic%2C700italic%2C400%2C700&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Cgreek%2Ccyrillic%2Clatin-ext%2Cvietnamese&ver=70a115690565af9faf7a8d28f4104d24
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 24 Feb 2020 20:35:11 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 23 Jul 2019 03:48:08 GMT
Server: sffe
Age: 346802
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 12660
X-XSS-Protection: 0
Expires: Tue, 23 Feb 2021 20:35:11 GMT

GET

/
securityaffairs.co/wordpress/
Redirect Chain

https://securityaffairs.co/wordpress?ga_action=googleanalytics_get_script
https://securityaffairs.co/wordpress/?ga_action=googleanalytics_get_script

0
0

GET
H/1.1 200
OK g.gif
pixel.wp.com/ 50 B
215 B 52ms
36ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pixel.wp.com/g.gif?v=ext&j=1%3A8.2.3&blog=29506073&post=98597&tz=0&srv=securityaffairs.co&host=securityaffairs.co&ref=&fcp=806&rand=0.9830891622137317
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:13 GMT
Cache-Control: no-cache
Server: nginx
Connection: keep-alive
Content-Length: 50
Content-Type: image/gif

GET
H/1.1

301
Moved Permanently

sc Show response
l.sharethis.com/
Redirect Chain

https://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&fpc=6f69f6a-1708d94f112-73a0af9d-1&sessionID=1582923313426.32724&hostname=securityaffairs.co&location=%2Fwordpress%2F98597%2...
https://l.sharethis.com/sc?cm=CicACl5ZfjEAAAASGw0mAw%3D%3D&uid=true&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&publisher=4d48b7c5-0ae3-43d4-bfbe...

0
-1 B

81ms
20ms

XHR
text/html

18.195.176.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://l.sharethis.com/sc?cm=CicACl5ZfjEAAAASGw0mAw%3D%3D&uid=true&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&sop=false
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.176.77 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-176-77.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:13 GMT
Location: /sc?cm=CicACl5ZfjEAAAASGw0mAw%3D%3D&uid=true&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&sop=false
P3p: policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Access-Control-Max-Age: 1728000
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: http://securityaffairs.co
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Access-Control-Allow-Headers: *
Content-Length: 248
Stid: CicACl5ZfjEAAAASGw0mAw==

Redirect headers

Date: Fri, 28 Feb 2020 20:55:13 GMT
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: http://securityaffairs.co
Access-Control-Max-Age: 1728000
P3p: policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Location: /sc?cm=CicACl5ZfjEAAAASGw0mAw%3D%3D&uid=true&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&sop=false
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Access-Control-Allow-Headers: *
Content-Length: 248
Stid: CicACl5ZfjEAAAASGw0mAw==

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 2C69 109 B
171 B 16ms
15ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co

Requested by

Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 20:55:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 2C69 109 B
171 B 16ms
15ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co

Requested by

Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 20:55:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2020022401.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 2C69 167 KB
61 KB 29ms
28ms Script
text/javascript 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022401.js

Requested by

Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

sffe /

Resource Hash

6d941ee14efe29bc4859114b4d6c93bd58d9843249a4e9d7603d6f80edb4eadf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 20:55:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 24 Feb 2020 14:08:08 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 62028
x-xss-protection: 0
expires: Fri, 28 Feb 2020 20:55:13 GMT

GET
H/1.1 200
OK bfp_ssn.js
pxlclnmdecom-a.akamaihd.net/javascripts/ Frame 9CBB 0
0 22ms
22ms Document
text/html 2.16.106.193
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/bfp_ssn.js?templateId=3
Requested by: Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU5BD6EW
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.106.193 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-106-193.deploy.static.akamaitechnologies.com
Software: / Express
Resource Hash

Request headers

Host: pxlclnmdecom-a.akamaihd.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Response headers

Content-Type: text/html; charset=utf-8
X-Powered-By: Express
Vary: Accept-Encoding
Access-Control-Max-Age: 1800
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Cache-Control: max-age=1800
Expires: Fri, 28 Feb 2020 21:25:13 GMT
Date: Fri, 28 Feb 2020 20:55:13 GMT
Content-Length: 3752
Connection: keep-alive

POST
H/1.1 200
OK ptmdP
dt.clnmde.com/ 7 B
467 B 236ms
212ms Other
text/html 52.20.172.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: http://dt.clnmde.com/ptmdP
Requested by: Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU5BD6EW
Protocol: HTTP/1.1
Server: 52.20.172.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-172-27.compute-1.amazonaws.com
Software: / Express
Resource Hash: aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Origin: http://securityaffairs.co
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Fri, 28 Feb 2020 20:55:13 GMT
ETag: W/"7-Jgyp3YpFd/wAt71YECmAdg"
X-Powered-By: Express
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Content-Length: 7

GET
H/1.1 200
OK cenw.js Show response
dt.clnmde.com/ 36 B
498 B 233ms
220ms XHR
text/html 52.20.172.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: http://dt.clnmde.com/cenw.js?identifier=bafp
Requested by: Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU5BD6EW
Protocol: HTTP/1.1
Server: 52.20.172.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-172-27.compute-1.amazonaws.com
Software: / Express
Resource Hash: 2189cc89b469101dbc2148cc58c8829f56c94fa94fab7fb7244af11c99c58974

Request headers

Origin: http://securityaffairs.co
Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:13 GMT
Vary: Accept-Encoding
X-Powered-By: Express
ETag: W/"24-IFWryBIk+z5cfj7/J+f44Q"
Access-Control-Max-Age: 1800
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Content-Length: 36

GET
H/1.1 200
OK ptmd
dt.clnmde.com/ 70 B
476 B 218ms
214ms Image
image/gif 52.20.172.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://dt.clnmde.com/ptmd?t=158292331369331360191035_N4IgtgniBcDasEYA0BOA7AZiQgTJpALAlgGwkYC6FSIA7gI4yzXgQBOTLAxm2AA5MQCABwEMODAgCsBAPoATCLIQgWAQwA2AFyYAGFgGcA9jGQguXABYBrQeRRkpGKVJA0RYidIJuQaEjiBCA44qjR8AJbyOnAgur7xNPEsbACmAGYAqmzagr75hmxc2bmxllpafACkGACCVTgAYg2NBqlcAK5sEVoQaunpahFsBgB0XEYttEZs8nxpBgYtKMJS6C1gmrRqaS0aavwRRgB2ALSbGttppzMRAOYRx6PlYBq+5ZU19U0tbZ3dvX6g2GYwmUxmcwWSyaKzWaA2Wx2qT2B0iJ3OiOutweTxebxoH2qdRav3aXR6fQGQxG40mTWms3mqUWy1W6yaFyuyKa+0O6M5SJu3Rxzy0rzCIAAbgZZFEYrBjh0NBokIrlaqlRoWJZpbLooJdIbdNJhDgUBJJM4nLpJLoxGgUAQ0KbdGhEnEjSazRbiDIcDaEHaMA6ncJhM6MAlPVJTeaMJaCOGA0GQ86EM6fNwOgYtHr5SBhABhTJSABCABESABRADqviLJYr1brNAbZcrtYlPElgmAAB0QPZHFaB9B+yBenxUqOBzw9QOkAPJRF5zAB1645aSM60EFgwuBzqZVEZx7DRufVaMMn7Y7nf63QOAL5P3zjjziSQyUfjyfTtfmGwq6LlKK4ngBF7xsQBA4FINpoC4CAHiAR6rtAA5GsaMbelBzgwTewZ3mGEbPq+hhaGoWjZkwWAEEg8b0XRzj0SQ9FoPRwj0SghD0VgGBMVILFsRxXE8Qx-H0YJGCscGHEsAAXmopjhHcMBSr4qTHD20AgAINB3JYamQVuKC4SQxooIGzi+FoBhGTBKyugQAQuMIvjSmpJCjLooziG5NCaDAWAgOkXAwKcZipEpOkYFwJAIOkABGqS6KcUhqAgXARQgUWnMIahOnlzpqKkOCJYMgypBpWgRKY2GbsQNA5qp0C6E1tg6cZxCyEQDjpteTrmRpEQCJ1qyjCgowiKMwgkL4HS1a1NCpJKbxwIYGg5kZ9WXiQYa+Bo6TKaBerbbGl6Bm6Lj+nNNCdDmp06W2TadvpYXQF1waBDQ9BVR9NDpItOBPkAA
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 52.20.172.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-172-27.compute-1.amazonaws.com
Software: / Express
Resource Hash: c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:13 GMT
X-Powered-By: Express
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 2B93 109 B
171 B 20ms
20ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co

Requested by

Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 20:55:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 2B93 109 B
171 B 19ms
19ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co

Requested by

Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 20:55:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2020022401.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 2B93 167 KB
61 KB 28ms
28ms Script
text/javascript 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022401.js?21065618

Requested by

Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

sffe /

Resource Hash

6d941ee14efe29bc4859114b4d6c93bd58d9843249a4e9d7603d6f80edb4eadf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 20:55:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 24 Feb 2020 14:08:08 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 62028
x-xss-protection: 0
expires: Fri, 28 Feb 2020 20:55:13 GMT

GET
H/1.1 200
OK log
qsearch.media.net/ 35 B
329 B 317ms
292ms Image
image/gif 2.16.186.67
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qsearch.media.net/log?logid=kfk&evtid=videoerror&cid=8CU5BD6EW&crid=null&dn=securityaffairs.co&REASON=33&ACTION=0&visitorId=2251157123040127000V10&dc=2&adtagId=126440378&bidder_id=99999&biddertagid=99999&bsr=Chrome_74&dt=desktop&os=MAC&id=00001582923313735006644304912833&purl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 2.16.186.67 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-67.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.25.v20191220) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 28 Feb 2020 20:55:14 GMT
Server: Jetty(9.4.25.v20191220)
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Fri, 28 Feb 2020 20:55:14 GMT

GET
H/1.1 200
OK sc Show response
l.sharethis.com/ 51 B
508 B 21ms
20ms XHR
text/plain 18.195.176.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://l.sharethis.com/sc?cm=CicACl5ZfjEAAAASGw0mAw%3D%3D&uid=true&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&sop=false
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.176.77 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-176-77.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e8851506f48f39b8e4aac07e674557a28ae7147b4f9f0c9c96c47cf3a6538324

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Origin: http://securityaffairs.co
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:13 GMT
Access-Control-Max-Age: 1728000
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: http://securityaffairs.co
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Access-Control-Allow-Headers: *
Content-Length: 51
Stid: CicACl5ZfjEAAAASGw0mAw==

GET
H2 200 nrrV92300.js Show response
contextual.media.net/ Frame 5817 81 KB
25 KB 43ms
42ms Script
text/javascript 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/nrrV92300.js

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/fcmdynet.js?&gdpr=0&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&size=300x250&cc=CH&https=1&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&nse=3&vi=1582923313107055206&lw=1&ugd=4&rtbs=1&hlt=1&dfp=1&ntv=1&nb=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-253-103.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e8cece7fcc8e81f27384afe1eefd48bce89a20bc8c73ef16f8d743a731b7f8d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: max-age=2592000
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
date: Fri, 28 Feb 2020 20:55:13 GMT
vary: Accept-Encoding
x-mnet-h: 8-3
content-type: text/javascript; charset=utf-8
status: 200
cache-control: max-age=1209600
content-length: 25696
expires: Fri, 13 Mar 2020 20:55:13 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 2B93 51 KB
11 KB 330ms
330ms XHR
text/plain 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2586425520590215&correlator=1005528499074145&output=ldjh&impl=fif&adsid=NT&eid=21065618%2C21065203&vrg=2020022401&guci=1.2.0.0.2.2.0.0&sc=0&sfv=1-0-37&ecs=20200228&iu_parts=45361917%2C8CU5BD6EW-639665355-Skyscraper_post_yahoo_300_x_600&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&prev_scp=crid%3D639665355%26mnet_variant%3D98%26pub_domain%3Dsecurityaffairs.co%26mnet_cc%3DCH%26mnet_bucketid%3Da2%26mnet_dfp_ol%3D1%26mnet_nat_tpid%3D801835331%26PubMaticSS%3D1610%26RubiconSS%3D2209%26fp%3Dqcqq&eri=4&cookie_enabled=1&bc=23&abxe=1&lmt=1582923313&dt=1582923313925&dlt=1582923313560&idt=244&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=600&oid=3&adxs=973&adys=1639&adks=2499085226&ucis=3dstozzhdlf6&ifi=1&ifk=3496779993&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&top=securityaffairs.co&dssz=5&icsg=170&std=0&vis=1&scr_x=0&scr_y=0&ga_vid=539159860.1582923314&ga_sid=1582923314&ga_hid=1383005756&fws=256&ohw=0&btvi=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022401.js?21065618

