www.nisos.com Open in urlscan Pro
162.159.134.42 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
Submission: On June 14 via api (June 14th 2023, 3:34:08 pm UTC) from DE — Scanned from DE

Summary HTTP 110 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 34 IPs in 5 countries across 26 domains to perform 110 HTTP transactions. The main IP is 162.159.134.42, located in and belongs to CLOUDFLARENET, US. The main domain is www.nisos.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 7th 2022. Valid for: a year.

This is the only time www.nisos.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
50	162.159.134.42 162.159.134.42	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:830::2008	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:1634	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:863b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.66.192.125 18.66.192.125	16509 (AMAZON-02) (AMAZON-02)
1	52.200.29.199 52.200.29.199	14618 (AMAZON-AES) (AMAZON-AES)
5	23.36.163.106 23.36.163.106	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
3	2606:4700:e6:... 2606:4700:e6::ac40:ca1c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.227.219.3 13.227.219.3	16509 (AMAZON-02) (AMAZON-02)
3	2606:4700::68... 2606:4700::6812:19c4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:77be	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:816e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:88ce	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6811:6bc7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a02:26f0:310... 2a02:26f0:3100::1735:28a8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 5	2600:9000:225... 2600:9000:225e:3a00:6:9280:1080:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2001:4860:480... 2001:4860:4802:38::178	15169 (GOOGLE) (GOOGLE)
1	18.66.112.110 18.66.112.110	16509 (AMAZON-02) (AMAZON-02)
1	34.255.78.124 34.255.78.124	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:237... 2600:9000:237d:ec00:2:53b2:240:93a1	16509 (AMAZON-02) (AMAZON-02)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
1	54.229.94.52 54.229.94.52	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f14:cc6... 2600:1f14:cc6:ea04:4d6d:dcdd:12a6:3f04	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6811:d6f3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80b::2004	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:310... 2a02:26f0:3100::210:6e5b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
110	34

50 162.159.134.42 (None, )

ASN13335 (CLOUDFLARENET, US)

www.nisos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1634 (United States)

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:863b (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.192.125 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-192-125.muc50.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.200.29.199 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-200-29-199.compute-1.amazonaws.com

lltrck.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.36.163.106 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-36-163-106.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:e6::ac40:ca1c (United States)

ASN13335 (CLOUDFLARENET, US)

ka-f.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.227.219.3 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-227-219-3.ams54.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:19c4 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:77be (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:816e (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:88ce (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:6bc7 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3100::1735:28a8 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:225e:3a00:6:9280:1080:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:38::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.110 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-110.fra56.r.cloudfront.net

vc.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.255.78.124 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-255-78-124.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:237d:ec00:2:53b2:240:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.229.94.52 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-94-52.eu-west-1.compute.amazonaws.com

content.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f14:cc6:ea04:4d6d:dcdd:12a6:3f04 (Boardman, United States)

ASN16509 (AMAZON-02, US)

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:d6f3 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3100::210:6e5b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
50	nisos.com www.nisos.com	476 KB
6	adroll.com 1 redirects s.adroll.com — Cisco Umbrella Rank: 2705 d.adroll.com — Cisco Umbrella Rank: 1432	25 KB
6	6sc.co j.6sc.co — Cisco Umbrella Rank: 6484 c.6sc.co — Cisco Umbrella Rank: 9628 ipv6.6sc.co — Cisco Umbrella Rank: 6605 b.6sc.co — Cisco Umbrella Rank: 4269	13 KB
5	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 408 www.linkedin.com — Cisco Umbrella Rank: 563 px4.ads.linkedin.com — Cisco Umbrella Rank: 6542	5 KB
5	gstatic.com fonts.gstatic.com	75 KB
4	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 1987 ka-f.fontawesome.com — Cisco Umbrella Rank: 4145	24 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 82	273 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 389	13 KB
3	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2377	16 KB
3	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 749 script.hotjar.com — Cisco Umbrella Rank: 1067 in.hotjar.com — Cisco Umbrella Rank: 5501	73 KB
2	google.de www.google.de — Cisco Umbrella Rank: 4835	515 B
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 124	395 B
2	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2890 www.google.com — Cisco Umbrella Rank: 3	661 B
2	hotjar.io vc.hotjar.io — Cisco Umbrella Rank: 2638 content.hotjar.io — Cisco Umbrella Rank: 5923	420 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 60	21 KB
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 4971 forms.hscollectedforms.net — Cisco Umbrella Rank: 5088	26 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 80	2 KB
1	hubspot.com track.hubspot.com — Cisco Umbrella Rank: 2462	1 KB
1	hsforms.com forms.hsforms.com — Cisco Umbrella Rank: 4470	983 B
1	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 1027	377 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 960	5 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2379	21 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 4538	88 KB
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 3542	3 KB
1	lltrck.com lltrck.com — Cisco Umbrella Rank: 33485
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2641	1 KB
110	26

	Domain	Requested by
50	www.nisos.com	www.nisos.com
5	s.adroll.com	1 redirects www.googletagmanager.com s.adroll.com www.nisos.com
5	fonts.gstatic.com	www.nisos.com
4	www.googletagmanager.com	www.nisos.com www.googletagmanager.com
3	b.6sc.co	www.nisos.com
3	px.ads.linkedin.com	3 redirects
3	bat.bing.com	www.googletagmanager.com bat.bing.com www.nisos.com
3	js.hs-banner.com	js.hs-scripts.com js.hs-banner.com
3	ka-f.fontawesome.com	kit.fontawesome.com
2	www.google.de	www.nisos.com
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	fonts.googleapis.com	www.nisos.com
1	track.hubspot.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	www.google.com	www.nisos.com
1	forms.hsforms.com	www.nisos.com
1	d.adroll.com	s.adroll.com
1	content.hotjar.io	script.hotjar.com
1	region1.analytics.google.com	www.googletagmanager.com
1	forms.hscollectedforms.net	js.hscollectedforms.net
1	px4.ads.linkedin.com	www.nisos.com
1	www.linkedin.com	1 redirects
1	cdn.linkedin.oribi.io	snap.licdn.com
1	in.hotjar.com	script.hotjar.com
1	vc.hotjar.io	script.hotjar.com
1	snap.licdn.com	www.googletagmanager.com
1	js.hscollectedforms.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hsleadflows.net	js.hs-scripts.com
1	js.hsadspixel.net	js.hs-scripts.com
1	script.hotjar.com	static.hotjar.com
1	j.6sc.co	www.nisos.com
1	lltrck.com	www.nisos.com
1	static.hotjar.com	www.nisos.com
1	js.hs-scripts.com	www.nisos.com
1	kit.fontawesome.com	www.nisos.com
110	38

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.linkedin.com
www.facebook.com
www.instagram.com

Subject Issuer	Validity	Valid
nisos.com Cloudflare Inc ECC CA-3	`2022-10-07` - `2023-10-06`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1	`2022-11-22` - `2023-12-23`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-03` - `2024-05-02`	a year	crt.sh
*.hotjar.com Amazon ECDSA 256 M01	`2023-03-09` - `2024-04-06`	a year	crt.sh
lltrck.com Go Daddy Secure Certificate Authority - G2	`2022-07-25` - `2023-08-26`	a year	crt.sh
6sc.co R3	`2023-05-25` - `2023-08-23`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2023-02-16` - `2023-08-16`	6 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
s.adroll.com Amazon RSA 2048 M01	`2023-06-03` - `2024-07-01`	a year	crt.sh
*.hotjar.io Amazon ECDSA 256 M01	`2023-03-09` - `2024-04-06`	a year	crt.sh
linkedin.oribi.io Amazon RSA 2048 M01	`2023-06-08` - `2024-07-07`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-05-19` - `2023-08-11`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
d.adroll.com Amazon RSA 2048 M02	`2022-11-08` - `2023-12-07`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2023-02-05` - `2024-02-05`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
Frame ID: F7EE88E0233260186104BC0550790FF0
Requests: 109 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Page not found - Nisos

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AdRoll (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

(?:a|s)\.adroll\.com

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Slick (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/slick(?:\.min)?\.js

