urlscan.io logo urlscan.io
SecurityTrails logo

symtrex.com Open in urlscan Pro
209.17.116.160  Public Scan

Go To Rescan Add Verdict Report
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Submission Tags: falconsandbox
Submission: On November 30 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 13 IPs in 3 countries across 11 domains to perform 43 HTTP transactions. The main IP is 209.17.116.160, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is symtrex.com.
TLS certificate: Issued by Network Solutions DV Server CA 2 on October 7th 2020. Valid for: a year.
This is the only time symtrex.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

18    209.17.116.160 (United States)

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
symtrex.com
1    2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
3    142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net
www.googleadservices.com
3    2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    143.204.101.199 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-101-199.fra50.r.cloudfront.net
d31y97ze264gaa.cloudfront.net
3    2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    107.162.156.70 (United States)

ASN55002 (DEFENSE-NET, US)
st1.dialogtech.com
1    2a00:1450:400c:c09::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
2    2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
3    2a00:1450:4001:831::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
4    2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
2    2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
Domain Requested by
18 symtrex.com symtrex.com
4 www.google.de symtrex.com
3 www.google.com symtrex.com
3 www.google-analytics.com symtrex.com
www.google-analytics.com
3 fonts.gstatic.com fonts.googleapis.com
3 www.googleadservices.com 1 redirects symtrex.com
www.googletagmanager.com
2 www.gstatic.com www.googletagmanager.com
www.gstatic.com
2 googleads.g.doubleclick.net www.googleadservices.com
2 www.googletagmanager.com symtrex.com
www.googletagmanager.com
1 stats.g.doubleclick.net www.google-analytics.com
1 st1.dialogtech.com d31y97ze264gaa.cloudfront.net
1 d31y97ze264gaa.cloudfront.net symtrex.com
1 fonts.googleapis.com symtrex.com
43 13
Subject Issuer Validity Valid
symtrex.com
Network Solutions DV Server CA 2		 2020-10-07 -
2021-09-25		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
www.googleadservices.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.cloudfront.net
Amazon		 2021-03-19 -
2022-03-17		 a year crt.sh
*.dialogtech.com
DigiCert SHA2 Secure Server CA		 2020-02-06 -
2022-05-11		 2 years crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
www.google.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
www.google.de
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.googleadservices.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.google.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.google.de
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Frame ID: FB39DEE2A9D594EAA7E0852CAA73DDCE
Requests: 43 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

How does Locky ransomware use DGA in its attacks? - Symtrex Inc.

Page Statistics

43
Requests

56 %
HTTPS

69 %
IPv6

11
Domains

13
Subdomains

13
IPs

3
Countries

370 kB
Transfer

839 kB
Size

6
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 39
  • https://www.googleadservices.com/pagead/conversion/921062171/wcm?cc=ZZ&dn=8664318972&cl=MehACMm_u5UBEJuWmbcD&ct_eid=2 HTTP 302
  • https://www.google.de/pagead/attribution/wcm?cc=ZZ&dn=8664318972&cl=MehACMm_u5UBEJuWmbcD

43 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/ 		66 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 / PHP/7.0.33
Resource Hash
88ca19aba4d89c4387794e36d26f46d13b51f17871fdd9dba6e3146b4d9300c7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