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

cafe /

Resource Hash

c971758a62027de3832dbb2a77d7b0d93b80ecce12e1c9acb0ebeba7884dc9d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Origin: http://securityaffairs.co
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 28 Feb 2020 20:55:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 11304
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://securityaffairs.co
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2020022401.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 2B93 66 KB
24 KB 30ms
30ms Script
text/javascript 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020022401.js?21065618

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022401.js?21065618

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

sffe /

Resource Hash

816709e9295a4116a9f1648dcdca148a141e0ee263887b39f474a923380e4310

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 20:55:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 24 Feb 2020 14:08:08 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 24743
x-xss-protection: 0
expires: Fri, 28 Feb 2020 20:55:13 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 2B93 0
0 6ms
6ms Other
text/html 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022401.js?21065618
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

GET
H2 200 mediamain.html Show response
contextual.media.net/ Frame 44E1 65 KB
15 KB 365ms
365ms Script
text/javascript 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&pid=8PO5M70HK&size=300x600&cpnet=yVb1sHm-0KIh29BOFTjjrOMbY3Wy7OSYfNFL7sC0vVY%3D&cme=auTgd-6jz2Z4bACDRdo45ZvP7JuGgYF5kBoI5_LcBkDhTKAaIXOYkys-W_SyGzGBJLaCGEHs_r9k7CrDwoOBfNjkZQKK0rF8wWuaZjQgrRupjr0yzVqrCOf03Reqgj-5jz09YE71aOA%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CygJDWuih5otg1sflNsIQ2jvfmNfrbgWtJjawETPEjASZd4dsrgrjJfTOlR1z96K-hwAeciOmbKapm7nSzYkvlps85OI6MMeY1_I0syMjHj8%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=CH&bf=0&staticIframe=1&vif=1&nse=3&vi=1582923313678722137&lw=1&ugd=4&ib=0&bid=265598&katid=801835331&katbid=-21&katen=1&nb=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-253-103.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

002782949268e48866cb4d2aafbee3c58811263aeb4a67c9cced26628bf686be

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
date: Fri, 28 Feb 2020 20:55:14 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
x-mnt-hl3: 8-20
cache-control: max-age=300
x-mnt-w: 12-31
content-length: 14760
expires: Fri, 28 Feb 2020 21:00:14 GMT

GET
H/1.1 200
OK ptmd
dt.clnmde.com/ 70 B
476 B 114ms
114ms Image
image/gif 52.20.172.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://dt.clnmde.com/ptmd?t=158292331369331360191035_N4IgxgTgbiBcDaJgB0QDYDMBONaCsGeeqsKIALgJ4AOApiapAPoCWAJqgDSpQusdxUARjwAOAExZxGDEIxoA7KIXjxchV1QALKAGd+DEAAYTRkRKky5RDEdlGALBgVYHS8UYVHUAXx8hOJGFRJ2kRBxIyKjpDZnZNEF4DQRBzSWlZDAdxPDsFIiEEnX14lNMzMXSrQmy7IUdnVyVlUQxff0CyBTRVNRxxSNRo+hS4gW5EvlLYYUrLTPqvIg80Ir1kmeNTNPm5B2U6hpc3USElCJA-EABdQIA7AEM4eGzXHBU0B049owPsTgIJhCrSMtxAj10cEkgRYDwAts9QTCHpDYKJAgAPABmcBAWXEojQWIeWAetCwACMcrQ0A82EYwBhaA4KUJaIy2OJaKIAiBseRcQp6lhHBT7C5RKJclg2EJxBSHEY2LQhGAsaIHmA0Lzic9Fs4HA4cEZODhOCaLearZabdbrWDiai0IEtFpnngFADRA6cbAhIEAK4BuDhQJYmCwEC8gDWT0jMtltDYIoAtHgHmgwCmhGyHimKVKsPmiMSNbQFLQsdrAtGKSHAmAI0EQLpaLpdCwAPZ3Ji6cidiAPADmI02CbZyaMaYzWZztDzBbwRYpJYeZYrVYSYE7nejLFoTDYD3ID0M46TqfTmezufzheLeFLZI3q0uvKH5F98FtNrBH9R352v6Fpgn2AE-vagTsuQCKRoaDi8nClDPPA-pYAoGDfOIGGcA4cicLgGC3PA4i4Wg6LdOiPR2ARDgEMRmHoZhco4UInwmqoirXGCADuACOzxgkhECCQ2EBwtQzypCEGBhHgDiHpQTBCLy3S9EI-RMEO1DkEw4i8pgOD4IQeBaTpTAYDcgQPAANgKCC5CajmgZ2cCYSALARkYAB0eCBH2x4BgB-zQrYnA5KanCYcxWBggAXnG-ogNQQ64jAUF3E2kmBEObqRjsGRyGgWDVGgZhYPUhC8uQqKpK8oieA4PREDygR6LiaDeT5smtSAtluWGYBwNmUFxniWpCFiFK0FO6aqje84phqbhLUoZLysSxK0LytDkCwIZzIV7l9qlsAmi20a4gV1RMHhOBnLYbhlTtLCSflUreVg3lCKI3mEryAb7WdUFQDZoktjZfZXYdpWSryNm+klSTsNDFhHYsRjLEY1bgEFuko5GogAMIAKp4AAQgAImgACiADq75DX6MOyNkbGBHx21+mGQMYD4QA
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: HTTP/1.1
Server: 52.20.172.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-172-27.compute-1.amazonaws.com
Software: / Express
Resource Hash: c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:14 GMT
X-Powered-By: Express
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T

GET
H2 200 amp4ads-host-v0.js Show response
cdn.ampproject.org/rtv/012002141856310/ Frame 2B93 20 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012002141856310/amp4ads-host-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022401.js?21065618

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b449cc316af17efa8352b185ba13ea36eca7b1c23037ecd05f14587c264e55b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14565
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7146
x-xss-protection: 0
server: sffe
date: Fri, 28 Feb 2020 16:52:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "b84407683e78f245"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 27 Feb 2021 16:52:29 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012002141856310/ Frame 4570 202 KB
55 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012002141856310/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020022401.js?21065618

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7cfeb2796d608a88410160f76bdd0456b3fcf362859589f7eb300b3a069635c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 26946
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 56116
x-xss-protection: 0
server: sffe
date: Fri, 28 Feb 2020 13:26:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "c310832256213cf1"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 27 Feb 2021 13:26:08 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012002141856310/v0/ Frame 4570 16 KB
6 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012002141856310/v0/amp-ad-exit-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020022401.js?21065618

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd606c728926a263166056197042ce45cc41b5440fa22ca24974b8da1e69b7d7

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 42602
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5731
x-xss-protection: 0
server: sffe
date: Fri, 28 Feb 2020 09:05:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "3c28451551a1eabd"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 27 Feb 2021 09:05:12 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012002141856310/v0/ Frame 4570 92 KB
28 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012002141856310/v0/amp-analytics-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020022401.js?21065618

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb898cdafe2cf6e08984c5375be09414655e63de26bfd2718d817710530722b2

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 26946
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28124
x-xss-protection: 0
server: sffe
date: Fri, 28 Feb 2020 13:26:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "750e538d33767fef"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 27 Feb 2021 13:26:08 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012002141856310/v0/ Frame 4570 3 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012002141856310/v0/amp-fit-text-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020022401.js?21065618

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8dae82c0959e2310509fc13b3bbaf6dd840239a2ef42a08375972c878034d92e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 42602
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1402
x-xss-protection: 0
server: sffe
date: Fri, 28 Feb 2020 09:05:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "aa9f121905c9d577"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 27 Feb 2021 09:05:12 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012002141856310/v0/ Frame 4570 46 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012002141856310/v0/amp-form-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020022401.js?21065618

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf2925f057f8266b2d5d84d2dd756c81940f3eef3224d507e4ef677e7181449f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 42601
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14831
x-xss-protection: 0
server: sffe
date: Fri, 28 Feb 2020 09:05:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "dc5fe1b94f9b2335"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 27 Feb 2021 09:05:13 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 4570 2 KB
661 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:815::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300&lang=en

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020022401.js?21065618

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ccffa5096e12764aa6c84137becb13f6951fa531fcf9e56c93317d77de118fd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 28 Feb 2020 20:55:14 GMT
server: ESF
date: Fri, 28 Feb 2020 20:55:14 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 28 Feb 2020 20:55:14 GMT

GET
DATA 200
OK truncated
/ Frame 4570 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3e5186ceaad1e4f5f0627d547c83b641503b28a5470d7457b40d3b82a1e7642b

Request headers

Referer: http://securityaffairs.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/2158786882657645658/ Frame 4570 7 KB
7 KB 9ms
9ms Image
image/jpeg 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2158786882657645658/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoInAIQlQEYASABLQAAAD8wnAI4lQFFAACAPw&rs=AOga4qkrMelfasPdR_xoXxILVYiFJIP6eg

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13f98e653f58cdacef8abf079910259b7cccebe94e4898d57bb700c35c2054a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 20:46:09 GMT
x-content-type-options: nosniff
last-modified: Fri, 22 Feb 2019 17:15:29 GMT
server: sffe
age: 545
content-type: image/jpeg
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 7377
x-xss-protection: 0
expires: Sat, 27 Feb 2021 20:46:09 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/13256797330833292739/ Frame 4570 8 KB
8 KB 9ms
8ms Image
image/png 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13256797330833292739/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qmAyS_2N6i6WVRJrhVZWLJKSmNoHw

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

623ba67fdee04abb38857d8cb22124da662ae2d95d1ce5033a4df0ddcd444031

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 30 Jan 2020 07:48:53 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 17:36:44 GMT
server: sffe
age: 2552781
content-type: image/png
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 8473
x-xss-protection: 0
expires: Fri, 29 Jan 2021 07:48:53 GMT

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 4570 0
0 33ms
32ms Image
text/html 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CpKMzMX5ZXsG1O5DwgAfMnq_wDvDf6uxb88WssqcKwI23ARABINCWmBxguwagAY-Us5cDyAEG4AIAqAMByAMKqgSPAk_QEmvFyHmN0RNe4oYS1EYA45wnycax878Kvc0R1aZumtCSKQpe7t5eqX8n1oklYXzKyxMQw8YgkEHUgS_5BSNExi8VT56KSnLA0rYLva32x3tgR17Q2_R6fqAx4EbmaDRHjCj3zlzZ929Q85vMjpvz2hrGrE-RehHfnWe82791Ibuu8-JBNtqn16ZJM_INQr03pTqlDCZQ9Hwiq1YBZkacjsk1UfuTeoymYzb1jpb_-tUSYgf6XbJMz6yVnMZYJ7VZ3LaygVcHSPZVqO-MiV2UBSW1sDzVrQiu-YgyyAeDq-AEPMiz_vAkruZyUWFwzFwzoBmZsfBdF-8XwsHslSB605l2YxSA3KmZlfMSnbjABKvyqYOmAuAEAZIFBAgEGAGSBQQIBRgEoAY3gAfZ68xoqAeOzhuoB9XJG6gHk9gbqAe6BqgH8NkbqAfy2RuoB6a-G6gH7NUb2AcB8gcDEOBd0ggJCIDhgHAQARgd8ggbYWR4LXN1YnN5bi03MjQzMzUyNDM5MTAyNTUzgAoDyAsB2BMM&sigh=cL5lcdP7mZk&template_id=492&tpd=AGWhJmsGXiyXw5O2U0Fau9242UG5lC3S2djBBggkhSWhn0DF0w
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s20-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://securityaffairs.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 4570 2 KB
3 KB 7ms
7ms Image
image/png 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 11:08:58 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 35176
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sat, 29 Feb 2020 11:08:58 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 4570 295 B
367 B 6ms
6ms Image
image/png 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 12:55:21 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 28793
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sat, 29 Feb 2020 12:55:21 GMT

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 4570
Redirect Chain

http://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

16ms
15ms

Image
text/html

2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

Date: Fri, 28 Feb 2020 20:55:14 GMT
X-Content-Type-Options: nosniff
Server: safe
Content-Type: text/html; charset=UTF-8
Location: https://googleads.g.doubleclick.net/pagead/drt/si
Cache-Control: private
Content-Length: 246
X-XSS-Protection: 0