Swiper Slider (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

swiper(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

110
Requests

95 %
HTTPS

74 %
IPv6

26
Domains

38
Subdomains

34
IPs

5
Countries

1159 kB
Transfer

4247 kB
Size

25
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/nisos
Title: Follow

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/nisos/
Title: Follow

Search URL Search Domain Scan URL

URL: https://www.facebook.com/nisos.managed.intelligence/
Title: Follow

Search URL Search Domain Scan URL

URL: https://www.instagram.com/nisos.managed.intelligence/
Title: Follow

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 82

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4343073&time=1686756842832&url=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4343073&time=1686756842832&url=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4343073%26time%3D1686756842832%26url%3Dhttps%253A%252F%252Fwww.nisos.com%252Fresearch%252Ftrigona-ransomware-explained%252F***IOCs%253A***IP%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4343073&time=1686756842832&url=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4343073&time=1686756842832&url=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&cookiesTest=true&liSync=true&e_ipv6=AQKOS61cXEvFXwAAAYi6it-csD4iuzBEGmUvtpRHjRZQf9M8l2NFgibKBXRwGDK41YAYFGw_I1Kr

Request Chain 84

https://s.adroll.com/j/pre/ZCNLOBHP6JAMPK46MHW4HJ/FQF5LWUC4ZDBZCUBYYYETE/fpconsent.js HTTP 302
https://s.adroll.com/j/pre/index.js

110 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 404 Primary Request ***IOCs:***IP Show response
www.nisos.com/research/trigona-ransomware-explained/ 134 KB
26 KB 408ms
314ms Document
text/html 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9198751141182778ff336c74f4d7e3ad6757f13199c7958dcb7be81182fa2c34

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, must-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 7d73a2957b403653-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 14 Jun 2023 15:34:02 GMT
expires: Wed, 11 Jan 1984 05:00:00 GMT
ki-cache-type: None
ki-cf-cache-status: BYPASS
ki-edge: v=19.0.6;mv=1.1.3
link: <https://www.nisos.com/wp-json/>; rel="https://api.w.org/"
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jwOiXu6G%2FwisgPoc99KwdsCdr2uIJ1chV23FYZ%2FHU%2Fsb7ozU8esknHmqV9N0CBN9wwaVRqFA6v71gW%2BWS1CJDbqhcVsTJRbHR8I0nLxtugUOeOeNBlx2TGi4w1XR4Is%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff
x-edge-location-klb: 1
x-frame-options: SAMEORIGIN
x-kinsta-cache: HIT

GET
H2 200 style.min.css
www.nisos.com/wp-includes/css/dist/block-library/ 95 KB
13 KB 63ms
62ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-includes/css/dist/block-library/style.min.css?ver=3bc2f6d635f19ab24e7adf5b4e33d3b8

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,88b53538fc0e54512cead375ab30fb58fbd06633718ae385fd75a2b970c9cfd5
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,88b53538fc0e54512cead375ab30fb58fbd06633718ae385fd75a2b970c9cfd5
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 06 Apr 2023 17:43:35 GMT
server: cloudflare
etag: W/"642f04c7-17ced"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IouD%2FUgnK8D%2FSB5ZmhEblnX%2BxcsiQxNiUa7s%2FxF5IzKgNGF%2BG2lIFixLgaFXkbAjBfzp5K02qvTUyTm5TIyYKoiypXG%2FypI6V9Ce7vtWgvvX7QXzhHBqNYxxoQDGbUg%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2977dc53653-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 swiper.min.css
www.nisos.com/wp-content/plugins/dg-blog-carousel/styles/ 19 KB
3 KB 40ms
40ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/dg-blog-carousel/styles/swiper.min.css?ver=3bc2f6d635f19ab24e7adf5b4e33d3b8

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

46bbc7b22b8c58dc664cd4b31da0906636b96c8d64b839b1671d3eff081f6c1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,4b3cc2a010bb32274103334332a2dc990b984e5e8e6ff72c0b368b32b5be1896
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 280698
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 02 Aug 2022 16:43:01 GMT
server: cloudflare
etag: W/"62e95415-4d50"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oEas9iSrMjiseiSQOI2Ay41rntQoRlPxmHJMdD6NAj7FWXF%2FnVZ5XJwRmJpXab2Zkr8uxnOPKC7WxdHE2aEfSFlxegLxHumaEXV3tXGdtAykHFY4q7SZiIJ7MId0kVA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2977dc63653-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.css
www.nisos.com/wp-content/plugins/monarch/css/ 113 KB
14 KB 62ms
61ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/monarch/css/style.css?ver=1.4.14

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f820d93daf383e178bda2912f5bee00e90e56390597820622643fa8e5e487143

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,b39b0a0ede3780dcb00d16eb59c7dd039b8dcbedaebee368cb2819b843baa6a0
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,b39b0a0ede3780dcb00d16eb59c7dd039b8dcbedaebee368cb2819b843baa6a0
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 14 Oct 2021 19:09:25 GMT
server: cloudflare
etag: W/"61688065-1c56d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qgqk77aridX%2FHnb1y5zoGO5745TaBz8Fg%2FOBr%2BQmWHvOESVH3FaTEYJGVOOxEhpwYX1fviXWzjFKVle0EMiek7ZGUmE7QMVGSwR6pYg3mDJEC8zmgrYOQOadUjwn2SY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2977dc73653-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 css
fonts.googleapis.com/ 5 KB
774 B 67ms
28ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,700

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

67eb879fb1645c73ccbaac598e815fd3901eb5114228021d686b8b5e470edbbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 14 Jun 2023 14:48:09 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 14 Jun 2023 15:34:02 GMT

GET
H3 200 front.min.css
www.nisos.com/wp-content/plugins/popups-for-divi/styles/ 7 KB
2 KB 46ms
46ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/popups-for-divi/styles/front.min.css?ver=3.0.5

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ba2eeab126375c9cc2fabe9a6fe35f25dea57c52df280e6e24a790f5f45be878

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,b9ac426e1e9d65602937f14f305030ead098ae4fcde8d4be7c3254c79215cbe6
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 74
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 06 Jul 2022 19:34:32 GMT
server: cloudflare
etag: W/"62c5e3c8-1c9f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wqCoJm4He18bo5X4PVMeF0aUTCKGXjC40%2BO%2BTkY67Hzu3PwMxKiqoaVlDNo4IdHLwtcbsHrfWd7GuyDQ7CAE5HdS8BfyTtmfBRmb3xluTKfbgnxmehx%2BL8zrbhRcOzA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a297fd9c6927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 search-filter.min.css
www.nisos.com/wp-content/plugins/search-filter-pro/public/assets/css/ 36 KB
7 KB 71ms
68ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/search-filter-pro/public/assets/css/search-filter.min.css?ver=2.5.14

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c90d3c0b0e49b95857fbd4a60728451deb97ac4079be355467deac9ee7de4a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,1a81ac67ffe4c03d4748628c61333e8eeded4c74b90ca49d8a289d47712195e0
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 74
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 24 Apr 2023 15:06:23 GMT
server: cloudflare
etag: W/"64469aef-91f3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WXQDCKyTEYfiMe7R%2BNmg9kGHkmp1hBeiKYpdmfq4q43dbNWTvsvHuzxwfQ45B8x0mvE3aRUtn1p8SJhP4IZLcvcV%2BkypA6Ml7K5TM1NVmBW5hUwpcyUNbbl%2BosSULeA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a297fda36927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 style.min.css
www.nisos.com/wp-content/themes/Divi/ 26 KB
7 KB 48ms
45ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/themes/Divi/style.min.css?ver=4.20.4

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ba7e231732c5791c70061b395c1d28b929f28ed1f6ec000fad64727a36c46da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,f386483d672dda793762337e3261104edf5cb2f404140c243f9c14656dae14ea
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 74
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 06 Apr 2023 17:46:18 GMT
server: cloudflare
etag: W/"642f056a-680e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z9v1XYjP%2FZdFqDN75XULjldKu%2FApAYcPztP4L%2BXpX7b3pXyzyctZDyGP5ZZRkINSNd2yZi4QqV6KQJ1Alt97Kd43z93Ks0QeDko00NehQ3s405fOXBkaa5X%2FxKCDi%2Bs%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a297fda56927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 et-divi-dynamic-tb-9107-late.css
www.nisos.com/wp-content/et-cache/notfound/ 628 B
884 B 45ms
42ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/et-cache/notfound/et-divi-dynamic-tb-9107-late.css?ver=1686688277