server
openresty/1.17.8.2
date
Tue, 30 Nov 2021 07:38:20 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding X-Forwarded-Proto,Accept-Encoding
x-powered-by
PHP/7.0.33
strict-transport-security
max-age=31536000
last-modified
Tue, 30 Nov 2021 07:30:29 GMT
cache-control
max-age=0
expires
Tue, 30 Nov 2021 07:38:20 GMT
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
"1; mode=block"
referrer-policy
no-referrer-when-downgrade
x-webcom-cache-status
BYPASS
content-encoding
gzip
style-94f64132eb41afc2ced69448a5011df4.css
symtrex.com/wp-content/cache/min/1/wp-content/themes/enterprise-pro/ 		29 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://symtrex.com/wp-content/cache/min/1/wp-content/themes/enterprise-pro/style-94f64132eb41afc2ced69448a5011df4.css
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
91f1c4f5dd4891c909eef02e3ef445ede616af7535970ac3afff5ca0fdb88f61
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:20 GMT
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 30 Mar 2021 19:12:58 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, X-Forwarded-Proto,Accept-Encoding
content-type
text/css; charset=utf-8
cache-control
max-age=31536000, public
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-xss-protection
"1; mode=block"
expires
Wed, 30 Nov 2022 07:38:20 GMT
style.min.css
symtrex.com/wp-includes/css/dist/block-library/ 		52 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://symtrex.com/wp-includes/css/dist/block-library/style.min.css?ver=5.4.8
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:20 GMT
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 26 May 2020 19:15:54 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, X-Forwarded-Proto,Accept-Encoding
content-type
text/css; charset=utf-8
cache-control
max-age=31536000, public
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-xss-protection
"1; mode=block"
expires
Wed, 30 Nov 2022 07:38:20 GMT
styles-078a640c19b9107743d468b9a710a28f.css
symtrex.com/wp-content/cache/min/1/wp-content/plugins/contact-form-7/includes/css/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://symtrex.com/wp-content/cache/min/1/wp-content/plugins/contact-form-7/includes/css/styles-078a640c19b9107743d468b9a710a28f.css
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
f08b45361f73a88a63c04a5a87a7ac8b2f96dcd445ae25fac8aebb51d8421a9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:20 GMT
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 30 Mar 2021 19:12:58 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, X-Forwarded-Proto,Accept-Encoding
content-type
text/css; charset=utf-8
cache-control
max-age=31536000, public
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-xss-protection
"1; mode=block"
expires
Wed, 30 Nov 2022 07:38:20 GMT
style-b7472b9074e777f479026495a1ad4f94.css
symtrex.com/wp-content/cache/min/1/wp-content/plugins/floating-social-media-icon/css/ 		412 B
799 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://symtrex.com/wp-content/cache/min/1/wp-content/plugins/floating-social-media-icon/css/style-b7472b9074e777f479026495a1ad4f94.css
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
48a042784a470512be9dd511dea19694eb12bf94f5492ea48e62e10c70b9d0e3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:20 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 11 Nov 2021 05:02:08 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
x-xss-protection
"1; mode=block"
cache-control
max-age=31536000, public
strict-transport-security
max-age=31536000
accept-ranges
bytes
vary
X-Forwarded-Proto,Accept-Encoding
content-length
412
x-content-type-options
nosniff
expires
Wed, 30 Nov 2022 07:38:20 GMT
dashicons.min.css
symtrex.com/wp-includes/css/ 		46 KB
30 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://symtrex.com/wp-includes/css/dashicons.min.css?ver=5.4.8
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
de7bdcb93f2804e963f238713752a30a22a3a3afef6070fb78d206e6199cd353
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:20 GMT
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 15 Apr 2021 04:37:52 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, X-Forwarded-Proto,Accept-Encoding
content-type
text/css; charset=utf-8
cache-control
max-age=31536000, public
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-xss-protection
"1; mode=block"
expires
Wed, 30 Nov 2022 07:38:20 GMT
css
fonts.googleapis.com/ 		3 KB
999 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Lato%3A300%2C700%2C300italic%7CTitillium+Web%3A600&ver=2.1.1
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
5faa7bdc7fb2817668c02defcb54c107fb0c9643c16b394aad0b62024921ab54
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 30 Nov 2021 07:33:35 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 30 Nov 2021 07:38:20 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 30 Nov 2021 07:38:20 GMT
jquery.js
symtrex.com/wp-includes/js/jquery/ 		95 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://symtrex.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:20 GMT
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 21 Feb 2020 22:23:17 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, X-Forwarded-Proto,Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-xss-protection
"1; mode=block"
expires
Wed, 30 Nov 2022 07:38:20 GMT
jquery-migrate.min.js
symtrex.com/wp-includes/js/jquery/ 		10 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://symtrex.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:21 GMT
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 06 Oct 2017 18:57:16 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, X-Forwarded-Proto,Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-xss-protection
"1; mode=block"
expires
Wed, 30 Nov 2022 07:38:21 GMT