GET
H2 200 rtblog.php
lg3.media.net/ 35 B
177 B 30ms
30ms Image
image/gif 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lg3.media.net/rtblog.php?&gdpr=0&vgd_sc=ZH&vgd_hbReqId=T1582921750C8S36U85&vgd_uspa=0&vgd_isiolc=1&l3ch=4&cc=CH&vgd_implt=0&movlimp=0&vgd_dfp_tgt={%22crid%22:%22639665355%22,%22mnet_variant%22:%2298%22,%22pub_domain%22:%22securityaffairs.co%22,%22mnet_cc%22:%22CH%22,%22mnet_bucketid%22:%22a2%22,%22mnet_dfp_ol%22:1,%22mnet_nat_tpid%22:%22801835331%22,%22PubMaticSS%22:%221610%22,%22RubiconSS%22:%222209%22}&vgd_scr_h=1200&vgd_scr_w=1600&vgd_optout=0&vgd_is_amp=0&vgd_rensize=300_600&vgd_l2wsip=2886940479&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=639665355&pid=8PO4A4J48&size=300x600&vi=1582923313678722137&ugd=4&bdrid=153&subBdr=98&bdrct=0.02&adx=1&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&vgd_crefurl=undefined&vgd_dfpnc=0&vgd_refadx=14&vgd_demp=0&vgd_refcnf={%22a2y%22:{%22afterLoadSecs%22:30,%22afterViewSecs%22:10,%22percentTraffic%22:95,%22ignoreSessionDisable%22:true,%22both%22:false}}&rtbsd=10&bto=13&vgd_rt=0&vgd_l1ch=1&vgd_l2ch=0&pti=41&https=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&hvsid=00001582923313553031043794782070&gdpr=0
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-253-103.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:14 GMT
server: Apache
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 28 Feb 2020 20:55:14 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/2158786882657645658/ Frame 4570 7 KB
7 KB 6ms
5ms Image
image/jpeg 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002141856310/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13f98e653f58cdacef8abf079910259b7cccebe94e4898d57bb700c35c2054a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 20:46:09 GMT
x-content-type-options: nosniff
last-modified: Fri, 22 Feb 2019 17:15:29 GMT
server: sffe
age: 545
content-type: image/jpeg
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 7377
x-xss-protection: 0
expires: Sat, 27 Feb 2021 20:46:09 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/13256797330833292739/ Frame 4570 8 KB
8 KB 8ms
8ms Image
image/png 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002141856310/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

623ba67fdee04abb38857d8cb22124da662ae2d95d1ce5033a4df0ddcd444031

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 30 Jan 2020 07:48:53 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 17:36:44 GMT
server: sffe
age: 2552781
content-type: image/png
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 8473
x-xss-protection: 0
expires: Fri, 29 Jan 2021 07:48:53 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 4570 2 KB
3 KB 7ms
7ms Image
image/png 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002141856310/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 11:08:58 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 35176
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sat, 29 Feb 2020 11:08:58 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 4570 295 B
362 B 7ms
7ms Image
image/png 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012002141856310/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 28 Feb 2020 12:55:21 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 28793
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sat, 29 Feb 2020 12:55:21 GMT

GET
H2 200 log
hblg.media.net/ 35 B
194 B 33ms
30ms Image
image/gif 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hblg.media.net/log?logid=kfk&evtid=relog&pid=8PREB0781&itype=HB-CM&dn=securityaffairs.co&cid=8HB41O6BH&svr=2020022712_764&servname=c8-web-25&gdpr=0&csex=2&csstr=&usp_status=0&usp_enf=1&usp_string=&ufca=&usp_ldf=&ugd=4&adt=desktop&vid=00001582923313899031043794789615&vsid=&sd=1&gtd=400&inid=0&gfd=&cc=CH&sc=ZH&ct=ZURICH&abte=CONTROL&adbd=0&amp=0&version=1&sB=true&cors=true&disB=false&ice=&vw=1585&vh=1200&pht=8482&cl=&__rk=0&app=0&rtype=&ffp=0.00&efp=qcqq&mdf=&mdk=&rp=&rf=&rfs=nfetched&dfpAdPath=%2F45361917%2F8CU5BD6EW-639665355-Skyscraper_post_yahoo_300_x_600&src=Rules&lper=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&kwrf=&epurl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-253-103.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.25.v20191220) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:15 GMT
server: Jetty(9.4.25.v20191220)
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 28 Feb 2020 20:55:15 GMT

GET
H2 200 log
lg3.media.net/ 35 B
194 B 32ms
32ms Image
image/gif 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lg3.media.net/log?&logid=kfk&evtid=adPrvLog&otherprov=1&tagsonpage=GO&cid=8CU5BD6EW&crid=639665355&cc=CH&ugd=4&timeTaken=2&vi=1582923313678722137&r=1582923315240
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-253-103.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.25.v20191220) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:15 GMT
server: Jetty(9.4.25.v20191220)
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 28 Feb 2020 20:55:15 GMT

GET
H/1.1 200
OK ptmd
dt.clnmde.com/ 70 B
476 B 115ms
114ms Image
image/gif 52.20.172.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://dt.clnmde.com/ptmd?t=158292331369331360191035_N4IgpgHiBcIAwgDQgM4GMD2MQEYCsAHAEwCcRAzOTuQPoAsOJAbDgOzlx2tMLLoYAzGDj6YALtnzEylavUYt2nbnBoEARkTgFW6nHCJoSYcmDwCBYACY40OLgWsbWBJKnFDoI9xjFXJhKQUVLQMzGwcXDw0RACGbALqcIwCsQQEcOQCaGjcsXTkrGhMjkQUeG78fp7eYADWsdgkVmDMVhwAtHixTGgdODhgsR0kAqwkHeTqGYZ0dL1w-sj16sLIaABuKNjAADqoYCgoAJYYAHY0KGIYAE6xAOZg+9D7za1M7XBdPX0DQyNjCZTGZoOYLKz7RD7TAYOrHMA0KyxMSxZ6vFptTrdXr9QbDUbjSbTAyg+ZoRb7AC+bmOGxgRD4KLEAFdttAANoURCMAC6yAAXo0vMgAA73bB05ZnOmwEVue4ACwC0mC1CYJFk5B4jH05AqyDEbNwdFIGVY8yIeEIbi22CYADo4PbyERXMhYgAbGDkZDZGD9ZZCkDkYo4RJgL7dWy4-4EfKsDo6ONgIjqVKpMBuMBiY7CQIyEKM8XQOB8OrKoKa+ThJRRXjgY5y2A4Ah4e0ke0t+0EJhuZm5kvLDZejmgM6xAC2mdg6mOVhaNxoc7cSJRMFAs-nYEXy+beHINuOS-8e5VmqYLlYZWorBAlMpfNQHquFYLavSbg9NWQGyPu9w+aqlQcCsHAVpaL26ysmIx7YAQADCACqeAAEIACJMAAogA6vKaB5meVB4KwOBMMgACO07eAIA50JSQA
Protocol: HTTP/1.1
Server: 52.20.172.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-172-27.compute-1.amazonaws.com
Software: / Express
Resource Hash: c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:15 GMT
X-Powered-By: Express
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 2C69 4 KB
2 KB 443ms
443ms XHR
text/plain 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1863289999061747&correlator=3188968966469717&output=ldjh&impl=fif&adsid=NT&eid=21065391%2C21065304%2C21065305&vrg=2020022401&guci=1.2.0.0.2.2.0.0&sc=0&sfv=1-0-37&ecs=20200228&iu_parts=45361917%2C8CU5BD6EW-762221962-300x250_inside_post&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&prev_scp=crid%3D762221962%26mnet_segment%3D0.15%26mnet_variant%3D454%26pub_domain%3Dsecurityaffairs.co%26mnet_cc%3DCH%26mnet_bucketid%3Db3%26mnet_ref_ybn%3D1%26mnet_nat_tpid%3D801338173%26PubMaticSS%3D1610%26RubiconSS%3D2209%26fp%3Dqcwk&eri=4&cookie=ID%3Df797a5972b32a84f%3AT%3D1582923313%3AS%3DALNI_MYI6uJBXGCbgeWPbFvqvuAckwjW1g&bc=23&abxe=1&lmt=1582923316&dt=1582923316356&dlt=1582923313537&idt=232&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=250&oid=3&adxs=468&adys=6583&adks=3236558092&ucis=c0j9683n3mu8&ifi=1&ifk=3496784243&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&top=securityaffairs.co&dssz=5&icsg=170&std=0&vis=1&scr_x=0&scr_y=0&ga_vid=2010987256.1582923316&ga_sid=1582923316&ga_hid=408903599&fws=256&ohw=0&btvi=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

cafe /

Resource Hash

fb932d90e9fed9b18e512d046bfd593e143f6c445db3a1eeee0d52407ca55d62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Origin: http://securityaffairs.co
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 28 Feb 2020 20:55:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1934
x-xss-protection: 0
google-lineitem-id: 731759957
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 33134143277
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://securityaffairs.co
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2020022401.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 2C69 66 KB
24 KB 29ms
29ms Script
text/javascript 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020022401.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

sffe /

Resource Hash

816709e9295a4116a9f1648dcdca148a141e0ee263887b39f474a923380e4310

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 20:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 24 Feb 2020 14:08:08 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 24743
x-xss-protection: 0
expires: Fri, 28 Feb 2020 20:55:16 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 2C69 0
0 6ms
5ms Other
text/html 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022401.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

GET
H2 200 mediamain.html Show response
contextual.media.net/ Frame 977B 66 KB
19 KB 319ms
319ms Script
text/javascript 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&pid=8PO5M70HK&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrEBbIZGw_v2fXpyZXRW3WVE%3D&cme=hmi3FHRUKMmbg7S1za9RrgUwPcWgA-5rHMNJEPFQuzUVLkrdVMv8-oVOyRAFvxfUNqonVoHZo5pmXdFR_QujpmK0x59gKKMgHl7urD31dViSBd6L5RXiqrMavI-JqMKYTeUIdk2MGXM%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CygJDWuih5otg1sflNsIQ2jvfmNfrbgWtJjawETPEjASZd4dsrgrjJfTOlR1z96K-hwAeciOmbKapm7nSzYkvlps85OI6MMeY1_I0syMjHj8%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=CH&bf=0&staticIframe=1&vif=1&nse=3&vi=1582923313107055206&lw=1&ugd=4&ib=0&bid=265598&katid=801338173&katbid=-21&katen=1&nb=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-253-103.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

523355193fb189f80814831114b7ab4c66202e58ca5678a7692047a8d136ff8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
date: Fri, 28 Feb 2020 20:55:16 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
x-mnt-hl3: 8-20
cache-control: max-age=300
x-mnt-w: 12-2
content-length: 18963
expires: Fri, 28 Feb 2020 21:00:16 GMT

GET
H2 200 mediamain.html Show response
contextual.media.net/ Frame 09D6 79 KB
24 KB 364ms
363ms Script
text/javascript 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/mediamain.html?&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&pid=8PO5M70HK&size=300x250&cpnet=yVb1sHm-0KIh29BOFTjjrHvHwrQGlpByWaOO1vn303s%3D&cme=B8QTkEAJekI0Te_VLkXv4TiqmM_QnWTuqacVqQmM3O1f52e5nPnfZatUe3-eCgBiElBJRPLfxuT1y42pCHDh9hMmplUUQOrIWiipr66hToNgwsE2dy13osR4WJ6E7G_Ax8YpUEMQ0ww%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CygJDWuih5otg1sflNsIQ2jvfmNfrbgWtJjawETPEjASZd4dsrgrjJfTOlR1z96K-hwAeciOmbKapm7nSzYkvlps85OI6MMeY1_I0syMjHj8%3D%7CsRBSg3CPSiQ%3D%7C&https=1&cc=CH&bf=0&staticIframe=1&vif=1&nse=3&vi=1582923313425037551&lw=1&ugd=4&ib=0&bid=265596&katid=801353038&katbid=-21&katen=1&nb=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-253-103.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

57b8cffc507dabf69607d808c6b5274dc94367639278a2d5162afb987f0e0f5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
date: Fri, 28 Feb 2020 20:55:16 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
x-mnt-hl3: 8-20
cache-control: max-age=300
x-mnt-w: 12-11
content-length: 24024
expires: Fri, 28 Feb 2020 21:00:16 GMT