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

925d5ba38a0c2f9ab7df22566d1b0eec56615e69ea93b84c5e79a7f3074eb02a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,b47d06dbde3646fc81f045ef7513995d9fb0a135e6ea93559961d5a990709b23
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 13 Jun 2023 20:49:18 GMT
server: cloudflare
etag: W/"6488d64e-274"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YZeW9S2cqXaOSWyqoXSSWaWU5av9uX6y1nJTMRk%2BE5WDI48praeh%2BXiY8kzsFP9kdRGpOGgQHjRDzpWIwkWvlGds4GCM1OHOPvGdCm3ZEBlWXqMu8xCz31z4u7rdXvA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a297fda76927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 et-divi-dynamic-tb-9107.css
www.nisos.com/wp-content/et-cache/notfound/ 94 KB
15 KB 48ms
46ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/et-cache/notfound/et-divi-dynamic-tb-9107.css?ver=1686688277

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2b4e13a4e12823ec6fe43ef5d7775abe7c9badf09c6f51693eb7722a924c68e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,0e5bcf162e766100d4f58674917f3c0b49427be5fc96c3cf52cccb60a32d53c4
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 13 Jun 2023 20:31:17 GMT
server: cloudflare
etag: W/"6488d215-17757"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nN5kq%2FeBZUJegWsrrJ0GUC8GHlLOp9KC1wGQLNaOyoA36Dg%2F%2FefzMzibEULGi0%2B4exeM3%2BrroMTGTDwimBxaRfjaXI78mbspL7GwRYWj4ZE%2BdbkndzoBcwFvHUGKN%2Fc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a297fda86927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 style.min.css
www.nisos.com/wp-content/plugins/dg-advanced-heading/styles/ 4 KB
2 KB 43ms
41ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/dg-advanced-heading/styles/style.min.css?ver=1.0.1

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

26764edc2000ff1b83064a99effb1fe10e7cddf5b1a2c406a6d10a86b852eda6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,873323157c00d783cb7b90d4a55e8b95210eb876e983f1cbd8f760fd27167860
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 08 Sep 2022 14:34:06 GMT
server: cloudflare
etag: W/"6319fd5e-e6e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HasLTsFgAliHeLg6Xb975gxrRp09wz0KzBC9m9yWLPWTzdCreKVff%2Bo8eX%2F8bQf0z%2B64vF4qeWMYKK80QbKyOzF5Dgp9J9w6Lq1xr%2FGPrbQhEBASBpFiWM7n6z8PGus%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a297fda96927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 style.min.css
www.nisos.com/wp-content/plugins/dg-blog-carousel/styles/ 11 KB
2 KB 59ms
57ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/dg-blog-carousel/styles/style.min.css?ver=1.0.15

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43bfa4cb8df3cc265a138e9e526679040ac26b50498319031ad41b77c6f01f84

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,05dbb013f7db58185451dafd6adb5d0d3af981ef13fa9b8c85327b9cd3d3990d
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 02 Aug 2022 16:43:01 GMT
server: cloudflare
etag: W/"62e95415-2a52"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fVFMwjpc4RvML%2FL652aMzpwYMNfRcEhpBJtwdsKpVcGYtYaSASj9lwC0RLYJzlTBn%2FC8c7DUirvFw8ZGb2SrCQE0yB6V%2F3qY4Crki4Zz5FpX%2BRVnEnWBiqxjA%2Bc22TY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a297fdab6927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 style.min.css
www.nisos.com/wp-content/plugins/supreme-modules-pro-for-divi/styles/ 414 KB
30 KB 49ms
47ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/supreme-modules-pro-for-divi/styles/style.min.css?ver=4.9.34

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fa5ba6fab394d537af1ad89a49479e9953ab0f96251532163c794a3ccea938e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,e5fe29412d6e3f9b5710560ecd0b725d41299e76601fa54cb5e50bd3012a00ac
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 09 May 2023 17:29:27 GMT
server: cloudflare
etag: W/"645a82f7-678e2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tZh8N8SYwBBH1fTKt2bwLbJMSOcbantpdPwjHiHmNl3kL2YXsvxmGVy7Rde57CJUrG1PJXQEEuVAcBZWMTXs9psB9nCBK6xvGzIw%2BSJAeB0uaBTsEj9dFnASUVVEv%2FM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a297fdad6927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 magnific_popup.css
www.nisos.com/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/css/ 6 KB
2 KB 71ms
69ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/css/magnific_popup.css?ver=4.9.34

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ca3af915877e0f119ce0df14dfce6249f76222c600e23882fa7c7f99788971cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,af73cdea617c649b330ae3647a74cb9865332f0fc5ed8ac13914c1055476e559
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 06 Apr 2023 17:46:19 GMT
server: cloudflare
etag: W/"642f056b-1946"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KY8F56T6CyxbZ5A8l7VTpeogHVV4sEezclLF9Ll%2FeiscPoIQqzc3ofyrclYlFmV3%2FP%2BG0h7oB82kDQ5siXIxyea7oKL3Mfe0lIMiDpN%2FITzcOEO82C49dnMhNInGLWo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a297fdae6927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 swiper.css
www.nisos.com/wp-content/plugins/supreme-modules-pro-for-divi/public/css/ 22 KB
4 KB 70ms
65ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/supreme-modules-pro-for-divi/public/css/swiper.css?ver=4.9.34

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e53a639010f02dd7e7c3859f82daeffa535fc069b3e4145640af023dc386f86

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,90e094d277e81dee92dfbd4dcca5ace43e2396d58bc08f6445b0b4f70a582a67
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 09 May 2023 17:29:27 GMT
server: cloudflare
etag: W/"645a82f7-5737"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5M6G9wFAMWOvSIPT%2BRIuch6g58AGu75JWRBdlTNGcDjeyn1EMbLGtWQfd1Kx7sacUMYJYkGsL%2BJfkaoV9LQus4QIXDIvBbG%2F0ML%2Bj4v0gjjspx7Htu5H9UdTYEIWpZY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2980db16927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 popup.css
www.nisos.com/wp-content/plugins/supreme-modules-pro-for-divi/public/css/ 7 KB
2 KB 67ms
62ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/supreme-modules-pro-for-divi/public/css/popup.css?ver=4.9.34

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56c81b4086d742cf938f6fbc06de7dab26cce2ea6a889b6cf94a356251495631

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,ae94453bdf50fc9455df1902d94914353c270ba72508d3e932b0923ec729caa0
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 09 May 2023 17:29:27 GMT
server: cloudflare
etag: W/"645a82f7-1b60"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BHo8y8PxKWDbpsoCSl64tOJHpUfaqPE3yhSR%2F1VhqOPHUEfB3D8svHinFETLeqGtRBLN5OaX%2Fp%2Fj8kydaGM1ejVV6FNTb%2Bc9GcUe2LpCJ%2BUcNwfl1MIo2sLBbR%2FTB34%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2980db36927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 animate.css
www.nisos.com/wp-content/plugins/supreme-modules-pro-for-divi/public/css/ 83 KB
6 KB 60ms
55ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/supreme-modules-pro-for-divi/public/css/animate.css?ver=4.9.34

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2414767fbf3e93d3269cb3795b6c667da0f58a8f662dfd8aabb0807243d1134f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,270c2e6f46317d504dabd8865e09334f4c600b3d816303dcf30efc674623751b
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 09 May 2023 17:29:27 GMT
server: cloudflare
etag: W/"645a82f7-14d7b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t56R%2BBKHL2DeGvTgYkBT1gxd3RHm3JVWBZoUJ0Bd9PBJ%2B9%2FkGW4SrfMP0DTlLKVxbO9ZM0PC4Uk%2BZwzYbqEiuLjVyMB%2FSOzD4XCO9cuFio0Fqg4pUT88eYFlXZgDfzY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2980db46927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 readmore.css
www.nisos.com/wp-content/plugins/supreme-modules-pro-for-divi/public/css/ 2 KB
1 KB 59ms
56ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/supreme-modules-pro-for-divi/public/css/readmore.css?ver=4.9.34

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e103f8eeb3f4ba878184dea6d2137c6d5d2e0356e62fb5b8385c3d0e0ec598fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,6c03f7226438a7d0fd440a1b10df2303dbebae4899b7b6b71ba8f6cb98aafa48
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 09 May 2023 17:29:27 GMT
server: cloudflare
etag: W/"645a82f7-6b2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=goe3czgtnusnWtY9e6UlPSsKXhIVAACYUowafbLKcFlffs%2B21JSQB2de8ehD4gyFwJ12GDg6T1KJaTlCAM%2FrW1%2FP1mFn57g9wQeZ04khq3P8QPmO6ABiNFIIJgD%2BsRQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2980db76927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 style.css
www.nisos.com/wp-content/uploads/custom-layouts/ 18 KB
3 KB 63ms
60ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/uploads/custom-layouts/style.css?ver=41