popup-f0a0abbd27de772ccc0c9f84e8bbb15c.js
symtrex.com/wp-content/cache/min/1/wp-content/plugins/alligator-popup/js/ 		388 B
784 B 		Script
General
Check archive.org
Download Go to
Full URL
https://symtrex.com/wp-content/cache/min/1/wp-content/plugins/alligator-popup/js/popup-f0a0abbd27de772ccc0c9f84e8bbb15c.js
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
be3b9f66ccd78042158b80f58abaa22c86bf65d806ddbc205c948b491f1a4806
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:21 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Mon, 02 Mar 2020 15:44:14 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
x-xss-protection
"1; mode=block"
cache-control
max-age=31536000, public
strict-transport-security
max-age=31536000
accept-ranges
bytes
vary
X-Forwarded-Proto,Accept-Encoding
content-length
388
x-content-type-options
nosniff
expires
Wed, 30 Nov 2022 07:38:21 GMT
responsive-menu-819e1dcdc55f432d3d90e49714e54c6f.js
symtrex.com/wp-content/cache/min/1/wp-content/themes/enterprise-pro/js/ 		697 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://symtrex.com/wp-content/cache/min/1/wp-content/themes/enterprise-pro/js/responsive-menu-819e1dcdc55f432d3d90e49714e54c6f.js
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
9baadff8d14f3000a5a588b5ea2fbde2ca7658bc981dba54e1e77b2b7b0b3262
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:21 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Mon, 02 Mar 2020 15:44:14 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
x-xss-protection
"1; mode=block"
cache-control
max-age=31536000, public
strict-transport-security
max-age=31536000
accept-ranges
bytes
vary
X-Forwarded-Proto,Accept-Encoding
content-length
697
x-content-type-options
nosniff
expires
Wed, 30 Nov 2022 07:38:21 GMT
js
www.googletagmanager.com/gtag/ 		90 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-134843895-1
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
c20357e3048b04edccabcc45b4ec3c2babf9e7765a5aed295b786e736f23731c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:21 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36151
x-xss-protection
0
last-modified
Tue, 30 Nov 2021 06:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 30 Nov 2021 07:38:21 GMT
facebook.png
symtrex.com/wp-content/plugins/floating-social-media-icon/images/themes/1/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://symtrex.com/wp-content/plugins/floating-social-media-icon/images/themes/1/facebook.png
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
9d62e0ead87b7432af1765a27fa54709dd243c499f010c20567552ef3e71dcb7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:21 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Mon, 19 Aug 2019 19:06:29 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
content-type
image/png
x-xss-protection
"1; mode=block"
cache-control
max-age=10368000, public
strict-transport-security
max-age=31536000
accept-ranges
bytes
vary
X-Forwarded-Proto,Accept-Encoding
content-length
1869
x-content-type-options
nosniff
expires
Wed, 30 Mar 2022 07:38:21 GMT
twitter.png
symtrex.com/wp-content/plugins/floating-social-media-icon/images/themes/1/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://symtrex.com/wp-content/plugins/floating-social-media-icon/images/themes/1/twitter.png
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
f2c2127051527a0b4d2c8fb642920551d812cbf233634011412144150dacce2c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:21 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Mon, 19 Aug 2019 19:06:29 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
content-type
image/png
x-xss-protection
"1; mode=block"
cache-control
max-age=10368000, public
strict-transport-security
max-age=31536000
accept-ranges
bytes
vary
X-Forwarded-Proto,Accept-Encoding
content-length
6312
x-content-type-options
nosniff
expires
Wed, 30 Mar 2022 07:38:21 GMT
linkedin.png
symtrex.com/wp-content/plugins/floating-social-media-icon/images/themes/1/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://symtrex.com/wp-content/plugins/floating-social-media-icon/images/themes/1/linkedin.png
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
6577ae5dd231c9956d5ea412fcf0b12d15dc8c0557a0e4249ffd1a0c49459f35
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:21 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Mon, 19 Aug 2019 19:06:29 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
content-type
image/png
x-xss-protection
"1; mode=block"
cache-control
max-age=10368000, public
strict-transport-security
max-age=31536000
accept-ranges
bytes
vary
X-Forwarded-Proto,Accept-Encoding
content-length
1877
x-content-type-options
nosniff
expires
Wed, 30 Mar 2022 07:38:21 GMT
requestmoreinformation.fw_-300x40.png
symtrex.com/wp-content/uploads/2017/02/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://symtrex.com/wp-content/uploads/2017/02/requestmoreinformation.fw_-300x40.png
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
69ad2305dbb5aca0663f842ced457f1475649e312c33f78acafcbafc7a655482
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:21 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 26 Mar 2019 18:31:41 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
content-type
image/png
x-xss-protection
"1; mode=block"
cache-control
max-age=10368000, public
strict-transport-security
max-age=31536000
accept-ranges
bytes
vary
X-Forwarded-Proto,Accept-Encoding
content-length
1398
x-content-type-options
nosniff
expires
Wed, 30 Mar 2022 07:38:21 GMT
rss.png
symtrex.com/wp-includes/images/ 		608 B
985 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://symtrex.com/wp-includes/images/rss.png
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