GET
H2 200 log
hblg.media.net/ 35 B
194 B 34ms
34ms Image
image/gif 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hblg.media.net/log?logid=awlog&pid=8PREB0781&itype=HB-CM&dn=securityaffairs.co&cid=8HB41O6BH&svr=2020022712_764&servname=c8-web-25&gdpr=0&csex=2&csstr=&usp_status=0&usp_enf=1&usp_string=&ufca=&usp_ldf=&ugd=4&adt=desktop&vid=00001582923313899031043794789615&vsid=&sd=1&gtd=400&inid=0&gfd=&cc=CH&sc=ZH&ct=ZURICH&abte=CONTROL&adbd=0&amp=0&version=1&sB=true&cors=true&disB=false&ice=&vw=1585&vh=1200&pht=8522&cl=&__rk=0&app=0&rtype=&pvid=9&prvAccId=184323154&prvApiId=8CU5BD6EW&exid=31&pcId=&mowxReqId=388560266715750631582923313545&crid=512365842&g=0&size=300x250&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=1&rtime=11&dtc=nydc&rtbsv2=&apid=1&wsip=c10-mowx-web-39&ltime=344&abs=0&ssregion=&ssreqid=&sssvnm=&bdp=0.01&cbdp=0.01&dcbdp=0&ckfl=0&cs=&mnet_ckfl=0&cat=&attr=&advId=&advNm=&advUrl=unknown&dfpBd=0.01&nms=1&di=&dt=O&epc=184323154&ogbdp=0.01&s=1&snm=success&dbf=1&bdata=bid%3D0.01%7C%7Cvv%3D0%7C%7Css%3D1600x1200%7C%7Cogbid%3D0.01%7C%7Ccbdp%3D0.01%7C%7Cbflag%3D0%7C%7Cdmm%3D&cmpid=88568&bId=&pcrid=8CU5BD6EW-184323154-9-26&ruct=0&brs=&brr=&iurl=https%3A%2F%2Fiurl-a.akamaihd.net%2Fybntag%3F%26cid%3D8CU5BD6EW%26crid%3D184323154%26size%3D300x250%26requrl%3Dhttp%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F98597%252Fmalware%252Flampion-malware-origin.html&htps=0&ptype=27&pbidflr=0.00&exp=sfl%3Dfalse%7Cbfl%3D-100%7Cclt%3D0%7Chr_ck%3Dfalse%7Cfl_rl%3D1%7Cdbr%3D1%7Ctkd%3Dnull&bfs=0&seat=&nbr=0&ba=2480&ybnca_gbid=&ybnca_erpm=&ybnca_vbid=&yogbdp=0.01&yErpmFlag=0&smsrc=1&strg=&ybnca_bbid=&prvReqId=19564590223038274_950233476_51236584291&dStat=0&ogbid=0.01&acid=203528708731322071582923313544&act=headerBid&dtfdl=&dspltime=&ttfd=&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=0&adj0=0&adj1=0&adj2=0&adj3=0&patkey=&patint%3C%3E=&pc=&spSource=0&spIvt=3&spId=&spFst=0&spIsReq=3&spTo=3&top=0&btm=0&lft=0&rght=0&mx_SD=&mx_PC=0&mx_SPRIG=&mx_UCC=&mx_GCID=&mx_IAB2=&mx_SC=0&mx_dgf=0&mx_BCT=&mx_bsBucket=0&mx_BCE=&mx_BCW=&mx_bsProfile=0&mx_uid_sent=0&mx_sbp=-10&mx_aqcpl_crid=4&mx_aurt=0&pgcatiab=&pgcatiab2=&pgcatsprig=&gFunDl=&ngFunDl=&rDl=&actltime=2824&auMxTm=&brf=0&dcs=&dfpDiv=&dfpPos=&dfpAdPath=&lper=1&td=r%3Dstr%7Cab%3D0%7C&oyaf=0&sbdrid=&ra_sz=300x250&sc_pvid=&sc_ogbdp=0&sc_adj0=0&sc_adj1=0&sc_adj2=0&sc_prspt=&sc_act=&sc_bdata=&sc_bdp=0&sc_cbdp=0&sc_bId=&sc_cat=&sc_cmpid=&sc_advId=&sc_advNm=&sc_advUrl=&udc=&rti=-1&rme=ADPTR&bbdrid=&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&kwrf=&epurl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-253-103.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.25.v20191220) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:16 GMT
server: Jetty(9.4.25.v20191220)
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 28 Feb 2020 20:55:16 GMT

GET
H/1.1 200
OK /
qsearch-a.akamaihd.net/log/ 35 B
329 B 92ms
28ms Image
image/gif 2.16.186.67
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log/?logid=kfk&evtid=ybnwl&aid=0d50cb8d31584455b881649a31106566&domain=securityaffairs.co&price=0.01&cgid=17608&cid=88568&rid=2241852&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&cc=CH&td=c%3D88568%3B+dma%3D%3B+ugd%3D4%3B+ua%3DGOOGLE_CHROME%3B+bid%3D0.01%3B+r%3D&lid=&t=1582923313803&_ls=rtb-nv-dcos-10-6-40-93-29872.srv.media.net
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.67 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-67.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.25.v20191220) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Fri, 28 Feb 2020 20:55:16 GMT
Server: Jetty(9.4.25.v20191220)
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Fri, 28 Feb 2020 20:55:16 GMT

GET
H2 200 nrrV92300.js Show response
contextual.media.net/ Frame 6830 81 KB
25 KB 38ms
38ms Script
text/javascript 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/nrrV92300.js

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/fcmdynet.js?&gdpr=0&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=CH&https=1&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&nse=3&vi=1582923313425037551&lw=1&ugd=4&rtbs=1&ntv=1&nb=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-253-103.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e8cece7fcc8e81f27384afe1eefd48bce89a20bc8c73ef16f8d743a731b7f8d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: max-age=2592000
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
date: Fri, 28 Feb 2020 20:55:16 GMT
vary: Accept-Encoding
x-mnet-h: 8-3
content-type: text/javascript; charset=utf-8
status: 200
cache-control: max-age=1209600
content-length: 25696
expires: Fri, 13 Mar 2020 20:55:16 GMT

GET
DATA 200
OK truncated
/ Frame 6830 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 6830 999 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f2d6da97c49f62460890eb1f23f5d22db3355f62776241956a8cf20191068f88

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bullet3.woff
contextual.media.net/__media__/fonts/bullet3/ Frame 6830 2 KB
2 KB 84ms
31ms Font
application/font-woff 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/__media__/fonts/bullet3/bullet3.woff

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-253-103.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0bf3f6e79af33723b0c1a822f59a484a35583303ab76fa9227b694b1e719364f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Origin: http://securityaffairs.co
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 28 Feb 2020 20:55:16 GMT
last-modified: Mon, 16 May 2016 10:39:41 GMT
server: Apache
access-control-allow-origin: *
strict-transport-security: max-age=604800
content-type: application/font-woff
status: 200
cache-control: max-age=86400
accept-ranges: bytes
content-length: 1688
expires: Sat, 29 Feb 2020 20:55:16 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 9941 0
0 31ms
31ms Fetch
image/gif 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst3wr3Pa3enkHIUydXGE14l08_dey2sEih08WBM40L5O1IObm_zNGiizCvusLr7JnBs8gTma8Bypi3Ru7iBbcqabbxZ7bBeXjQ2iKIJxkyw4qi1xJUnOZ2RnskVqHQp0hZchiF-J-0YMocR_XHR4cNcD5EsKbnqxoBXxtD_2It43P169KNUND7QDYIwocX6bUN2fbPuuByVO67uU1bzeiGM83cz15QGyDw_ZmJqgkFNckxXd0T_d-rRGlPHa3onHSPnbK5th9VxpjCZjY_nya25M02KUf7mN5Dlqx0gEueSR62F3tTu&sig=Cg0ArKJSzDKIFR0xV615EAE&urlfix=1&adurl=

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: empty

Response headers

timing-allow-origin: *
date: Fri, 28 Feb 2020 20:55:16 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 nrrV92300.js Show response
contextual.media.net/ Frame 82BE 81 KB
25 KB 33ms
33ms Script
text/javascript 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/nrrV92300.js

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-122-253-103.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e8cece7fcc8e81f27384afe1eefd48bce89a20bc8c73ef16f8d743a731b7f8d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: max-age=2592000
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
date: Fri, 28 Feb 2020 20:55:16 GMT
vary: Accept-Encoding
x-mnet-h: 8-3
content-type: text/javascript; charset=utf-8
status: 200
cache-control: max-age=1209600
content-length: 25696
expires: Fri, 13 Mar 2020 20:55:16 GMT

GET
DATA 200
OK truncated
/ Frame 82BE 240 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 34761d696127e4f2f41c2d1f1b6883a09729da8626ca63630d37bca4a0e753ad

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 82BE 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 82BE 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9941 73 KB
28 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020022401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e76ea1aec186a6f4e42cf26dcdb80f5953a73b3a6d8aa2840fef68746bb8f693

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 20:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582753860897921"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28205
x-xss-protection: 0
expires: Fri, 28 Feb 2020 20:55:16 GMT

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2C69 73 KB
27 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020022401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

261a1dfeeccd3f6747dd6bb49e60579c2582910c2b225d23677772825bf7bc3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 28 Feb 2020 20:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582753860897921"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 27728
x-xss-protection: 0
expires: Fri, 28 Feb 2020 20:55:16 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C69 0
58 B 14ms
13ms Image
image/gif 2a00:1450:4001:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_sz&pvsid=1863289999061747&r=300x250&w=300&h=250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:16 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 log
hblg.media.net/ 35 B
194 B 30ms
30ms Image
image/gif 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hblg.media.net/log?logid=awlog&pid=8PREB0781&itype=HB-CM&dn=securityaffairs.co&cid=8HB41O6BH&svr=2020022712_764&servname=c8-web-25&gdpr=0&csex=2&csstr=&usp_status=0&usp_enf=1&usp_string=&ufca=&usp_ldf=&ugd=4&adt=desktop&vid=00001582923313899031043794789615&vsid=&sd=1&gtd=400&inid=0&gfd=&cc=CH&sc=ZH&ct=ZURICH&abte=CONTROL&adbd=0&amp=0&version=1&sB=true&cors=true&disB=false&ice=&vw=1585&vh=1200&pht=8522&cl=&__rk=0&app=0&rtype=&pvid=4&prvAccId=762221962&prvApiId=8CU5BD6EW&exid=31&pcId=&mowxReqId=142982757051678711582923313516&crid=170605770&g=0&size=300x250&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=1&rtime=41&dtc=nydc&rtbsv2=&apid=1&wsip=c10-mowx-web-37&ltime=428&abs=0&ssregion=&ssreqid=&sssvnm=&bdp=0.15&cbdp=0.15&dcbdp=0&ckfl=0&cs=&mnet_ckfl=0&cat=&attr=&advId=&advNm=&advUrl=unknown&dfpBd=0.15&nms=1&di=&dt=O&epc=762221962&ogbdp=0.15&s=1&snm=success&dbf=1&bdata=sd2%3D3%7C%7Cbb%3D100%7C%7Cvv%3D0%7C%7Cerpm%3D0.15%7C%7Cogerpm%3D0.15%7C%7Cxgboost_l%3D0%7C%7Csd%3D1%7C%7Cuid%3D3o7iBrEZIP77kQgI40%7C%7Cdc2%3D1%7C%7Cbtd%3D158454284966209175021035520%7C%7Cscd%3Dzh%7C%7Cuim%3D2%7C%7Css%3D1600x1200%7C%7Cuiw%3D1%7C%7Cxgb_sd%3D2020022500%7C%7Clast%3D0%7C%7CCI%3D1737%7C%7Cfbb%3D0%7C%7Cxgb_nt%3D198%7C%7Ctb%3D-1%7C%7Cct%3Dzurich%7C%7Crc%3D1%7C%7Cbasis2%3D196%7C%7Curl_b%3D0.14%7C%7Cbasis1%3D196%7C%7CisRef%3D0%7C%7Clc%3D0%7C%7Curl_l%3D50%7C%7Cxgboost_b%3D0.06%7C%7Cbid%3D0.15%7C%7Cxgb_b%3D0.06%7C%7Cdc%3D7%7C%7Cgcat%3D-1%7C%7Cogbid%3D0.15%7C%7Ccbdp%3D0.15%7C%7Cbflag%3D1%7C%7Cdmm%3D&cmpid=&bId=&pcrid=8CU5BD6EW-762221962-9-26&ruct=0&brs=&brr=&iurl=https%3A%2F%2Fiurl-a.akamaihd.net%2Fybntag%3F%26cid%3D8CU5BD6EW%26crid%3D762221962%26size%3D300x250%26requrl%3Dhttp%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F98597%252Fmalware%252Flampion-malware-origin.html&htps=0&ptype=27&pbidflr=0.00&exp=sfl%3Dfalse%7Cbfl%3D-100%7Cclt%3D0%7Chr_ck%3Dfalse%7Cfl_rl%3D1%7Cdbr%3D1%7Ctkd%3Dnull&bfs=0&seat=&nbr=0&ba=2859&ybnca_gbid=&ybnca_erpm=0.15&ybnca_vbid=0.15&yogbdp=0.43&yErpmFlag=1&smsrc=1&strg=&ybnca_bbid=-1.0&prvReqId=20245702748877082_215473474_17060577041&dStat=0&ogbid=0.43&acid=508401440017774111582923313510&act=headerBid&dtfdl=&dspltime=&ttfd=&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=0&adj0=0&adj1=0&adj2=0&adj3=0&patkey=&patint%3C%3E=&pc=&spSource=0&spIvt=3&spId=&spFst=0&spIsReq=3&spTo=3&top=0&btm=0&lft=0&rght=0&mx_SD=&mx_PC=0&mx_SPRIG=&mx_UCC=&mx_GCID=&mx_IAB2=&mx_SC=0&mx_dgf=0&mx_BCT=&mx_bsBucket=0&mx_BCE=&mx_BCW=&mx_bsProfile=0&mx_uid_sent=0&mx_sbp=-10&mx_aqcpl_crid=0&mx_aurt=0&pgcatiab=&pgcatiab2=&pgcatsprig=&gFunDl=&ngFunDl=&rDl=&actltime=2835&auMxTm=&brf=0&dcs=&dfpDiv=&dfpPos=&dfpAdPath=&lper=1&td=r%3Dstr%7Cab%3D0%7C&oyaf=0&sbdrid=454&ra_sz=300x250&sc_pvid=&sc_ogbdp=0&sc_adj0=0&sc_adj1=0&sc_adj2=0&sc_prspt=&sc_act=&sc_bdata=&sc_bdp=0&sc_cbdp=0&sc_bId=&sc_cat=&sc_cmpid=&sc_advId=&sc_advNm=&sc_advUrl=&udc=&rti=-1&rme=ADPTR&bbdrid=&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&kwrf=&epurl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-253-103.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.25.v20191220) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:16 GMT
server: Jetty(9.4.25.v20191220)
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 28 Feb 2020 20:55:16 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 2C69 7 KB
5 KB 18ms
17ms XHR
application/json 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020022401&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020022401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