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d6a60541b6205300575d1c6a1e92c4c139f4dccadfe00ff9b3a85ceb6c81110

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,c7200c1295aca72f5be4b699166384fdb3a236a124f28cdaaafaa14443142a83
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 06 Apr 2023 17:40:13 GMT
server: cloudflare
etag: W/"642f03fd-472b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zS8tYqIPgSNOQqx6At0HsYlpG%2BT4IgDp3wU%2Fi5Low9NsVqWIQ10s9htLfeD8tpTMxHOYAzNqSMZh6bKJzGtHHHrLhzIpjG3Im91dXTA2Qc1AA%2F9lgCoh9WoZjVTXqes%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2980db96927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 slick.css
www.nisos.com/wp-content/themes/nisos-child/ 5 KB
2 KB 73ms
70ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/themes/nisos-child/slick.css?ver=3bc2f6d635f19ab24e7adf5b4e33d3b8

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

99a15b32a81b6f965c2e5bd6c582f7ffc73adfa751fc2465a00f3104e7a6cf95

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,5fbc5fe2c5a13b70a03e378015eed45fa113cc3e07dcc33bb6263b8300b7142d
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 22 Nov 2021 15:10:41 GMT
server: cloudflare
etag: W/"619bb2f1-1327"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ty%2BWh%2F6s7y7nwQo79z3wMFSAL9crr4h4gBq7Gmb0784spA%2FW6gFoXixb7yK7EJa%2BaZ3kjA9mSVrguAO%2B70MC%2BZi%2B3Pqri9tIBv2oTuRm598SvcYuejLd5mLGkuCQmLg%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2980dbb6927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 style.css
www.nisos.com/wp-content/themes/nisos-child/ 14 KB
4 KB 64ms
62ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/themes/nisos-child/style.css?ver=4.20.4

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

754233622f501da9f79ca0d4626d442150d84aee8a909201132fa960b2bf803c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,fbe70093782887fcb889dc883ac3b9ba916e10dafbb96ba5a96a080863c496f0
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 24 Jan 2023 20:21:41 GMT
server: cloudflare
etag: W/"63d03dd5-3778"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vS%2BD4LOqlxgeDJuRad7Q5FLRCMiLFmeA1EFNOmKl1CTTLi6jiNQWnUQvyZ0IAAq6AURUueDhJvBy5b102jRxaTfi%2BDm5ZLBBPp85q4Lemz93q%2F08r0mz6cOO2y3N6Zc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2980dbc6927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 DOMPurify.min.js Show response
www.nisos.com/wp-content/plugins/svg-support/vendor/DOMPurify/ 21 KB
9 KB 67ms
64ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/svg-support/vendor/DOMPurify/DOMPurify.min.js?ver=1.0.1

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50c36bc2a71485bc6939c1f5de3d1b38ff260d9de91dac1855df0b50c35d81bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,0e8150840593df9bd0f4ce4a0b74b2d49d90c869f1ea097b1379495e962f0cac
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 22 Dec 2022 15:13:47 GMT
server: cloudflare
etag: W/"63a4742b-52b1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J6H%2FhoHLZ8QO5H6OqwsZC32Q6FjNmJ%2Fhb%2FmpHixa1NqRo1dLh2D%2F0lLbMDw40gzpZm0gI%2FCZOA8kRx7m6B7N5mrzS5zDb8J%2F1jefZse%2B%2BRYTiZHb7q9C5CmC%2BmknD3o%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2980dbd6927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 jquery.min.js Show response
www.nisos.com/wp-includes/js/jquery/ 88 KB
32 KB 65ms
62ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.4

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,222a13131a49c24deee95ba060d5206b4903536022794aad6170fb9f1fefc9c8
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 06 Apr 2023 17:43:35 GMT
server: cloudflare
etag: W/"642f04c7-15ed7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lJfKV%2BmgXUJa1RpBn5ElLyDtxwXEHkgmyw7mng03mlxpcS1BOxU1M%2FoGCoA2BTHvY7gTTHACjMFdGhjdIKYsdNtYaFA7GRNbx%2F3Nn%2B8r2asNdTQCxE2Z1KyCyUB%2BjIs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2980dbe6927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 jquery-migrate.min.js Show response
www.nisos.com/wp-includes/js/jquery/ 13 KB
6 KB 67ms
65ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.0

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9810aee7e6d57d8cceaa96322b88e6df46710194689ae12b284149148cabc2f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,14cf7fc0bbdcb4c27f17e961d028f68223e417036e493f75213810624f82c00b
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 06 Apr 2023 17:43:35 GMT
server: cloudflare
etag: W/"642f04c7-3470"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ahjGTBHqC2fXVh1FWYIBunTicHTOpHnsIcbU%2BwDVPhyMG1aADk6tlds9uWRrQPupBz8c9C0WmYsFMlBynrrldb%2FA%2FKO1RA2XbDe54zIShuaP3cXfT0EU5eScTSN%2BmDM%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2980dbf6927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 svgs-inline-min.js Show response
www.nisos.com/wp-content/plugins/svg-support/js/min/ 2 KB
1 KB 68ms
66ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/svg-support/js/min/svgs-inline-min.js?ver=1.0.1

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eabc19480b6212343af7996aa06029eb00e8a05d9709b4c8b05e3222558a12f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,7bcad437b9e70caddd0e55c4807867d6de7c499835da36a897bf620af656900d
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 22 Dec 2022 15:13:47 GMT
server: cloudflare
etag: W/"63a4742b-601"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oSZ3Nf3Pz3YgmKXn5i5k1vbFS1D9WumXEGJ%2BqQ1%2BlFaHM9m1OGxK%2BxABeY8Y7T4A%2FB0xRSTudf5yPQ7vnCA2zRjXjZpNiPbLqYm8eKbwJObaSRT9fXfgYttO8dX%2Bnk0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2980dc16927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 ie-compat.min.js Show response
www.nisos.com/wp-content/plugins/popups-for-divi/scripts/ 10 KB
4 KB 69ms
66ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/popups-for-divi/scripts/ie-compat.min.js?ver=3.0.5

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6aed488d128d02850cfb20b4de28a2eceffddd04342f413bbe88a141235a976

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,f748acf366c5bbea00b8be5fad3d89e32a05b1a742a6208421cc074a828b78b6
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 06 Jul 2022 19:34:32 GMT
server: cloudflare
etag: W/"62c5e3c8-2712"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6NYD4o%2Fp%2FLcb5%2F6A3Y%2Bru99wGfe%2Bg5VmJE8SKi6z54CnaxUJv3d1X25oyE85co6PRYdeejk8jRwW6f%2BtuuwUQaFVVZIJ%2FemQJo1lA64yqJaPo3aB5zzN4STxploiL5c%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2980dc26927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 search-filter-build.min.js Show response
www.nisos.com/wp-content/plugins/search-filter-pro/public/assets/js/ 64 KB
20 KB 69ms
67ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/search-filter-pro/public/assets/js/search-filter-build.min.js?ver=2.5.14

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fbcc9f3151a357828aa120dc98bafa35359d42c83b4cd39693009f43e2ae9098

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,0c21e2bb1283e80621ac1ad2d9d182dcd66450e1edb18a20184fc4a0a8ab1726
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 24 Apr 2023 15:06:23 GMT
server: cloudflare
etag: W/"64469aef-10074"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=49UFqRKcTdpccwYzZJ7V25SnMVmo5Be38Seh5rxT5Nv4SIsJgyTXKpFm6ZJCQ2ZN3zTce79uz6TcSwlJcIioa6n%2FYMk2HkJkRcElqwHRsyjwk3PnYxFFHsYoTLvYLZQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2980dc46927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 chosen.jquery.min.js Show response
www.nisos.com/wp-content/plugins/search-filter-pro/public/assets/js/ 28 KB
8 KB 70ms
68ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/search-filter-pro/public/assets/js/chosen.jquery.min.js?ver=2.5.14

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

73881513a7e7f8944a311bea8e80e9fad946e256ae74d62b5c8d469dc6df0186

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,280351e81b2a6fc9a850db62a7374c4403d3b3f2c511e8e6644f509e144b27b9
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 43
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 24 Apr 2023 15:06:23 GMT
server: cloudflare
etag: W/"64469aef-71c1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mUuSBcoAVS8J2emYYf4k18lhhpt%2FncGagbPpm8qnCwNGyMfA9r%2FYoj3fZ41RgosqGFs%2BVDXmIWWuXNtkg%2BN3obBahe1KlvRqVksR%2BsLxNX6OH5TvifpXTVrmr%2Ff2R8Y%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2980dc76927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 css2
fonts.googleapis.com/ 799 B
806 B 58ms
27ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Zilla+Slab&display=swap