0c6daa646e0a867e5f721b5017c98cfd2c82c26c60b614531ddae8a5d9986be8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:21 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 06 Oct 2017 18:57:05 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
content-type
image/png
x-xss-protection
"1; mode=block"
cache-control
max-age=10368000, public
strict-transport-security
max-age=31536000
accept-ranges
bytes
vary
X-Forwarded-Proto,Accept-Encoding
content-length
608
x-content-type-options
nosniff
expires
Wed, 30 Mar 2022 07:38:21 GMT
conversion.js
www.googleadservices.com/pagead/ 		45 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion.js
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f2.1e100.net
Software
cafe /
Resource Hash
4112275fe878d4b037316a449f7516817d3c7da7839eb532b81c80b309b36df5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17627
x-xss-protection
0
server
cafe
etag
16294007831590153160
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 30 Nov 2021 07:38:21 GMT
scripts-7d446616fbe4b1ba5ac44a3ee8ce390a.js
symtrex.com/wp-content/cache/min/1/wp-content/plugins/contact-form-7/includes/js/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://symtrex.com/wp-content/cache/min/1/wp-content/plugins/contact-form-7/includes/js/scripts-7d446616fbe4b1ba5ac44a3ee8ce390a.js
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
46358b08c9bfb45ca14519fa1a98a1d9e3b62a09a66458feaabf0f5dfd410ffa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:21 GMT
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 26 May 2020 19:09:15 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, X-Forwarded-Proto,Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-xss-protection
"1; mode=block"
expires
Wed, 30 Nov 2022 07:38:21 GMT
comment-reply.min.js
symtrex.com/wp-includes/js/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://symtrex.com/wp-includes/js/comment-reply.min.js?ver=5.4.8
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
4f00ec40b144121114b6cec693fccc2b51a06ab01fc34defa466467b581a7f2c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:21 GMT
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 15 Apr 2021 04:37:54 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, X-Forwarded-Proto,Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-xss-protection
"1; mode=block"
expires
Wed, 30 Nov 2022 07:38:21 GMT
logo-symtrex_2.jpg
symtrex.com/wp-content/uploads/2015/04/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://symtrex.com/wp-content/uploads/2015/04/logo-symtrex_2.jpg
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.17.116.160 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
Software
openresty/1.17.8.2 /
Resource Hash
e1e0f90643a8241318fa8a0ba95b86cd5f22b357ec952f8b39695d80b54b5940
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:21 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 08 Aug 2018 20:02:56 GMT
server
openresty/1.17.8.2
x-webcom-cache-status
BYPASS
x-frame-options
SAMEORIGIN
content-type
image/jpeg
x-xss-protection
"1; mode=block"
cache-control
max-age=10368000, public
strict-transport-security
max-age=31536000
accept-ranges
bytes
vary
X-Forwarded-Proto,Accept-Encoding
content-length
3918
x-content-type-options
nosniff
expires
Wed, 30 Mar 2022 07:38:21 GMT
S6u9w4BMUTPHh7USSwiPGQ.woff2
fonts.gstatic.com/s/lato/v20/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v20/S6u9w4BMUTPHh7USSwiPGQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato%3A300%2C700%2C300italic%7CTitillium+Web%3A600&ver=2.1.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9194059997d722ec01e41980dffbff03ebe00808b1cdd164a7fd18a561bc312a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://symtrex.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 24 Nov 2021 02:43:26 GMT
x-content-type-options
nosniff
age
536095
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
23248
x-xss-protection
0
last-modified
Tue, 10 Aug 2021 00:18:53 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 24 Nov 2022 02:43:26 GMT
NaPDcZTIAOhVxoMyOr9n_E7ffBzCGItzYw.woff2
fonts.gstatic.com/s/titilliumweb/v10/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/titilliumweb/v10/NaPDcZTIAOhVxoMyOr9n_E7ffBzCGItzYw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato%3A300%2C700%2C300italic%7CTitillium+Web%3A600&ver=2.1.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ef8a5f444c988e2c08260642c8257654f5e825e839a9c3d355933d4d12e0345b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://symtrex.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 23 Nov 2021 14:06:47 GMT
x-content-type-options
nosniff
age
581494
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12300
x-xss-protection
0
last-modified
Tue, 29 Jun 2021 22:44:22 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 23 Nov 2022 14:06:47 GMT
S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v20/ 		22 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/lato/v20/S6u9w4BMUTPHh6UVSwiPGQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato%3A300%2C700%2C300italic%7CTitillium+Web%3A600&ver=2.1.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://symtrex.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 26 Nov 2021 04:27:49 GMT
x-content-type-options
nosniff
age
357032
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22992
x-xss-protection
0
last-modified
Tue, 10 Aug 2021 00:18:57 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 26 Nov 2022 04:27:49 GMT
st.js
d31y97ze264gaa.cloudfront.net/assets/st/js/ 		68 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d31y97ze264gaa.cloudfront.net/assets/st/js/st.js
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
143.204.101.199 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-101-199.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
578a6a6e76d78cbdb5c4aa5b475c20f71ec0a8b6e277423c6ae9d139271d2275