be0f64bb75a2a1d75e5c5db6642012d20b4cf7fb04845d1d289c93941f3903b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Origin: http://securityaffairs.co
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 28 Feb 2020 20:55:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5157
x-xss-protection: 0

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 6830 15 B
204 B 35ms
34ms Script
text/javascript 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lg3.media.net/bql.php?v=1&gdpr=0&hvsid=00001582923313542031043794788783&geo=47.37|8.55&lper=100&bdrid=9&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYMtYrxEu-lxRD0Lsy72a3vLc6N2HkYgVTj48OMGKC3CgsbsHyDEl2Dn143SOZLwtVjpyWecVrb5PXhCt4ZiGo5Y%3D&lpid=&tsid=1&ksu=207&q=&prv=&type=&ps=&cme=-qkzMpzS_SI-aBira-jsiweWCMXSTRYilXR4OEAywxiX6UOMTmct-IGAoXohl3NXrY_0_3CzEJxK0TLZEU700SIL1MjOnN-ESNSu81WShsTznu6ntBVELezYX1sKaaAGxa3IKWMzfjZWM-ZHeVO0r4F_m1hT_TZIPGEl6IMLXjGhQjMbM2UBM-QcdpfA42k8wEuePcQQkKadwC0bWRYgOIptko_7XxAkQG5dKO6S8mc%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CygJDWuih5otg1sflNsIQ2jvfmNfrbgWtJjawETPEjASZd4dsrgrjJfTOlR1z96K-hwAeciOmbKapm7nSzYkvlps85OI6MMeY1_I0syMjHj8%3D%7CsRBSg3CPSiQ%3D%7C2Eny-Wlc_U7JfcdZfQpp5vpF5ChEVzK0E-9o5ofdtER5uUShrol88gvB4dn_J21Stn35isvgDCTdbriGoVBU6EQ1tbWIaM8gwh3oyBdUGHh_NVK_t30Iv80pFB5rY6fmm_AnTcDeD9ssPvL_BzvVVU2myxDLL_NmlgBFm7sm2BIjrWsz5plvTyPApzjgOBj6rWX3GC_GwzchJrDHDqo8_g%3D%3D%7C&hint=&td=&cc=CH&wsip=2886945770&bca=0&ugd=4&vgd_chost=contextual.media.net&vgde_setid=NufozNuG&&rc=0&vgd_aid=203528708731322071582923313544&fdkt=244&kwd[]=Free%20Cell%20Phone%20Tracking&kwt[]=244&kbc[]=1203023066&kwp[]=1&kid[]=11531083&kbc2[]=ir%3D1%7C%7Ciid%3D318046%7C%7Cps%3D1.082%7C%7Crpc%3D0.23%7C%7Clvl%3D1.57&ktd[]=277327511808&kwd[]=Track%20Cell%20Phone%20Location&kwt[]=244&kbc[]=1203023066&kwp[]=2&kid[]=172728028&kbc2[]=ir%3D1%7C%7Ciid%3D436823%7C%7Cps%3D1.082%7C%7Crpc%3D0.07%7C%7Clvl%3D3.19&ktd[]=278938124544&kwd[]=Best%20Antivirus%20Software%20of%202020&kwt[]=439&kbc[]=1202866661&kwp[]=3&kid[]=329721996&kbc2[]=ir%3D1%7C%7Ciid%3D10730624%7C%7Cps%3D0.890%7C%7Crpc%3D0.49%7C%7Clvl%3D1.92&ktd[]=277042299136&kwd[]=Best%20Investment%20Plans&kwt[]=244&kbc[]=1203023066&kwp[]=4&kid[]=3473948&kbc2[]=ir%3D1%7C%7Ciid%3D156677%7C%7Cps%3D1.082%7C%7Crpc%3D1.01%7C%7Clvl%3D1.00&ktd[]=277327511808&kwd[]=Online%20Malware%20Scan&kwt[]=439&kbc[]=1202866661&kwp[]=5&kid[]=21246677&kbc2[]=ir%3D1%7C%7Ciid%3D3971680%7C%7Cps%3D0.890%7C%7Crpc%3D0.40%7C%7Clvl%3D1.17&ktd[]=277327511808&rand=1582923316794&cid=8CU5BD6EW&vwid=1582923313425037551&vi=1582923313425037551&l3ch=0&slnkp=no&bdrct=0.01&vgd_rt=2826&bto=0&tdAdd[]=rtbsd%3D10&tdAdd[]=ib=0&vgd_uspa=0&vgd_sc=ZH&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&vgd_ifrmode=00&sttm=1582923313542&upk=1582923313.19753&hvsid=00001582923313542031043794788783&verid=3121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&vgd_hbReqId=T1582921750C8S36U85&vgd_isiolc=1&npgv=1&rtbsd=10&dytm=1582923313887&matchstring=&matm=1582923316801&vsid=2259249137947807&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l3_sc=ZH&vgd_l2ch=0&vgd_l1ch=1&vgd_katid=801353038&vgd_katbid=-21&vgd_kals=ttype%3D10002%7C%7Cpc%3D42&vgd_kalog=TPTD%3D549806281604%7C%7CUUID%3D49LYcJQDtzkdtMbems%7C%7CSI%3D1737%7C%7CMI%3D1737%7C%7CHID%3D6%7C%7CCI%3D1737%7C%7CMPTD%3D192%7C%7CSID%3D12&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_sbSup=1&vgd_l2wsip=2886943814&vgd_nrrsf=nrr&vgd_nrrv=92300&vgd_nrrs=92300&vgd_optout=0&vgd_x_pos=973&vgd_y_pos=413&vgd_ren_page_h=8522&vgd_cty=ZURICH&vgd_vstrid=2259249137947807&vgde_bdata=G8Ov9.9u%7C%7Ceev9%7C%7CQQvuF99-uf99%7C%7CmyG8Ov9.9u%7C%7CNGOEv9.9u%7C%7CGkj1yv9%7C%7COYYv&vgd_cfud=200219&vgd_is_amp=0&vgd_icat=608&vgd_spcat=500434&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&oRurl=http%3A%2F%2Fcdn3nc%2Fmediamain.html%3F%26esi%3D1%26%26cid%3D8CU5BD6EW%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253D%253D%26crid%3D184323154%26pid%3D8PO5M70HK%26size%3D300x250%26cpnet%3DyVb1sHm-0KIh29BOFTjjrHvHwrQGlpByWaOO1vn303s%253D%26cme%3DB8QTkEAJekI0Te_VLkXv4TiqmM_QnWTuqacVqQmM3O1f52e5nPnfZatUe3-eCgBiElBJRPLfxuT1y42pCHDh9hMmplUUQOrIWiipr66hToNgwsE2dy13osR4WJ6E7G_Ax8YpUEMQ0ww%253D%257C%257CNDHRnZ9Gz3KXlI-i9OnZqQ%253D%253D%257C5gDUJdTGiJzedmq9hanWYg%253D%253D%257CN7fu2vKt8_s%253D%257CygJDWuih5otg1sflNsIQ2jvfmNfrbgWtJjawETPEjASZd4dsrgrjJfTOlR1z96K-hwAeciOmbKapm7nSzYkvlps85OI6MMeY1_I0syMjHj8%253D%257CsRBSg3CPSiQ%253D%257C%26https%3D1%26cc%3DCH%26bf%3D0%26staticIframe%3D1%26vif%3D1%26nse%3D3%26vi%3D1582923313425037551%26lw%3D1%26ugd%3D4%26ib%3D0%26bid%3D265596%26katid%3D801353038%26katbid%3D-21%26katen%3D1%26nb%3D1%26chost%3Dcontextual.media.net%26fvips%3D0%26vpf%3D000%26ap%3D0%26pf%3D0%26isOffice%3D0&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A5&vgd_end=1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/nrrV92300.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-253-103.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:16 GMT
server: Apache
access-control-allow-origin: *
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Fri, 28 Feb 2020 20:55:16 GMT

POST
H2 200 log
navvy.media.net/ Frame 6830 807 B
997 B 575ms
196ms Other
image/gif 52.9.163.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://navvy.media.net/log
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/nrrV92300.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.9.163.168 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-9-163-168.us-west-1.compute.amazonaws.com
Software: Jetty(9.4.7.v20170914) /
Resource Hash: 0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Origin: http://securityaffairs.co
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:17 GMT
server: Jetty(9.4.7.v20170914)
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache,no-store
content-length: 807
expires: Fri, 28 Feb 2020 20:55:17 GMT

GET
H/1.1 200
OK sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 2C69 14 KB
6 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020022401.js

Protocol

HTTP/1.1

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:16 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: sffe
ETag: "1582746470043195"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: private, max-age=3000
Accept-Ranges: bytes
Content-Length: 5456
X-XSS-Protection: 0
Expires: Fri, 28 Feb 2020 20:55:16 GMT