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5489746d9317f7924511ff59d5781ef51906900a231fe46684c1e512a09ef076

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 14 Jun 2023 15:34:02 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 14 Jun 2023 15:34:02 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 127 KB
49 KB 119ms
38ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-145073476-1

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

427edd6de036cf6d976fe0126fe3b9f30aceae3185bc4c7169f85b35aa7619c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 50192
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 14 Jun 2023 15:34:02 GMT

GET
H3 200 alt-nisos-logo.png
www.nisos.com/wp-content/uploads/2023/04/ 18 KB
19 KB 85ms
82ms Image
image/png 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nisos.com/wp-content/uploads/2023/04/alt-nisos-logo.png

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57f4680898f2af59bf83a8bedb562603677780be4133457db08e6314c6438723

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,9e1cc11f922671cae97c6059e0bef5e438bbaee348bf1fa087f49aef62e5be2d
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,9e1cc11f922671cae97c6059e0bef5e438bbaee348bf1fa087f49aef62e5be2d
alt-svc: h3=":443"; ma=86400
content-length: 18447
last-modified: Mon, 17 Apr 2023 14:31:45 GMT
server: cloudflare
etag: "643d5851-480f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z60NUTce4%2BUorFET1Cp25R86YVfvWgzLi4goGJqNk6tqvbjRy9fb6B3nKZ6Q%2B9Zn2prXPmGXtJRFQoD3Cm6wgUPu87%2Fs5IfjNNm%2FMNZEdftPNXAzrMbiPX1vpEIGBVQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 7d73a298bf036927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 NISOS_logo_high_res_vert_white@2x.png
www.nisos.com/wp-content/uploads/2021/01/ 9 KB
10 KB 117ms
114ms Image
image/png 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nisos.com/wp-content/uploads/2021/01/NISOS_logo_high_res_vert_white@2x.png

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

10fd67d6c6eac5cdfda0b370fb6b23bc1fc4b9f1f1a7cb8b401aac906f2a6822

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,c548b1b1af14ae1266c3e98a1feac25ef7fcd047721cb91230d4687e03a7c78e
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,c548b1b1af14ae1266c3e98a1feac25ef7fcd047721cb91230d4687e03a7c78e
alt-svc: h3=":443"; ma=86400
content-length: 9652
last-modified: Thu, 02 Dec 2021 00:19:22 GMT
server: cloudflare
etag: "61a8110a-25b4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X%2BqMzSyMExTqHZv1QLgzJtSKK4qwLeSuGUj7iLr1FLKvrYg2yc3jn41oQqv2XqhYyi3SiJWV5mEbRGlVICHwUR%2B4oCu22UUKU9uhjU9ml66metIGkMTWq79PdXqWJy8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 7d73a298bf056927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 9379eed59c.js Show response
kit.fontawesome.com/ 11 KB
5 KB 53ms
25ms Script
text/javascript 2606:4700::6812:1634
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kit.fontawesome.com/9379eed59c.js

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ef3755c1c0e73dd384a7a7c4d07fb899808284d0639a70d7db43fc51c3e6419

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Referer: https://www.nisos.com/
Origin: https://www.nisos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
strict-transport-security: max-age=31536000; preload
content-encoding: gzip
cf-cache-status: HIT
server: cloudflare
age: 43
access-control-max-age: 3000
access-control-allow-methods: GET, OPTIONS
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=60, public, must-revalidate
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
cf-ray: 7d73a298ef4b3a85-FRA
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id: F2iQX2kT2Tj49XAf7nSB

GET
H3 200 imagesloaded.min.js Show response
www.nisos.com/wp-includes/js/ 5 KB
3 KB 76ms
76ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-includes/js/imagesloaded.min.js?ver=4.1.4

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,ac16e648bbd8ab246c8802531e2e281b0d0094b44172184e8992cc74dcb58374
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,ac16e648bbd8ab246c8802531e2e281b0d0094b44172184e8992cc74dcb58374
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 14 Oct 2021 19:08:54 GMT
server: cloudflare
etag: W/"61688046-15fd"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JTEDFze9ZzHw0nI4CWBLIbs97Ym%2BgDFwTcQAeQRSR7BtB%2BLPSk%2BKU%2Bb5c45FKlLih3HbajA4%2FKsukWw3eXD%2FbjQIEPnjdLEpcn8WXIERp17pY%2BYUW2Yd4x8FxS9xB7Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2988e886927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 masonry.min.js Show response
www.nisos.com/wp-includes/js/ 24 KB
8 KB 73ms
73ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-includes/js/masonry.min.js?ver=4.2.2

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e00add38134eac2fb8e8e9c09cbfff7bbe57952b210322eb2eecb0a21fc055eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,186526930cac930fbf1401b86ea72183e8e160b637663475dbd3020cd6e38006
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,186526930cac930fbf1401b86ea72183e8e160b637663475dbd3020cd6e38006
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 14 Oct 2021 19:08:54 GMT
server: cloudflare
etag: W/"61688046-5e4a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yAL4CScAQqNFlI0Lga51HPX2OWam4PGzmOSwEa4K4rZV%2FBqE1SLbgXta0DRM%2FnMqEPUR5rmgIq1qwi58XtQkSRzOXDVcYXvu2xDsBrtNJ3tOVwRKZyvVxQ5C%2FWi9w9o%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a2988e8c6927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 custom-layouts.js Show response
www.nisos.com/wp-content/plugins/custom-layouts/assets/js/frontend/ 362 B
979 B 155ms
154ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/custom-layouts/assets/js/frontend/custom-layouts.js?ver=1.4.9

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8e71262c3e6d9eac19580f7725c2f1619790e8feb7fa6f536c029d94dcedc128

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,5b613f47a8eddddb04331b01c34c663b8c0c661de721af79ee619081763329b5
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,5b613f47a8eddddb04331b01c34c663b8c0c661de721af79ee619081763329b5
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 06 Apr 2023 17:40:12 GMT
server: cloudflare
etag: W/"642f03fc-16a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AhKYDBiBe8xFoGYO5mycYOtl7IwLbKoccQpetGs0%2BB3gaB0iv4RSzbIO%2BWiK2NCE%2Bmz12TF7K379%2F4u12nRyZnB8n5f1X0Bf7jOf9XEJgP7ES7a%2F9D45xIASpAj0eTI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298bee46927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 anime.min.js Show response
www.nisos.com/wp-content/plugins/dg-advanced-heading/scripts/ 17 KB
8 KB 79ms
75ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/dg-advanced-heading/scripts/anime.min.js?ver=8.7.1

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71f229efc891fac06cdafe9765967f3dc1ce71db155e7130042e7e64aab7f43a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,8daca3b0c76ead811179a1bb2cba48637591af5a6347a97d69bef348ae5dabc8
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,8daca3b0c76ead811179a1bb2cba48637591af5a6347a97d69bef348ae5dabc8
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 08 Sep 2022 14:34:06 GMT
server: cloudflare
etag: W/"6319fd5e-437e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3SaMlbEKXlv7OGTQIgvTesA2ZG%2BJQNqF0scwjKU0QaWKAIPwby0Qs8rGe%2FBOXuZiOMkO7AXXKHNqTuZRgYyc1X7sIHBOKu01WFsaGPR5is3B9FMHU%2BJr1hIwOye6Y3A%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298beef6927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 swiper.min.js Show response
www.nisos.com/wp-content/plugins/dg-blog-carousel/scripts/ 135 KB
36 KB 70ms
66ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/dg-blog-carousel/scripts/swiper.min.js?ver=5.2.1

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a75aa5bab9865958cd01d39856dc37e96491296ef55f5d2fdce2915b1ea1c58

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,e66a057b995eae5a249d4c5562c57804698c142eb05edea085f1b7e7e2549fe1
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,e66a057b995eae5a249d4c5562c57804698c142eb05edea085f1b7e7e2549fe1
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 02 Aug 2022 16:43:00 GMT
server: cloudflare
etag: W/"62e95414-21cea"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FGQcB1iIjUhBWdiQjhvdZNSov3XPHqYp6puczyUKv6FYLwzOZDU0ny%2BJUV0EnqKgChTqArlA3xTLjQqXTJqOrHpQIalFKdy%2FQodWOhgoquT8zl24tavcrz9YXh165eM%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298bef06927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 6068438.js Show response
js.hs-scripts.com/ 2 KB
1 KB 178ms
154ms Script
application/javascript 2606:4700::6812:863b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/6068438.js?integration=WordPress&ver=10.1.16
Requested by: Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:863b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: edab33ffa43d915a22d81599b90cbb00b4cb988809ea65d55b60f70c892a3426