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Tue, 30 Nov 2021 07:37:30 GMT
Content-Encoding
gzip
Last-Modified
Tue, 14 Sep 2021 16:40:59 GMT
Server
AmazonS3
Age
336
ETag
W/"3ada7e792244a7508ebe96ee72971ce6"
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 1b73451818d2dd47a574604c0b84f692.cloudfront.net (CloudFront)
Connection
keep-alive
Transfer-Encoding
chunked
X-Amz-Cf-Pop
FRA50-C1
X-Amz-Cf-Id
dXZQhVy1KWmUambhQNoZLV5JOg7hO5HE3V_kZIyCMIffE7j3qFGfDQ==
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
198
date
Tue, 30 Nov 2021 07:35:03 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Tue, 30 Nov 2021 09:35:03 GMT
collect
www.google-analytics.com/j/ 		4 B
206 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1722722856&t=pageview&_s=1&dl=https%3A%2F%2Fsymtrex.com%2Fhow-does-locky-ransomware-use-dga-in-its-attacks%2F&ul=en-us&de=UTF-8&dt=How%20does%20Locky%20ransomware%20use%20DGA%20in%20its%20attacks%3F%20-%20Symtrex%20Inc.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=641579663&gjid=1374551842&cid=2110653251.1638257901&tid=UA-104619175-1&_gid=254978321.1638257901&_r=1&_slc=1&z=833482627
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 07:38:21 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://symtrex.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
st1.dialogtech.com/st/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://st1.dialogtech.com/st/?_stk=ae9261cf2f8dcc0b7257f19a260e71c6cdbf7364&dr=&dl=https%3A%2F%2Fsymtrex.com%2Fhow-does-locky-ransomware-use-dga-in-its-attacks%2F&dt=How%20does%20Locky%20ransomware%20use%20DGA%20in%20its%20attacks%3F%20-%20Symtrex%20Inc.&vp=1600x1200&sr=1600x1200&ua=UA-104619175-1&uac=2110653251.1638257901&cb=1638257901314&stv=38
Requested by
Host: d31y97ze264gaa.cloudfront.net
URL: https://d31y97ze264gaa.cloudfront.net/assets/st/js/st.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
107.162.156.70 , United States, ASN55002 (DEFENSE-NET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 30 Nov 2021 07:38:21 GMT
Via
1.1 fra1-bit20
Last-Modified
Tue Nov 30 2021 07:38:21 GMT+0000 (Coordinated Universal Time)
Vary
Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
collect
www.google-analytics.com/j/ 		1 B
21 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1722722856&t=pageview&_s=1&dl=https%3A%2F%2Fsymtrex.com%2Fhow-does-locky-ransomware-use-dga-in-its-attacks%2F&ul=en-us&de=UTF-8&dt=How%20does%20Locky%20ransomware%20use%20DGA%20in%20its%20attacks%3F%20-%20Symtrex%20Inc.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHDAAUABAAAAAC~&jid=1841974760&gjid=1137077538&cid=2110653251.1638257901&tid=UA-134843895-1&_gid=254978321.1638257901&_r=1&gtm=2ouba1&z=506591482
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 07:38:21 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://symtrex.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		97 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-921062171&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-134843895-1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d811425d1cf28c0e86de4b569e25905ed8e71fe40736d9c69ff2be4d904a85e7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:21 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39522
x-xss-protection
0
last-modified
Tue, 30 Nov 2021 06:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 30 Nov 2021 07:38:21 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
439 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-104619175-1&cid=2110653251.1638257901&jid=641579663&gjid=1374551842&_gid=254978321.1638257901&_u=IEBAAEAAAAAAAC~&z=1180836451
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c09::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 30 Nov 2021 07:38:21 GMT
content-type
text/plain
access-control-allow-origin
https://symtrex.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/921062171/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/921062171/?random=1638257901361&cv=9&fst=1638257901361&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603261&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fsymtrex.com%2Fhow-does-locky-ransomware-use-dga-in-its-attacks%2F&tiba=How%20does%20Locky%20ransomware%20use%20DGA%20in%20its%20attacks%3F%20-%20Symtrex%20Inc.&hn=www.googleadservices.com&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8b10adfe3df903feb43e12b02f099d62590d882088dc9b8bb77df6a7f35486a5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 07:38:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1058
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-104619175-1&cid=2110653251.1638257901&jid=641579663&_u=IEBAAEAAAAAAAC~&z=2094638294
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 07:38:21 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-104619175-1&cid=2110653251.1638257901&jid=641579663&_u=IEBAAEAAAAAAAC~&z=2094638294