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 82BE 15 B
204 B 32ms
32ms Script
text/javascript 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lg3.media.net/bql.php?v=1&gdpr=0&hvsid=00001582923313487031043794781784&geo=47.37|8.55&lper=100&bdrid=4&subBdr=454&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYMtYrxEu-lxRD0Lsy72a3vLc6N2HkYgVTj48OMGKC3CgsbsHyDEl2DmPfRRLtZsloEMMe7vFHkv2Xs9LhqTujSI%3D&lpid=&tsid=1&ksu=207&q=&prv=&type=&ps=&cme=kJe0pxngeTM7W-tTrtNnEl_ffwLqSp0Q2bBp36dslQjnhhNniT_fhOfe7Yv8CrPsKN8mA5q9_-v4KQSbh8-rCh1J_ezwJki4tMICkkjb6ixLS3LrDbM2J1EEa5tKKJfqwmietXELhvQKGMEu3QlSEvZfG3ROE0ux8sxKDmHFxBobRK2833GdZvBMxOrsi0G7RwH7AW59f_jS4uI3JrykEkKZZAX_u6RovqlFOWzRugg%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CygJDWuih5otg1sflNsIQ2jvfmNfrbgWtJjawETPEjASZd4dsrgrjJfTOlR1z96K-hwAeciOmbKapm7nSzYkvlps85OI6MMeY1_I0syMjHj8%3D%7CsRBSg3CPSiQ%3D%7CiYx7ecmNdCXPcV1ZJDFeIIDEa7nPTG53d4HS58HJE8yge_V2o6q-fnPKaWuTgHs5bA6tEvEEtjc2SLMSmzKlPW05qnp0kkX3bGPXOg_th3klps27kdmZUtB1KPGPhE4TS_JyaG_QynLJDipb0pUq3mQ55o2c8fUjr2M-V9S_EaT4efDSjQ_tFH0DOy0JRDCiRkzmC_pewg0ozghBGMaTAg%3D%3D%7C&hint=&td=&cc=CH&wsip=2886940717&bca=0&ugd=4&vgd_chost=contextual.media.net&vgde_setid=NufozNuN&&rc=0&vgd_aid=508401440017774111582923313510&fdkt=244&kwd[]=Free%20Cell%20Phone%20Tracking&kwt[]=244&kbc[]=1203023066&kwp[]=1&kid[]=11531083&kbc2[]=ir%3D1%7C%7Ciid%3D436823%7C%7Cps%3D1.082%7C%7Crpc%3D0.23%7C%7Clvl%3D1.57&ktd[]=278132818176&kwd[]=Track%20Cell%20Phone%20Location&kwt[]=244&kbc[]=1203023066&kwp[]=2&kid[]=172728028&kbc2[]=ir%3D1%7C%7Ciid%3D861055%7C%7Cps%3D1.082%7C%7Crpc%3D0.07%7C%7Clvl%3D3.19&ktd[]=275716899072&kwd[]=Best%20Antivirus%20Software%20of%202020&kwt[]=439&kbc[]=1202866661&kwp[]=3&kid[]=329721996&kbc2[]=ir%3D1%7C%7Ciid%3D12104038%7C%7Cps%3D0.890%7C%7Crpc%3D0.49%7C%7Clvl%3D1.92&ktd[]=277042299136&kwd[]=Best%20Investment%20Plans&kwt[]=244&kbc[]=1203023066&kwp[]=4&kid[]=3473948&kbc2[]=ir%3D1%7C%7Ciid%3D1363540%7C%7Cps%3D1.082%7C%7Crpc%3D1.01%7C%7Clvl%3D1.00&ktd[]=278938124544&kwd[]=Online%20Malware%20Scan&kwt[]=439&kbc[]=1202866661&kwp[]=5&kid[]=21246677&kbc2[]=ir%3D1%7C%7Ciid%3D5455234%7C%7Cps%3D0.890%7C%7Crpc%3D0.40%7C%7Clvl%3D1.17&ktd[]=277327511808&rand=1582923316873&cid=8CU5BD6EW&vwid=1582923313107055206&vi=1582923313107055206&l3ch=0&slnkp=no&bdrct=0.15&vgd_rt=2839&bto=0&tdAdd[]=rtbsd%3D10&tdAdd[]=ib=0&vgd_uspa=0&vgd_sc=ZH&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&vgd_ifrmode=00&axbx=bl5&vgd_refimp=0&sttm=1582923313487&upk=1582923313.19753&hvsid=00001582923313487031043794781784&verid=3121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&vgd_hbReqId=T1582921750C8S36U85&vgd_isiolc=1&rtbsd=10&dytm=1582923313848&matchstring=&matm=1582923316878&vsid=2259249137947807&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l3_sc=ZH&vgd_l2ch=0&vgd_l1ch=1&vgd_katid=801338173&vgd_katbid=-21&vgd_kals=ttype%3D10002%7C%7Cpc%3D5&vgd_kalog=TPTD%3D549797892868%7C%7CUUID%3DpMcdFMF99Jq99FqOi%7C%7CSI%3D1737%7C%7CMI%3D1737%7C%7CHID%3D6%7C%7CCI%3D1737%7C%7CMPTD%3D192%7C%7CSID%3D12&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_refcnf=%7B%22a2y%22%3A%7B%22afterLoadSecs%22%3A30%2C%22afterViewSecs%22%3A10%2C%22percentTraffic%22%3A95%2C%22ignoreSessionDisable%22%3Atrue%2C%22both%22%3Afalse%7D%7D&vgd_dfp_tgt=%7B%22crid%22%3A%22762221962%22%2C%22mnet_segment%22%3A%220.15%22%2C%22mnet_variant%22%3A%22454%22%2C%22pub_domain%22%3A%22securityaffairs.co%22%2C%22mnet_cc%22%3A%22CH%22%2C%22mnet_bucketid%22%3A%22b3%22%2C%22mnet_ref_ybn%22%3A1%2C%22mnet_nat_tpid%22%3A%22801338173%22%2C%22PubMaticSS%22%3A%221610%22%2C%22RubiconSS%22%3A%222209%22%7D&vgd_sbSup=1&vgd_l2wsip=2886930082&vgd_nrrsf=nrr&vgd_nrrv=92300&vgd_nrrs=92300&vgd_optout=0&vgd_x_pos=360&vgd_y_pos=6583&vgd_ren_page_h=8522&vgd_cty=ZURICH&vgd_vstrid=2259249137947807&vgde_bdata=QOfvA%7C%7CGGvu99%7C%7Ceev9%7C%7CJLEYv9.uX%7C%7CmyJLEYv9.uX%7C%7C-yGmmQ7Mjv9%7C%7CQOvu%7C%7Cx8OvAmh8RL42V0hhUgyVH9%7C%7CONfvu%7C%7CG7OvuXWHXHfWHiFFf9iuhX9fu9AXXf9%7C%7CQNOvlw%7C%7Cx8Yvf%7C%7CQQvuF99-uf99%7C%7Cx8Bvu%7C%7C-yGMQOvf9f99ffX99%7C%7Cj1Q7v9%7C%7C%3DVvuhAh%7C%7CkGGv9%7C%7C-yGMz7vuiW%7C%7C7Gvou%7C%7CN7vlxL8Nw%7C%7CLNvu%7C%7CG1Q8QfvuiF%7C%7CxLjMGv9.uH%7C%7CG1Q8QuvuiF%7C%7C8QDJkv9%7C%7CjNv9%7C%7CxLjMjvX9%7C%7C-yGmmQ7MGv9.9F%7C%7CG8Ov9.uX%7C%7C-yGMGv9.9F%7C%7CONvh%7C%7CyN17vou%7C%7CmyG8Ov9.uX%7C%7CNGOEv9.uX%7C%7CGkj1yvu%7C%7COYYv&vgd_cfud=200221&vgd_is_amp=0&vgd_icat=608&vgd_spcat=500434&vgd_rensize=517_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&oRurl=http%3A%2F%2Fcdn3nc%2Fmediamain.html%3F%26esi%3D1%26%26cid%3D8CU5BD6EW%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253D%253D%26crid%3D762221962%26pid%3D8PO5M70HK%26size%3D300x250%26cpnet%3DyVb1sHm-0KIh29BOFTjjrEBbIZGw_v2fXpyZXRW3WVE%253D%26cme%3Dhmi3FHRUKMmbg7S1za9RrgUwPcWgA-5rHMNJEPFQuzUVLkrdVMv8-oVOyRAFvxfUNqonVoHZo5pmXdFR_QujpmK0x59gKKMgHl7urD31dViSBd6L5RXiqrMavI-JqMKYTeUIdk2MGXM%253D%257C%257CNDHRnZ9Gz3KXlI-i9OnZqQ%253D%253D%257C5gDUJdTGiJzedmq9hanWYg%253D%253D%257CN7fu2vKt8_s%253D%257CygJDWuih5otg1sflNsIQ2jvfmNfrbgWtJjawETPEjASZd4dsrgrjJfTOlR1z96K-hwAeciOmbKapm7nSzYkvlps85OI6MMeY1_I0syMjHj8%253D%257CsRBSg3CPSiQ%253D%257C%26https%3D1%26cc%3DCH%26bf%3D0%26staticIframe%3D1%26vif%3D1%26nse%3D3%26vi%3D1582923313107055206%26lw%3D1%26ugd%3D4%26ib%3D0%26bid%3D265598%26katid%3D801338173%26katbid%3D-21%26katen%3D1%26nb%3D1%26chost%3Dcontextual.media.net%26fvips%3D0%26vpf%3D000%26ap%3D0%26pf%3D0%26isOffice%3D0&tdAdd[]=uiparams%3D%3Brend_w%3A517%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A5&vgd_end=1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/nrrV92300.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-253-103.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:16 GMT
server: Apache
access-control-allow-origin: *
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Fri, 28 Feb 2020 20:55:16 GMT

POST
H2 200 log
navvy.media.net/ Frame 82BE 807 B
997 B 537ms
196ms Other
image/gif 52.9.163.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://navvy.media.net/log
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/nrrV92300.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.9.163.168 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-9-163-168.us-west-1.compute.amazonaws.com
Software: Jetty(9.4.7.v20170914) /
Resource Hash: 0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Origin: http://securityaffairs.co
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:17 GMT
server: Jetty(9.4.7.v20170914)
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache,no-store
content-length: 807
expires: Fri, 28 Feb 2020 20:55:17 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 3EB5 0
0 6ms
6ms Document
text/html 2a00:1450:4001:818::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: http://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Fri, 28 Feb 2020 20:12:38 GMT
expires: Sat, 27 Feb 2021 20:12:38 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 2558
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C69 0
58 B 15ms
15ms Image
image/gif 2a00:1450:4001:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020022401&jk=1863289999061747&bg=!AwClABhYYwzB43GAtP0CAAAANVIAAAAJmQF4vI491r3cLiBn51UEk5-B5tG5GaKP_qviUQG0NY7Sw_yiOClpzG4H3cp1_lH5ur6SD07SK_fN84Rgas-hC-SlyM7nOvmCePjsWa56SdM1rrgFmtE3dd5-tFLiSgCxXGQQSwbGu-qQ4-vWru7CU6W7dZ8CWSY-EOzJEo5KOD4Ii7z_KK8zAVV_vAuylIaxBHj6mhioZKyFd7il7a2kJXvmd6M-SZrWc-pAC8OC36nSi6UZVYanI4s2Yyn6s3cUnnufjvtyluV2fbzqpJZs3Wv6kpmje7E9Nwkk2laH-kqiAw-e80cH7eC9ORWUJEyTKn8XQbkUCUVM5-r9JTa53IB8bD59kDyocc-VSgw9nEDN43gbHVvSjsl52UskZkBINIDFlzzFsbBWcn5j7i1DOt2-n3MpG7gOC00XF290fakrh0sWWdyBVJKcMyLHqU6LSzfRwFm2ieS559Blv7FUxckIhUkF6Bqd1-Mge3ZTuOrPHcFoMF7Ns4ruwA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:16 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 log
hblg.media.net/ 35 B
194 B 39ms
38ms Image
image/gif 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hblg.media.net/log?logid=aplog&pid=8PREB0781&itype=HB-CM&dn=securityaffairs.co&cid=8HB41O6BH&svr=2020022712_764&servname=c8-web-25&gdpr=0&csex=2&csstr=&usp_status=0&usp_enf=1&usp_string=&ufca=&usp_ldf=&ugd=4&adt=desktop&vid=00001582923313899031043794789615&vsid=&sd=1&gtd=400&inid=0&gfd=&cc=CH&sc=ZH&ct=ZURICH&abte=CONTROL&adbd=0&amp=0&version=1&sB=true&cors=true&disB=false&ice=&vw=1585&vh=1200&pht=8522&cl=&__rk=0&app=0&rtype=&pvid=0&prvAccId=&prvApiId=&exid=&pcId=&adj0=0&adj1=0&adj2=0&adj3=0&mowxReqId=&crid=170605770&g=0&size=300x250&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=0&bdp=0&cbdp=0&dcbdp=0&ckfl=&cs=&mnet_ckfl=&cat=&attr=&advId=&advNm=&advUrl=&dfpBd=0&nms=1&di=&dt=&epc=&ogbdp=0&s=1&snm=success&dbf=1&bdata=&cmpid=&bId=&pcrid=&ruct=0&brs=&brr=&iurl=&htps=0&ptype=27&pbidflr=0&exp=&bfs=0&seat=&nbr=&ba=1&ybnca_gbid=&ybnca_erpm=&ybnca_vbid=&yogbdp=&yErpmFlag=&smsrc=1&strg=&ybnca_bbid=&prvReqId=&dStat=&ogbid=0&acid=508401440017774111582923313510&act=headerBid&dtfdl=&dspltime=&ttfd=&rtime=&dtc=&rtbsv2=&apid=&wsip=&ltime=&abs=&ssregion=&ssreqid=&sssvnm=&top=0&btm=0&lft=0&rght=0&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=0&patkey=&patint=&pc=&spSource=0&spIvt=0&spId=&spFst=0&spIsReq=0&spTo=0&pgcatiab=&pgcatiab2=&pgcatsprig=&gFunDl=&ngFunDl=&rDl=&refVisId=&osnbr=&brf=0&iwb=1&toconsider=0&dcs=&auMxTm=&actltime=2835&acsn=1&dfpDiv=&dfpAdPath=&dfpPos=&sbdrid=454&bbdrid=&td=%7C&lper=1&pvid=0&prvAccId=&prvApiId=&exid=&pcId=&adj0=0&adj1=0&adj2=0&adj3=0&mowxReqId=&crid=512365842&g=0&size=300x250&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=0&bdp=0&cbdp=0&dcbdp=0&ckfl=&cs=&mnet_ckfl=&cat=&attr=&advId=&advNm=&advUrl=&dfpBd=0&nms=1&di=&dt=&epc=&ogbdp=0&s=1&snm=success&dbf=1&bdata=&cmpid=&bId=&pcrid=&ruct=0&brs=&brr=&iurl=&htps=0&ptype=27&pbidflr=0&exp=&bfs=0&seat=&nbr=&ba=0&ybnca_gbid=&ybnca_erpm=&ybnca_vbid=&yogbdp=&yErpmFlag=&smsrc=1&strg=&ybnca_bbid=&prvReqId=&dStat=&ogbid=0&acid=203528708731322071582923313544&act=headerBid&dtfdl=&dspltime=&ttfd=&rtime=&dtc=&rtbsv2=&apid=&wsip=&ltime=&abs=&ssregion=&ssreqid=&sssvnm=&top=0&btm=0&lft=0&rght=0&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=0&patkey=&patint=&pc=&spSource=0&spIvt=0&spId=&spFst=0&spIsReq=0&spTo=0&pgcatiab=&pgcatiab2=&pgcatsprig=&gFunDl=&ngFunDl=&rDl=&refVisId=&osnbr=&brf=0&iwb=1&toconsider=0&dcs=&auMxTm=&actltime=2824&acsn=1&dfpDiv=&dfpAdPath=&dfpPos=&sbdrid=&bbdrid=&td=%7C&lper=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&kwrf=&epurl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-253-103.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.25.v20191220) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:17 GMT
server: Jetty(9.4.25.v20191220)
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 28 Feb 2020 20:55:17 GMT