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
cf-cache-status: MISS
x-hubspot-correlation-id: ee36ec24-6cbc-4518-998b-f68e6c798164
x-evy-trace-route-service-name: envoyset-translator
x-envoy-upstream-service-time: 13
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 7a1d3e07-57e2-49c4-b26b-2b861d9653de
last-modified: Wed, 14 Jun 2023 15:34:02 GMT
server: cloudflare
x-trace: 2BCFAB6B165ACB62CFBE29EF2E9EB767D869454F0B000000000000000000
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.nisos.com
x-evy-trace-virtual-host: all
cache-control: public, max-age=60
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-598c95b5b7-zqxft
cf-ray: 7d73a298e9dc380d-FRA
expires: Wed, 14 Jun 2023 15:35:02 GMT

GET
H3 200 idle-timer.min.js Show response
www.nisos.com/wp-content/plugins/monarch/js/ 3 KB
2 KB 85ms
81ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/monarch/js/idle-timer.min.js?ver=1.4.14

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

80fa756dda143f69fb3ce750e905cc8188150dc4c6b7539bf3627fe26530b405

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,d0dbb38299fae013682e2a5637d1349fb5f6339fc7e063c7134c2acae29be3a3
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,d0dbb38299fae013682e2a5637d1349fb5f6339fc7e063c7134c2acae29be3a3
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 14 Oct 2021 19:09:25 GMT
server: cloudflare
etag: W/"61688065-a4b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C3zFZm1IezbOjIwp%2F0mukEXCDsuQ7luruFpMek70B4Mp6hDppqoOdbEvtZsamzy5bKrACyzJ4q9C%2BcyLLasKjQl%2BfHOmhGiPSQHiBup1ntGfVW0LrAHq4WIzt1NbHRc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298bef26927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 custom.js Show response
www.nisos.com/wp-content/plugins/monarch/js/ 26 KB
6 KB 92ms
88ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/monarch/js/custom.js?ver=1.4.14

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43b5c9ad80f0a5d1c63568583e9cf6cd5ca8454a680f4ee80d5d63d00b15a360

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,f11c497a4440a3b44ec456d9755a2d49a57e835b202d0bc8a566875f94868ce2
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,f11c497a4440a3b44ec456d9755a2d49a57e835b202d0bc8a566875f94868ce2
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 14 Oct 2021 19:09:25 GMT
server: cloudflare
etag: W/"61688065-6855"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PJE08aGoMVaSp8p%2BGjpc7vneeCjIuQHhVPl%2FNMnQaA9t0paYHTzhx1T5myaBkQvbsCZYmfvi3y6HoH%2BxKi%2FaCkGggQ%2BdVFAdGuLHHmhYAKfcJb62NfewxstHI0%2FR1uU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298bef36927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 front.min.js Show response
www.nisos.com/wp-content/plugins/popups-for-divi/scripts/ 65 KB
22 KB 50ms
46ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/popups-for-divi/scripts/front.min.js?ver=3.0.5

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b5cec8800ffe6b92993466f61ec4f4d5ee6dee946a942b9356559821585fb650

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,23af53dee9725f3caaf30aca7a821d7286e5bc7619b02a4a822f326c90fa97a7
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 06 Jul 2022 19:34:32 GMT
server: cloudflare
etag: W/"62c5e3c8-10394"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rwvgjd5K5VOec0JHOP7NDWyqAixWpGUi7gRlNXGvLbTsz8xcFHqnWvGSF8%2BoqA4alx9RzMCD3SnBVb69JGzQt4sABa4gWO4SpKJp2dpSvn9GojEZeGKjjlLZC8aJemM%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298bef46927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 core.min.js Show response
www.nisos.com/wp-includes/js/jquery/ui/ 21 KB
8 KB 47ms
43ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.2

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ca7dce2391845e8aec7da135f33fabd10f74eed28a532ac66fd01f761fcfb42f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,09feba44757de3dc5eefee3fddbc61100ff6515bf8096daa7e267547e18f3509
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 06 Apr 2023 17:43:35 GMT
server: cloudflare
etag: W/"642f04c7-53be"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NCrz0fL3e%2FxssNsqGlNtcLRD6jk5l8KVw9PDIzyvoFgXFyQsHPIeRqBeNyjElVoxcYUBY7%2BiVpWKRDO9d5Yibh5TtAibpp2l2oIABpNIhLk7CDzl3ozliTSqvMrLAXo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298bef56927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 datepicker.min.js Show response
www.nisos.com/wp-includes/js/jquery/ui/ 36 KB
12 KB 48ms
44ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-includes/js/jquery/ui/datepicker.min.js?ver=1.13.2

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db5ffd916dbeb4938cc236cb3a42e73a56987f28c5deb9f3beccbe2c4af19307

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,9bdfe29266775059ca7799e044a7ced0e5a22604c5e7816be9718a10e3621d64
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 06 Apr 2023 17:43:35 GMT
server: cloudflare
etag: W/"642f04c7-8f79"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iPAy%2BFczP%2FEZ8oeDha%2BoFvilliahok16iSA0BlhMPngOb9vorm8MOfDYRmVLF73Y9yEjZ3cxY%2F0uJRdfa3EmMm5XbMlCONmi58ixBYjpOVGvjnIZZDGtMQcRtBwDK8w%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298bef66927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 slick.js Show response
www.nisos.com/wp-content/themes/nisos-child/ 42 KB
11 KB 76ms
73ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/themes/nisos-child/slick.js?ver=1.5.3

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0521badda7c602b73185aa5e23dd04fcb5f5ce5e0f1d693ff2cf9474178c1fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,7f28b306da0223e553d055dba958a569ba4b06045676e30a0a81032de4e77caa
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,7f28b306da0223e553d055dba958a569ba4b06045676e30a0a81032de4e77caa
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 22 Nov 2021 15:10:41 GMT
server: cloudflare
etag: W/"619bb2f1-a794"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RdfwGu9mAdlSCcwre%2BTLY7m5Atr7mrVRXSNHzN08cYQ02WrP0U8oocJCL0sq094i2IY%2ByJYgDqENH9xJEY3Ib%2FCpZ7bjt2oQigSnZm%2BEph5%2Fm4ExoBVrW8v51KVCoFg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298bef76927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 main.js Show response
www.nisos.com/wp-content/themes/nisos-child/ 6 KB
3 KB 91ms
87ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/themes/nisos-child/main.js

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67154bc8868a4e60ffeb64c6512e70acb648a5420a5eb7eaf86b20bb0a8457e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,2497eda5ba28c1994d05448790851963bf661954a158a9d28c1a909c4ced576f
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,2497eda5ba28c1994d05448790851963bf661954a158a9d28c1a909c4ced576f
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 24 Jan 2023 19:31:39 GMT
server: cloudflare
etag: W/"63d0321b-1800"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2RjFC8zo2T4lYf%2BR6RHr12TO0piLn0cMYhC5sogd9ddtuFwBGPCLaagJMlX%2FeqpLjkBwTrPK7UWZ4SGloM9no%2BV8kk3TROL8DftwsDQo4tuvxQCpOg0lMk2pnH8fKqA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298bef96927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 scripts.min.js Show response
www.nisos.com/wp-content/themes/Divi/js/ 268 KB
62 KB 53ms
49ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/themes/Divi/js/scripts.min.js?ver=4.20.4

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97490bd354a26885acf09c0ba5b4c3c76d12bb55193f13456d3aa2ded6eda6fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,0078fe226f21135f02b76b9cea82d51452e37145e772c0de1ad7931b4196d7b1
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 06 Apr 2023 17:46:19 GMT
server: cloudflare
etag: W/"642f056b-42f5a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ky5Wy4mMFbPd9RkIvmAFrkGWs%2BqR7nJHhUfcLI%2BCs14C57Au%2Be2lWiwLGFZUFyDOANw8aSxpwxEasK5%2BgjtBNaFLCc7%2BSIr7j8O5mGMLVCW37xIqFEd%2FzQBJ33rqYiI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298befb6927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 jquery.fitvids.js Show response
www.nisos.com/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/ 3 KB
2 KB 75ms
72ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.fitvids.js?ver=4.20.4