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 07:38:21 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
conversion_async.js
www.googleadservices.com/pagead/ 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-921062171&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f2.1e100.net
Software
cafe /
Resource Hash
2e8548e063ae8b8f6225ac344af4bb535397ebd3003665e27e8d4b2716770db9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14378
x-xss-protection
0
server
cafe
etag
684346926396516684
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 30 Nov 2021 07:38:21 GMT
loader.js
www.gstatic.com/wcm/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/wcm/loader.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-921062171&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9f959aaad80347edc26ed8279c6a68c098efc76876ac2e2f8ccc54b118f197f4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:03:01 GMT
content-encoding
br
x-content-type-options
nosniff
age
2120
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1339
x-xss-protection
0
last-modified
Mon, 15 Mar 2021 16:45:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Tue, 30 Nov 2021 08:03:01 GMT
/
www.google.com/pagead/1p-user-list/921062171/ 		42 B
154 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/921062171/?random=1638257901361&cv=9&fst=1638255600000&num=1&guid=ON&eid=375603261&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fsymtrex.com%2Fhow-does-locky-ransomware-use-dga-in-its-attacks%2F&tiba=How%20does%20Locky%20ransomware%20use%20DGA%20in%20its%20attacks%3F%20-%20Symtrex%20Inc.&fmt=3&is_vtc=1&random=3732224626&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 07:38:21 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/921062171/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/921062171/?random=1638257901361&cv=9&fst=1638255600000&num=1&guid=ON&eid=375603261&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fsymtrex.com%2Fhow-does-locky-ransomware-use-dga-in-its-attacks%2F&tiba=How%20does%20Locky%20ransomware%20use%20DGA%20in%20its%20attacks%3F%20-%20Symtrex%20Inc.&fmt=3&is_vtc=1&random=3732224626&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 07:38:21 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
call-tracking_7.js
www.gstatic.com/call-tracking/ 		54 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/call-tracking/call-tracking_7.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/wcm/loader.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ff2fde453aa6220144126828a284d4cc227479f1fe83beef3a6b6a4504c7e4df
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 26 Nov 2021 04:13:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
357872
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-telephony
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21020
x-xss-protection
0
last-modified
Wed, 03 Feb 2021 22:45:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-telephony"
vary
Accept-Encoding
report-to
{"group":"ads-telephony","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-telephony"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 26 Nov 2022 04:13:49 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/921062171/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/921062171/?random=1638257901547&cv=9&fst=1638257901547&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaba1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsymtrex.com%2Fhow-does-locky-ransomware-use-dga-in-its-attacks%2F&tiba=How%20does%20Locky%20ransomware%20use%20DGA%20in%20its%20attacks%3F%20-%20Symtrex%20Inc.&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8fb555dd881d09f63f41836cdbf70060e74116114f55baa87c8fed49f99e07b3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 07:38:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1089
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
wcm
www.google.de/pagead/attribution/
Redirect Chain
  • https://www.googleadservices.com/pagead/conversion/921062171/wcm?cc=ZZ&dn=8664318972&cl=MehACMm_u5UBEJuWmbcD&ct_eid=2
  • https://www.google.de/pagead/attribution/wcm?cc=ZZ&dn=8664318972&cl=MehACMm_u5UBEJuWmbcD
80 B
111 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google.de/pagead/attribution/wcm?cc=ZZ&dn=8664318972&cl=MehACMm_u5UBEJuWmbcD
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H3
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d933a98657089095397ca6126d62e3a07c39e70f82b36f8cea002c0ba5bf1e2c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 07:38:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
application/json; charset=UTF-8
access-control-allow-origin
null
cache-control
private
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
87
x-xss-protection
0