GET
H2 200 log
hblg.media.net/ 35 B
194 B 41ms
40ms Image
image/gif 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hblg.media.net/log?logid=kfk&evtid=relog&pid=8PREB0781&itype=HB-CM&dn=securityaffairs.co&cid=8HB41O6BH&svr=2020022712_764&servname=c8-web-25&gdpr=0&csex=2&csstr=&usp_status=0&usp_enf=1&usp_string=&ufca=&usp_ldf=&ugd=4&adt=desktop&vid=00001582923313899031043794789615&vsid=&sd=1&gtd=400&inid=0&gfd=&cc=CH&sc=ZH&ct=ZURICH&abte=CONTROL&adbd=0&amp=0&version=1&sB=true&cors=true&disB=false&ice=&vw=1585&vh=1200&pht=8522&cl=&__rk=0&app=0&rtype=&ffp=0.15&efp=qcwk&mdf=0.15&mdk=mnet_segment&rp=&rf=&rfs=nfetched&dfpAdPath=%2F45361917%2F8CU5BD6EW-762221962-300x250_inside_post&src=Dynamic&lper=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&kwrf=&epurl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-253-103.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.25.v20191220) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:17 GMT
server: Jetty(9.4.25.v20191220)
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Fri, 28 Feb 2020 20:55:17 GMT

GET
H2 200 bqi.php
lg3.media.net/ 15 B
15 B 44ms
44ms Image
text/javascript 92.122.253.103
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lg3.media.net/bqi.php?lf=3&&gdpr=0&prid=8PRHGG6T9&vi=1582923313425037551&cid=8CU5BD6EW&crid=184323154&ugd=4&cc=CH&sc=ZH&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F98597%2Fmalware%2Flampion-malware-origin.html&pid=8PO5M70HK&hvsid=00001582923313542031043794788783&bdrid=9&cme=B8QTkEAJekI0Te_VLkXv4TiqmM_QnWTuqacVqQmM3O1f52e5nPnfZatUe3-eCgBiElBJRPLfxuT1y42pCHDh9hMmplUUQOrIWiipr66hToNgwsE2dy13osR4WJ6E7G_Ax8YpUEMQ0ww%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CN7fu2vKt8_s%3D%7CygJDWuih5otg1sflNsIQ2jvfmNfrbgWtJjawETPEjASZd4dsrgrjJfTOlR1z96K-hwAeciOmbKapm7nSzYkvlps85OI6MMeY1_I0syMjHj8%3D%7CsRBSg3CPSiQ%3D%7C&abpl=2&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&kalog=TPTD%3D549806281604%7C%7CUUID%3D49LYcJQDtzkdtMbems%7C%7CSI%3D1737%7C%7CMI%3D1737%7C%7CHID%3D6%7C%7CCI%3D1737%7C%7CMPTD%3D192%7C%7CSID%3D12&kata=aton&kals=ttype%3D10002%7C%7Cpc%3D42&kapc=42&katid=801353038&katbid=-21&l2wsip=2886943814&l2ch=0&dytm=1582923313887&rtbsd=10&npgv=1&vgd_isiolc=1&vgd_uspa=0&vgd_hbReqId=T1582921750C8S36U85&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&vgd_sc=ZH&verid=3121199&upk=1582923313.19753&sttm=1582923313542&l1ch=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 92.122.253.103 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-253-103.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 28 Feb 2020 20:55:17 GMT
server: Apache
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Fri, 28 Feb 2020 20:55:17 GMT

GET
H/1.1 200
OK ptmd
dt.clnmde.com/ 70 B
476 B 114ms
114ms Image
image/gif 52.20.172.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://dt.clnmde.com/ptmd?t=158292331369331360191035_N4IgtgniBcDasEYA0BOA7AZiQgTJpALAlgGwkYC6SsOhJAHEmg0iTgAykECsl1W6LLnwISBdkhw5xVWASQYSE+mjStu9eQwwFZ3VktSGC8nCl1UQAdwCOMWJcgAne5YDGTsAAd7IBJowcDARuAgB9ABMIMIQQJBBmKRwEFDYwgHMvABcwnDiQclSSXm5uDOywjHzEqRS0sABDAEsAOzCCfP8CQODQsMbWsO4QSwaAGyz7CXZLAGcAexh9EEzJ6BB2fKaANxh5EFmshqyAV1n7LCEUSwAvBphkEC90mBBd+IBTFt31n3j0gAWrxC9DMQWCihQGAhShSCE4w3iWXO6wQBDM9HYaAIbFK9Hy2xRBQAdOxiYF8fFxjAsCAAGZuGAAWkeH3u6wwbhICDpACMPuwmdwGgg3CyEGymfQGgQ0FK0NKPjheXSGqqPvkPlkmg8NGDocR4ocXtAJAcANbAvUocHEdp1BCYdiypSapo+VH0bjElDE-zE+gkfInHWmz7bMb2UAtBpgDXrXlNCIRD5OMJJ-IRY7s0CJ5Op9MRK1VeLbJqFq2gm0GxQKtC1DBoEAAX2bSGjsfjIDzKbTGfiWaOMFzSd7FfWKAJ5YzqOttp0OG4nDQpVirfbIBjcdePYL-ZAg5z3dHe6L6w6penZ78c5r8LQ7FKHCDrbmY0Olf1MPolJAYzpDyXuON5VvO96Ptwz75G4Zw5DOID0AAwgAqtwABCAAiJAAKIAOr5OkjLQCCX6OmgojxDY8aPHSobsM2QA
Protocol: HTTP/1.1
Server: 52.20.172.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-172-27.compute-1.amazonaws.com
Software: / Express
Resource Hash: c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:17 GMT
X-Powered-By: Express
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T

GET
H/1.1 200
OK ptmd
dt.clnmde.com/ 70 B
476 B 114ms
114ms Image
image/gif 52.20.172.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://dt.clnmde.com/ptmd?t=158292331369331360191035_N4IgLgDghiBcDaiCMAaADAXSykBLAbnABw4DOYUYArqXPACwBMKSAnBjgF4yyogQBzOCEI4ApgDtCsfiBwCAFsKQBWIo1aMAzFqRaAbKx179aNkjRaVc8LRlImrImgDs9fYxVqb+OyH0AdGgBWoxENlAANnBaOABmAMZwALR8YjwgWgn6SHEARmJoySpQSAmpSOnJRFD0LtUuNWKMeXFQbWI2YmC4cKrqmsaxIORCsGhkANbKahrauloA+vRsOS5aaHWmXbgQykQqAawBSEQBRPo2VL3j4vjRCKASUAC2nTJ5uAAmX2IATotvjYvpQeKBPj9-oCvjMtD5cNCZgN5iZGi5GIw9C4QABfHEoJ6vd4gCG-AFAnAgihwcHfMmImSseEMkD9OZDJgqSwuLxIXH4wlvYSkqEUkBUsEkumimEyejMoH2WaDBYWFxoLyMNCXPEcEaRchI9kLfREcI4SJxPo4fAIxWs5Uo3SuDUqLWXHAJGhgFlEADCAFUVAAhAAi+gAogB1GwCJK8R06TEuJD6HAAR3efDiNzQOKAA
Protocol: HTTP/1.1
Server: 52.20.172.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-172-27.compute-1.amazonaws.com
Software: / Express
Resource Hash: c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 28 Feb 2020 20:55:21 GMT
X-Powered-By: Express
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T

POST
H/1.1 200
OK ptmdP
dt.clnmde.com/ 7 B
467 B 114ms
114ms Other
text/html 52.20.172.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: http://dt.clnmde.com/ptmdP
Requested by: Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU5BD6EW
Protocol: HTTP/1.1
Server: 52.20.172.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-172-27.compute-1.amazonaws.com
Software: / Express
Resource Hash: aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Request headers

Referer: http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html
Origin: http://securityaffairs.co
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Fri, 28 Feb 2020 20:55:23 GMT
ETag: W/"7-Jgyp3YpFd/wAt71YECmAdg"
X-Powered-By: Express
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
Content-Length: 7

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: securityaffairs.co
URL: https://securityaffairs.co/wordpress/?ga_action=googleanalytics_get_script

Verdicts & Comments Add Verdict or Comment

83 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.pxlclnmdecom-a.akamaihd.net/	1970-01-23 06:41:45	Name: bafp_t Value: 9de96d30-5a6c-11ea-9f79-3b802c446c0d
.pxlclnmdecom-a.akamaihd.net/	1970-01-19 07:42:05	Name: bfp_sn_td_2a17fb019fa8803fcc76a437c68e2235 Value: 1582923313_419617304760_2a17fb019fa8803fcc76a437c68e2235
.pxlclnmdecom-a.akamaihd.net/	1970-01-19 07:42:05	Name: bfp_sn_t_8b2087b102c9e3e5ffed1c1478ed8b78 Value: 1582923313_419617304760_8b2087b102c9e3e5ffed1c1478ed8b78
.media.net/	1970-01-19 16:26:12	Name: data-rk Value: 1041246334447302112~~1
.media.net/	1970-01-19 16:27:39	Name: data-max Value: 1234~~1
.media.net/	1970-01-19 16:27:39	Name: visitor-id Value: 2259249137947807000V10
.media.net/	1970-01-19 16:27:39	Name: data-dat Value: setstatuscode~~1
.securityaffairs.co/	1970-01-20 01:13:15	Name: __gads Value: ID=f797a5972b32a84f:T=1582923313:S=ALNI_MYI6uJBXGCbgeWPbFvqvuAckwjW1g
.securityaffairs.co/	1970-01-19 07:42:05	Name: bfp_sn_pl Value: 1582923313_419617304760
.securityaffairs.co/	1970-01-23 06:41:45	Name: bfp_sn_rf_8b2087b102c9e3e5ffed1c1478ed8b78 Value: Direct
.securityaffairs.co/	1970-01-23 06:41:45	Name: bafp Value: 9dd1ed90-5a6c-11ea-b859-b55fa8ae7ef6
.securityaffairs.co/	1970-01-19 14:15:18	Name: __unam Value: 6f69f6a-1708d94f112-73a0af9d-1
securityaffairs.co/	1969-12-31 23:59:59	Name: hbcm_sd Value: 1%7C1582923313495
.securityaffairs.co/	1970-01-23 06:41:45	Name: bfp_sn_rt_8b2087b102c9e3e5ffed1c1478ed8b78 Value: 1582923313695
.media.net/	1970-01-19 16:26:12	Name: data-bs Value: 925f7a93-a971-49d9-84ed-c867010f6cee~~1
.media.net/	1970-01-19 16:27:39	Name: data-som Value: 65c12ce666a8467a812ce666a8767a9b~~1
securityaffairs.co/	1970-01-19 07:42:05	Name: session_depth Value: securityaffairs.co%3D1%7C762221962%3D1%7C184323154%3D1%7C639665355%3D1
.pxlclnmdecom-a.akamaihd.net/	1970-01-19 07:42:05	Name: bfp_sn Value: 1582923313_419617304760
.media.net/	1970-01-19 16:27:39	Name: data-mf Value: 6fd4b13d-619e-4ac9-a602-5a3eef7d8c65~~1