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

462747422c6af30aa81a0373fa1cfd736455cef52bdbb816f67be9531d84eace

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,7f53c136c574ac7f93303a17b8c2e84d7698ba503053c26c12a25b7b65d2e809
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,7f53c136c574ac7f93303a17b8c2e84d7698ba503053c26c12a25b7b65d2e809
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 06 Apr 2023 17:46:19 GMT
server: cloudflare
etag: W/"642f056b-d15"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5GyEPf7Tw3u0LN%2FDuuFTjFrEAJD8aWmc%2FiGaYVHf%2B2jImCQ5CVJfsf7SjozNKaTgyfwM2n%2F7xjxaFxsNajSedRA1ZBTu7XfUO%2BLR2OIgrI%2Fi2LRzwOISaKJbtkGxV3A%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298befc6927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 frontend-bundle.min.js Show response
www.nisos.com/wp-content/plugins/dg-advanced-heading/scripts/ 16 KB
4 KB 55ms
52ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/dg-advanced-heading/scripts/frontend-bundle.min.js?ver=1.0.1

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36e3278d17196da0532b353687c478f36936ecc8b6493d0b176ba69fdff05427

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,c231fe047aace500e7fb3a658afade5bf646b52fb2f2451aa05032563266a943
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 08 Sep 2022 14:34:06 GMT
server: cloudflare
etag: W/"6319fd5e-40a4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xRy8FJ5dnQwcPEECSrpjkzEjoNgJM1Kdtud8PNP5J%2FA9l9x0BxzD3GY61VejtwxQferIWc1vdbdfZgPhclmCmfgI7fk6Wcp6DGD8AGrfcTK76UIPv6nRKPqlK%2FaFop0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298befd6927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 frontend-bundle.min.js Show response
www.nisos.com/wp-content/plugins/dg-blog-carousel/scripts/ 4 KB
2 KB 61ms
58ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/dg-blog-carousel/scripts/frontend-bundle.min.js?ver=1.0.15

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a1786585ac9beb929463e7f963468e7e40da9b7b0111a0aab6673abdd2309b0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,b7d3ae58bce83150d812aa0cf8fb54ef4132df3ccfd7a0b7c69e118919a2446e
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 02 Aug 2022 16:43:00 GMT
server: cloudflare
etag: W/"62e95414-1054"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q%2FTQSXKfH6PuDdNzEdse%2F3BCkQdcaUKjBAkfeahozF0fRJWByye%2BDSnPDYVEAgWW9KV%2Bv3cuFfqcaM9OOxp19ERsxmfx%2FS5AcEqXU5zLuxIVL4A661zY92HNgpJLZ7k%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298befe6927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 common.js Show response
www.nisos.com/wp-content/themes/Divi/core/admin/js/ 1 KB
1 KB 87ms
84ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/themes/Divi/core/admin/js/common.js?ver=4.20.4

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ca76922f55b389b8f590ae7e3bcc3a2dccdce3aff1e5a4335af081b76a414ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,350374433f14b9e16af3c54b9a984c379cdda6c3314c5fa4572f3406a048d4fe
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,350374433f14b9e16af3c54b9a984c379cdda6c3314c5fa4572f3406a048d4fe
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 06 Apr 2023 17:46:18 GMT
server: cloudflare
etag: W/"642f056a-53f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CLiq15fsO6EujNB0mda4R0LeTPaPnJJTjKGXIGoq3W0fiMJuipfZ7TeT4x6n4MteE04%2Fsw7lDHIKgv%2BpnaNDjYAbnVYK8sCAZpToDJIGoU8E8AKS4onQb9p4ABdfzSU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298bf016927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 lazyload.min.js Show response
www.nisos.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/ 9 KB
4 KB 62ms
60ms Script
application/javascript 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f40767552e5e94b2d5f9a65d7f640cfa7d225298023dbd682095e040809a3d1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,a19d81d2b3a4e8aab2799c388ddcec8c72ef5af8b1bd2f9718c88cf1557ecadd
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 10 May 2023 12:27:01 GMT
server: cloudflare
etag: W/"645b8d95-22bc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pdNRFNxXzHV%2FRamqxLzNFKnBnLXmDNROD3LfTR4h%2B%2F%2F%2Bla%2FfB9hP6%2FN56oP252C4p0OmgcxVNyYMHy34WDsOQs4DexadRGR5YmFvXLk5WlpzO6jLlGbomGTs6pe0V7E%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298bf076927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 255 KB
89 KB 143ms
63ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TCFL7R7

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f458a5ebc15497471776087f952bf006491e6be2f96c4c4cf055c27fbe795daa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 90695
x-xss-protection: 0
last-modified: Wed, 14 Jun 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 14 Jun 2023 15:34:02 GMT

GET
H2 200 hotjar-3206651.js Show response
static.hotjar.com/c/ 9 KB
4 KB 120ms
40ms Script
application/javascript 18.66.192.125
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-3206651.js?sv=5

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.192.125 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-192-125.muc50.r.cloudfront.net

Software

Resource Hash

12d03201aa733372057226d7a64c2fa3544859acb87fd88347950d1fbe66727a

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Wed, 14 Jun 2023 15:33:19 GMT
via: 1.1 66ce4848bcf993e3c57b596461cd0b82.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P1
age: 43
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
etag: W/91c8c2780ab96eb20c5a53bda714aa6d
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
x-amz-cf-id: 4jsBfLJm5SBbWxTY3Py_vdgbHcJ-ejQv6qr03ZTSdVdnaIj-_Zbomw==

GET
H2 403 lt-v3.js
lltrck.com/scripts/ 0
0 330ms
106ms Script
text/html 52.200.29.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lltrck.com/scripts/lt-v3.js?llid=33234
Requested by: Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.29.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-200-29-199.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 200 6si.min.js Show response
j.6sc.co/ 35 KB
11 KB 88ms
9ms Script
application/javascript 23.36.163.106
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.163.106 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-163-106.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

4aec96eddab69454e554bb60664da2e5043c363ebef6921644f619523e7274d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 17 May 2023 00:27:16 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "64641f64-8a3f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 11052
expires: Wed, 14 Jun 2023 15:34:02 GMT

GET
H3 200 et-divi-dynamic-tb-9107-late.css
www.nisos.com/wp-content/et-cache/notfound/ 628 B
962 B 66ms
66ms Stylesheet
text/css 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/et-cache/notfound/et-divi-dynamic-tb-9107-late.css

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

925d5ba38a0c2f9ab7df22566d1b0eec56615e69ea93b84c5e79a7f3074eb02a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,f4b3b59bfbc6d2cfd542d8c58d34ce9cbf6150ed35167059d381c9c8631bfedd
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,f4b3b59bfbc6d2cfd542d8c58d34ce9cbf6150ed35167059d381c9c8631bfedd
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 13 Jun 2023 20:49:18 GMT
server: cloudflare
etag: W/"6488d64e-274"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cRmzox%2BCjUwWYb9xkGvFfc9fwhy0mneJol6rxFBBw8eNdgqzi2apxtHtHWVfsLUKQqB%2F2udxajqztTCQVkUfTE%2BlVUcOSioRE7Hp9GGBWCscSACZNhWVUE4TV5a%2FZHo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298cf116927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 2sDPZGJYnIjSi6H75xkZZE1I0yCmYzzQtuZnIGiV3w.woff2
fonts.gstatic.com/s/assistant/v18/ 13 KB
13 KB 110ms
52ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/assistant/v18/2sDPZGJYnIjSi6H75xkZZE1I0yCmYzzQtuZnIGiV3w.woff2

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

71e85b13d24a31d782e71da9f9192b5160369ec5ad1cb37988555d3eb93225d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.nisos.com/
Origin: https://www.nisos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 11:59:05 GMT
x-content-type-options: nosniff
age: 358497
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12868
x-xss-protection: 0
last-modified: Fri, 24 Jun 2022 19:44:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 09 Jun 2024 11:59:05 GMT

GET
H3 200 modules.woff
www.nisos.com/wp-content/themes/Divi/core/admin/fonts/modules/social/ 10 KB
7 KB 51ms
50ms Font
application/font-woff 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nisos.com/wp-content/themes/Divi/core/admin/fonts/modules/social/modules.woff

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/wp-content/et-cache/notfound/et-divi-dynamic-tb-9107-late.css?ver=1686688277