Redirect headers

timing-allow-origin
*
date
Tue, 30 Nov 2021 07:38:21 GMT
x-content-type-options
nosniff
server
cafe
location
https://www.google.de/pagead/attribution/wcm?cc=ZZ&dn=8664318972&cl=MehACMm_u5UBEJuWmbcD
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
https://symtrex.com
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
/
www.google.com/pagead/1p-user-list/921062171/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/921062171/?random=1638257901547&cv=9&fst=1638255600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaba1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsymtrex.com%2Fhow-does-locky-ransomware-use-dga-in-its-attacks%2F&tiba=How%20does%20Locky%20ransomware%20use%20DGA%20in%20its%20attacks%3F%20-%20Symtrex%20Inc.&async=1&fmt=3&is_vtc=1&random=106016059&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 07:38:21 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/921062171/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/921062171/?random=1638257901547&cv=9&fst=1638255600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaba1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsymtrex.com%2Fhow-does-locky-ransomware-use-dga-in-its-attacks%2F&tiba=How%20does%20Locky%20ransomware%20use%20DGA%20in%20its%20attacks%3F%20-%20Symtrex%20Inc.&async=1&fmt=3&is_vtc=1&random=106016059&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: symtrex.com
URL: https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://symtrex.com/how-does-locky-ransomware-use-dga-in-its-attacks/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 Nov 2021 07:38:21 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

81 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler undefined| $ function| jQuery function| gtag object| dataLayer function| loadCSS string| _stk string| GoogleAnalyticsObject function| ga object| google_conversion_id object| google_custom_params object| google_remarketing_only object| wpcf7 object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| $jscomp function| $jscomp$lookupPolyfilledValue object| _st undefined| JSON3 object| google_tag_manager function| GooglemKTybQhCsO object| google_conversion_date object| google_conversion_time number| google_conversion_snippets number| google_conversion_first_time object| google_conversion_js_version object| google_conversion_format object| google_enable_display_cookie_match object| google_conversion_type object| google_conversion_order_id object| google_conversion_language object| google_conversion_value object| google_conversion_currency object| google_conversion_domain object| google_conversion_label object| google_conversion_color object| google_disable_viewthrough object| google_gtag_event_data object| google_conversion_linker object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_allow_ad_personalization_signals object| google_restricted_data_processing object| google_conversion_items object| google_conversion_merchant_id object| google_user_id object| onload_callback object| opt_image_generator object| google_gtm_url_processor object| google_conversion_page_url object| google_conversion_referrer_url object| google_gtm object| google_gcl_cookie_prefix object| google_gcl_cookie_path object| google_gcl_cookie_flags object| google_gcl_cookie_domain object| google_gcl_cookie_max_age_seconds object| google_read_gcl_cookie_opt_out object| google_basket_feed_country object| google_basket_feed_language object| google_basket_discount object| google_basket_transaction_type object| google_additional_conversion_params object| google_additional_params object| google_transport_url object| google_gtm_experiments function| _googWcmImpl string| _googWcmAk function| google_trackConversion object| GooglebQhCsO function| _googWccDebug function| _googCallTrackingImpl function| _gaPhoneImpl object| addComment object| jQuery112409711083139999517 string| google_wcc_status

6 Cookies

Domain/Path Name / Value
.symtrex.com/ Name: _ga
Value: GA1.2.2110653251.1638257901
.symtrex.com/ Name: _gid
Value: GA1.2.254978321.1638257901
.symtrex.com/ Name: _gat
Value: 1
.symtrex.com/ Name: _gat_gtag_UA_134843895_1
Value: 1
.symtrex.com/ Name: _gcl_au
Value: 1.1.18553873.1638257901
.doubleclick.net/ Name: IDE
Value: AHWqTUkSbgqputpB6J56xCeRq9EGELo8upidRi9tJ9qZAVhYQ-amTY-SFGWjPvva