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 23) Message: JQMIGRATE: Migrate is installed with logging active, version 1.4.1
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 45) Message: JQMIGRATE: jQuery.fn.load() is deprecated
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 47) Message: console.trace
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 45) Message: JQMIGRATE: jQuery.fn.unload() is deprecated
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=1.4.1(Line 47) Message: console.trace
console-api	info	URL: https://cdn.ampproject.org/rtv/012002141856310/amp4ads-v0.js(Line 412) Message: Powered by AMP ⚡ HTML – Version 2002141856310 http://securityaffairs.co/wordpress/98597/malware/lampion-malware-origin.html

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.gravatar.com
adservetx.media.net
adservice.google.com
adservice.google.de
buttons-config.sharethis.com
c.sharethis.mgr.consensu.org
cdn.ampproject.org
connect.facebook.net
contextual.media.net
dt.clnmde.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
gum.criteo.com
hblg.media.net
i0.wp.com
i1.wp.com
i2.wp.com
l.sharethis.com
lg3.media.net
maxcdn.bootstrapcdn.com
navvy.media.net
pagead2.googlesyndication.com
pixel.wp.com
platform-api.sharethis.com
pxlclnmdecom-a.akamaihd.net
qsearch-a.akamaihd.net
qsearch.media.net
securepubads.g.doubleclick.net
securityaffairs.co
seguranca-informatica.pt
stats.wp.com
tpc.googlesyndication.com
w.sharethis.com
www.google.com
www.googletagservices.com
securityaffairs.co
18.195.176.77
192.0.76.3
192.0.77.2
2.16.106.193
2.16.186.67
2001:4de0:ac19::1:b:3b
2001:8d8:100f:f000::289
216.58.206.2
23.62.140.165
2600:9000:2057:1200:1c:8a07:5e80:93a1
2600:9000:2057:4a00:3:c04e:c780:93a1
2600:9000:2057:c200:c:abe:f440:93a1
2600:9000:214f:2000:c:a9b7:ddc0:93a1
2606:4700:3032::681b:bd6c
2a00:1450:4001:800::2002
2a00:1450:4001:800::2003
2a00:1450:4001:80b::2002
2a00:1450:4001:815::200a
2a00:1450:4001:818::2001
2a00:1450:4001:820::2001
2a00:1450:4001:820::2002
2a00:1450:4001:821::2002
2a00:1450:4001:825::2002
2a00:1450:4001:825::2004
2a02:2638::1c
2a03:2880:f02d:12:face:b00c:0:3
2a04:fa87:fffe::c000:4902
52.20.172.27
52.9.163.168
92.122.253.103
002782949268e48866cb4d2aafbee3c58811263aeb4a67c9cced26628bf686be
00a4c9aeb6f61ae7f260eea51d5d19a651544c01d202363463375992ef021960
00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286
00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584
02c4b43857c2616180338c2ad7a4549e6cdaa2bb25494feb679f2e6ee9f939c7
03093d2dae94f2cc640097a3c00fe0fc95ef47f37e8b12ee4d6eeb0ecad93d23
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60
0bf3f6e79af33723b0c1a822f59a484a35583303ab76fa9227b694b1e719364f
0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878
0dd9397a0686d401ff156f472666ecd330cb16abff47d5429eec94dc382b476c
0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742
13f98e653f58cdacef8abf079910259b7cccebe94e4898d57bb700c35c2054a8
1423f118a35dc9c99fff8faa25d7dc1872bf55c5e4d3298b28ee0fc361a4ca5d
1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea
18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19
1a64c45342cbefaa822150ebedceb88e20e287e663025b6df063b31619fc6249
1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e02d63e11bf8f905451979939a09d0c4f6974de2484e630bb25814d6f380886
1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f
201990824355061c17611846b716b0a15e2cedecd07ec6b90aaf2a7113eda5b0
2189cc89b469101dbc2148cc58c8829f56c94fa94fab7fb7244af11c99c58974
2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3
226d604cdc1373a906bae5698538fcb46a51ddd79d3838e32fa32270cd9ad604
2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732
261a1dfeeccd3f6747dd6bb49e60579c2582910c2b225d23677772825bf7bc3d
2975d809361999f5926fbaf69f7b14667583ec967271ac73edb32d47a2307e4d
2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f
2cbb8dfc4483c9ce680df342866531ac656e8bed029dcd37a1872327023da5f8
307b097506408393263fd8f0c6b50d9766e038d0dae73e8c8d49ced5cd2a8ded
34761d696127e4f2f41c2d1f1b6883a09729da8626ca63630d37bca4a0e753ad
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
3cfd539b9f38739f22f2ee725cdef0de152c31b83da0ff715eaf82c2efc62258
3e5186ceaad1e4f5f0627d547c83b641503b28a5470d7457b40d3b82a1e7642b
45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6
4b449cc316af17efa8352b185ba13ea36eca7b1c23037ecd05f14587c264e55b
4cda38f3885dc3ed94fd7074ba106f5e92289d4a99ca163c01060328806b9945
50f4eb73e4854117bf7bf9da7dc0c17740b03b5db6eb7ee6ffc20aeb35c1ea48
51aee7d0b125131db0a989aedb86c115390f3dc7f54b007a6ce087505da23e81
51ba1b1d5ca3db43a92c894bda906efe86e3e929452f4f25ce431d77d49234ca
523355193fb189f80814831114b7ab4c66202e58ca5678a7692047a8d136ff8e
538923bc24457b182240d9535564c0037f89fbcf747e27f2d830768dc0b106ac
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee
56159a7fa211c042c8da7005984653715f938917383f74292247f7b271469fb6
57b8cffc507dabf69607d808c6b5274dc94367639278a2d5162afb987f0e0f5a
623ba67fdee04abb38857d8cb22124da662ae2d95d1ce5033a4df0ddcd444031
643a860832456b5a74825b79d625434b5c4c2a344b8f9bef3614b327bea52646
65941e51aae35a3de796e434dd8f5ed90f7469ddb3855f45850375c7b7abc069
65f006ace0216aee1b87fa240a933bd3e5251c38935540bd77871494301bb2d3
6629c7906bec8dde5bec5816dd5070bfceb9e84713facb874580ed50d98c2f3b
6d941ee14efe29bc4859114b4d6c93bd58d9843249a4e9d7603d6f80edb4eadf
7040011c9ed547b38418a696ba843b65c2a24e466dc651941c24b8848ead1527
71419dc0ae1b7f134eac1039537251d178812408a89ee40b6d9f65ee29f5e01c
7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46
74a4357c090bbffc845e0948dd038fe5bcbacdc3488e55217e559b6831e92f9c
759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1
76a18f5f0637e0d73ce1afece898ce8b0fa75bb6b1c1990ae4a7ac6b083045ce
781fad3cdbe782cc6489deafdefa128bb3504fd6e3785337b8ac5ab209a6dc28
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
7a8cf6b7fce01f318e416ae1904132265526ca2b6ef3003f7fe831186a7380a0
7f113eb1e51c742c3d9ac8a34e5f056bce7ec259e37aabe68b6dce50546f215c
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
803cacdc49e9d5149b9ba435022e87f412d10a80337353314d1c5068411ee28a
816709e9295a4116a9f1648dcdca148a141e0ee263887b39f474a923380e4310
81e82457fb12ef9a7b3981eceba4363763a703fd04bbe4da183903fd74e2cbcd
83738d24b1739f2bb3ea037e29b153ecf43bdc15c75eeb8cec9f73aa174b774e
85af764caf1a06ae6a5157778f0948982feda127210fea8b9cbd9c8e411addf4
8630a5e9b221470e4baf94299937bbe590b50a2f8340c7a16533cddf9288224b
8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535
8dae82c0959e2310509fc13b3bbaf6dd840239a2ef42a08375972c878034d92e
936c3e0cfba7a07ab55be383aeca9d39dcde7b4e9cddbfd973f78e34d3cc7078
949a74d5c9b30adeb638aed4ee5d24f5249c15761f8e82451fe0e9966a978324
9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
9dfd881b8dce6557fa028ba7c9f0e76759898ffb09833ecb0adf9a5b34d91bcd
9e93647793dfed19dabe4f90cbe14907b06b3df688da169cac3439cf38bb1b69
a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833
a461001c96496bb9955465a16ab189790b03aaae47533d69a346a62f780d7a13
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
a5752b3be278ea4c2aa9ec45787cb633e83315c19e379220b6df8a1fe62196eb
ad86827a35f33f44cfb9a95286a520b728d4cf9a277e17a8e25239ec04edb04f
aecbb7494580f4902d9b6686614623951c0d599a7a21fe0f855491b0f52987a7
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
b1040b4870a9503a2b7e81f781ed65e43f668bab13ee4ac0199a040d75d3728c
b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8
b834a80037718e3da7f92199034dc59611ed774af41f1e84fa1e0d97c4261192
ba11dcc61e68732fda7216c2317e162c29e0982620ac3ee673c8a491bcba3c47
bb7d97eb19604573681684dfe0fef40692a943c29f59d11e7ba9eb39242e4e3b
be0f64bb75a2a1d75e5c5db6642012d20b4cf7fb04845d1d289c93941f3903b9
c067a7d5bc50ed4ba554421966d6c4b0140ff2ed4574640fd5abcfa1ab35be11
c255d6cac869be47d929ac6aa30d708482b94258921f91d90e9740b7650354ba
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24
c971758a62027de3832dbb2a77d7b0d93b80ecce12e1c9acb0ebeba7884dc9d7
ccffa5096e12764aa6c84137becb13f6951fa531fcf9e56c93317d77de118fd0
cd606c728926a263166056197042ce45cc41b5440fa22ca24974b8da1e69b7d7
cf2925f057f8266b2d5d84d2dd756c81940f3eef3224d507e4ef677e7181449f
d931ba2089021a1357761939c18bcc09aa856d39be2a707ea450333f5b3443c4
d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008
dce50148adaff4dccd1d95c9b25563011436e398272d530e974193b8685340a2
dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e51ea3ce40f201a8fef72890cdadaf5263ed1064ad535a030c1d4a797fa8cf1f
e58e3184f269e1dbd8e247942242824cf71d306b91b66841f9e119c6af572115
e66106b9a3496eefb769d801bdff9ea5cc468c6e76015d560ce192ff3a555db2
e747521bc9729c30f06bda6471e77ad26ce0e05b104743e93fe14c8ef3b559a7
e76ea1aec186a6f4e42cf26dcdb80f5953a73b3a6d8aa2840fef68746bb8f693
e8851506f48f39b8e4aac07e674557a28ae7147b4f9f0c9c96c47cf3a6538324
e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964
e8cece7fcc8e81f27384afe1eefd48bce89a20bc8c73ef16f8d743a731b7f8d3
eb898cdafe2cf6e08984c5375be09414655e63de26bfd2718d817710530722b2
f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5
f0dc5a104ad07a87dec3f36b5ff8eb24b974cf484e1d378fdf7d4578ea9f4b9d
f2d6da97c49f62460890eb1f23f5d22db3355f62776241956a8cf20191068f88
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f7cfeb2796d608a88410160f76bdd0456b3fcf362859589f7eb300b3a069635c
fb932d90e9fed9b18e512d046bfd593e143f6c445db3a1eeee0d52407ca55d62
fd503ca2cb350bd8ecec266730289fd8a519faffe250b976f7963dc10bfd829c
fe4bbdad1d6dff75cde79f8afc07f29502bd4708cb0ce5f552083c3d81ba8382
ff538454ee741443627ee05b3c79b2763b2db0daa7d984c650691cdbe540d27c

securityaffairs.co Open in urlscan Pro 2001:8d8:100f:f000::289 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

166 Requests

60 %HTTPS

67 %IPv6

20 Domains

36 Subdomains

30 IPs

6 Countries

2799 kBTransfer

4752 kBSize

19 Cookies

25 Outgoing links

Redirected requests

166 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

securityaffairs.co Open in urlscan Pro
2001:8d8:100f:f000::289 Public Scan

Screenshot
Live screenshot

Full Image

166
Requests

60 %
HTTPS

67 %
IPv6

20
Domains

36
Subdomains

30
IPs

6
Countries

2799 kB
Transfer

4752 kB
Size

19
Cookies

166 HTTP transactions
6 data transactions