2 Console Messages

Source Level URL
Text
javascript warning URL: https://www.googleadservices.com/pagead/conversion.js(Line 27)
Message:
Failed to execute 'write' on 'Document': It isn't possible to write into a document from an asynchronously-loaded external script unless it is explicitly opened.
network error URL: https://st1.dialogtech.com/st/?_stk=ae9261cf2f8dcc0b7257f19a260e71c6cdbf7364&dr=&dl=https%3A%2F%2Fsymtrex.com%2Fhow-does-locky-ransomware-use-dga-in-its-attacks%2F&dt=How%20does%20Locky%20ransomware%20use%20DGA%20in%20its%20attacks%3F%20-%20Symtrex%20Inc.&vp=1600x1200&sr=1600x1200&ua=UA-104619175-1&uac=2110653251.1638257901&cb=1638257901314&stv=38
Message:
Failed to load resource: the server responded with a status of 403 (No account found with _stk)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection "1; mode=block"

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d31y97ze264gaa.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
st1.dialogtech.com
stats.g.doubleclick.net
symtrex.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
107.162.156.70
142.250.184.226
143.204.101.199
209.17.116.160
2a00:1450:4001:802::2003
2a00:1450:4001:810::200a
2a00:1450:4001:811::200e
2a00:1450:4001:813::2002
2a00:1450:4001:82a::2003
2a00:1450:4001:82b::2003
2a00:1450:4001:82f::2008
2a00:1450:4001:831::2004
2a00:1450:400c:c09::9c
0c6daa646e0a867e5f721b5017c98cfd2c82c26c60b614531ddae8a5d9986be8
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
2e8548e063ae8b8f6225ac344af4bb535397ebd3003665e27e8d4b2716770db9
4112275fe878d4b037316a449f7516817d3c7da7839eb532b81c80b309b36df5
46358b08c9bfb45ca14519fa1a98a1d9e3b62a09a66458feaabf0f5dfd410ffa
48a042784a470512be9dd511dea19694eb12bf94f5492ea48e62e10c70b9d0e3
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4f00ec40b144121114b6cec693fccc2b51a06ab01fc34defa466467b581a7f2c
578a6a6e76d78cbdb5c4aa5b475c20f71ec0a8b6e277423c6ae9d139271d2275
5faa7bdc7fb2817668c02defcb54c107fb0c9643c16b394aad0b62024921ab54
6577ae5dd231c9956d5ea412fcf0b12d15dc8c0557a0e4249ffd1a0c49459f35
69ad2305dbb5aca0663f842ced457f1475649e312c33f78acafcbafc7a655482
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
88ca19aba4d89c4387794e36d26f46d13b51f17871fdd9dba6e3146b4d9300c7
8b10adfe3df903feb43e12b02f099d62590d882088dc9b8bb77df6a7f35486a5
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
8fb555dd881d09f63f41836cdbf70060e74116114f55baa87c8fed49f99e07b3
9194059997d722ec01e41980dffbff03ebe00808b1cdd164a7fd18a561bc312a
91f1c4f5dd4891c909eef02e3ef445ede616af7535970ac3afff5ca0fdb88f61
9baadff8d14f3000a5a588b5ea2fbde2ca7658bc981dba54e1e77b2b7b0b3262
9d62e0ead87b7432af1765a27fa54709dd243c499f010c20567552ef3e71dcb7
9f959aaad80347edc26ed8279c6a68c098efc76876ac2e2f8ccc54b118f197f4
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d
be3b9f66ccd78042158b80f58abaa22c86bf65d806ddbc205c948b491f1a4806
c20357e3048b04edccabcc45b4ec3c2babf9e7765a5aed295b786e736f23731c
d811425d1cf28c0e86de4b569e25905ed8e71fe40736d9c69ff2be4d904a85e7
d933a98657089095397ca6126d62e3a07c39e70f82b36f8cea002c0ba5bf1e2c
de7bdcb93f2804e963f238713752a30a22a3a3afef6070fb78d206e6199cd353
e1e0f90643a8241318fa8a0ba95b86cd5f22b357ec952f8b39695d80b54b5940
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef8a5f444c988e2c08260642c8257654f5e825e839a9c3d355933d4d12e0345b
f08b45361f73a88a63c04a5a87a7ac8b2f96dcd445ae25fac8aebb51d8421a9d
f2c2127051527a0b4d2c8fb642920551d812cbf233634011412144150dacce2c
ff2fde453aa6220144126828a284d4cc227479f1fe83beef3a6b6a4504c7e4df