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

20476c3fffc3c6f35095c566e8eff0342e3ddb73841c39b58455dc970522e7f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.nisos.com/wp-content/et-cache/notfound/et-divi-dynamic-tb-9107-late.css?ver=1686688277
Origin: https://www.nisos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,d48bfb68e0c79abe90e09219ab29fbbce8c657ef768bca57e406056af03018b3
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 06 Apr 2023 17:46:18 GMT
server: cloudflare
etag: W/"642f056a-28e8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2fmEN18zqLNkkviVN4iF96bWwLYv%2B80nu%2F5pNQElu%2FMksbRdylLoastzei2F2ZWI%2BlDzPNAKDFZwMgZGV9tGOCvN%2BUhMh6nERlUeKW4Y8ZqYXZzHyUaFlZin4Fr%2BcTk%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
cf-ray: 7d73a298ef336927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-4I-FWUU1.woff2
fonts.gstatic.com/s/rubik/v26/ 24 KB
24 KB 73ms
19ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/rubik/v26/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-4I-FWUU1.woff2

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ece9d22203d0bc59232a7ff5bc7b4df4342c89630387b0366595ba92b724957e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.nisos.com/
Origin: https://www.nisos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 09 Jun 2023 16:33:21 GMT
x-content-type-options: nosniff
age: 428441
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24396
x-xss-protection: 0
last-modified: Wed, 08 Mar 2023 21:57:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 08 Jun 2024 16:33:21 GMT

GET
H2 200 2sDPZGJYnIjSi6H75xkZZE1I0yCmYzzQttRnIGiV3w.woff2
fonts.gstatic.com/s/assistant/v18/ 13 KB
13 KB 93ms
38ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/assistant/v18/2sDPZGJYnIjSi6H75xkZZE1I0yCmYzzQttRnIGiV3w.woff2

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bd94017c98cb7e9337f4bcc1e3dbf22ad1e048853d188bf896591d9e1f11af67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.nisos.com/
Origin: https://www.nisos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 17:39:55 GMT
x-content-type-options: nosniff
age: 338047
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12880
x-xss-protection: 0
last-modified: Fri, 24 Jun 2022 19:44:51 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 09 Jun 2024 17:39:55 GMT

GET
H2 200 2sDPZGJYnIjSi6H75xkZZE1I0yCmYzzQtjhgIGiV3w.woff2
fonts.gstatic.com/s/assistant/v18/ 12 KB
13 KB 105ms
51ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/assistant/v18/2sDPZGJYnIjSi6H75xkZZE1I0yCmYzzQtjhgIGiV3w.woff2

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3175dd776c73e3f90beb2340fd7d138a7fce24c1054a73f08216b1aa7e357534

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.nisos.com/
Origin: https://www.nisos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 13 Jun 2023 15:49:21 GMT
x-content-type-options: nosniff
age: 85481
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12768
x-xss-protection: 0
last-modified: Fri, 24 Jun 2022 19:45:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Jun 2024 15:49:21 GMT

GET
H2 200 2sDPZGJYnIjSi6H75xkZZE1I0yCmYzzQtgFgIGiV3w.woff2
fonts.gstatic.com/s/assistant/v18/ 12 KB
13 KB 92ms
38ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/assistant/v18/2sDPZGJYnIjSi6H75xkZZE1I0yCmYzzQtgFgIGiV3w.woff2

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6ca9f43967b272f585a9feb7ffc604462bea2cd2339e0a173899fe45e95b37c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.nisos.com/
Origin: https://www.nisos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 16:31:32 GMT
x-content-type-options: nosniff
age: 342150
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12772
x-xss-protection: 0
last-modified: Fri, 24 Jun 2022 19:44:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 09 Jun 2024 16:31:32 GMT

GET
H2 200 free.min.css Show response
ka-f.fontawesome.com/releases/v5.15.4/css/ 59 KB
13 KB 64ms
33ms Fetch
text/css 2606:4700:e6::ac40:ca1c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=9379eed59c
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/9379eed59c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:ca1c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
via: 1.1 2e4a0520ad8fe16707823b20e9441e08.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: FRA56-C2
age: 210160
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
server: cloudflare
etag: W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hUQUal%2FGjg1dFBK2Rfbyc5D8lkxhvJBjG8Lbsi10K%2BNtUngUh9e4W3Sqg8KduQrEkvLWAgR7vrRZh32BmwDRyxT%2BE0ntdFLCY5Kz6488bpWmqNsEoBbKXV4nzXh5KUJOoebveXRMPKOlcgvf3ENVsUxc4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 7d73a2994a3d3a8b-FRA
access-control-allow-headers: fa-kit-token
x-amz-cf-id: RfkwkKrN5MrM1I2LLx15dMnQAkHoqYBv9_18RE_G3h8e2n8O0RLoSw==

GET
H2 200 free-v4-shims.min.css Show response
ka-f.fontawesome.com/releases/v5.15.4/css/ 26 KB
5 KB 63ms
32ms Fetch
text/css 2606:4700:e6::ac40:ca1c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=9379eed59c
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/9379eed59c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:ca1c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
via: 1.1 346bf51bc00fbeaa3f4c461a781bceb0.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: JFK50-P8
age: 210160
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
server: cloudflare
etag: W/"76f34b71fc9fb641507ff6a822cc07f5"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vBZGkC5N4WyJrv4KtehYHEV7XgKPZoaWStzSgaNqaQJZg9RNEXbD%2BPSw6Le1YxQz64qL8EqMYqitMtygfvIijp%2B8fTBAGDli9GKcrIu980990y6KKcocWx6ueWjdi4uGtRQ9mlCZ7fvgz6dzQjgrd2RylQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 7d73a2994a3e3a8b-FRA
access-control-allow-headers: fa-kit-token
x-amz-cf-id: JugjvSg6Z8v3h8OzoldAnXdmOb-f3Yg6AXnnyaaUyRQ3WdcKnUSJNg==

GET
H2 200 free-v4-font-face.min.css Show response
ka-f.fontawesome.com/releases/v5.15.4/css/ 3 KB
1 KB 63ms
33ms Fetch
text/css 2606:4700:e6::ac40:ca1c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-font-face.min.css?token=9379eed59c
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/9379eed59c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:ca1c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f8b63bff49fba3c5bae30f4eb39f2fd6d088fbe9d7292bdf37b0ef4a1ec68d6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
via: 1.1 d9904d2a7eb0a13ec208dbdb43366b78.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: JFK50-P8
age: 210160
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
server: cloudflare
etag: W/"f2e0b2680d9b0bcb6e0039c4424e5a59"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gBg0p%2F5bJo7LNarbD%2FV3HYj4fXbsVGTlfMOgaYg9cdjU6aaoO8gJk7nUwsL41VcwY96tozmLeAbEQm355O4KMPUGqI6KnfqgYcoXoM05s8VTCmlvpqDyY2o3v%2Bw1LnbGQF%2F3OYhNOZ%2BoOowwfopjJtr0PQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 7d73a2994a403a8b-FRA
access-control-allow-headers: fa-kit-token
x-amz-cf-id: 8rCArnO5ogezCFSxGCraqS51hqg99LM3uUeDBjEctb17kB1_fjIBeg==

GET
H2 200 modules.5718b73ab85bca652332.js Show response
script.hotjar.com/ 270 KB
69 KB 91ms
18ms Script
application/javascript 13.227.219.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.5718b73ab85bca652332.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3206651.js?sv=5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.3 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-3.ams54.r.cloudfront.net

Software

Resource Hash

5bad0658ea23d85d08fe0c5484686cf9c7e7ebefefc47627c8013a0f1647c289

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 09:34:07 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 1b0117d337408839a32bf2a49b55b3f0.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
age: 21595
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 70036
last-modified: Wed, 14 Jun 2023 09:33:13 GMT
etag: "aa0a9ff38247ad4cf62104f735a1a78c"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: mCdvQo55sv_QI-nqdTZD459KbI0zXV8helKTsRzMVlxrnEgJ70fe_A==

GET
H2 200 6068438.js Show response
js.hs-banner.com/ 60 KB
16 KB 66ms
19ms Script
text/javascript 2606:4700::6812:19c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/6068438.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/6068438.js?integration=WordPress&ver=10.1.16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:19c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ea452eadc5efaf0bc3c4c5285e5f1b4f4c92a5b01c26c99d7f5f89c9442749ac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
x-amz-version-id: lPvgFgL3qGjwKQFUqumxetd2DFL88LOM
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: 2J58R725YB93J2HC
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
age: 44
x-envoy-upstream-service-time: 51
x-amz-id-2: M0GQQ1EjgftxMU6+K5Vv+lQ9Nyu7GEVF5yoqzKXAVvKr1wjsVMxUj5y5rqWJbqAP7bHeipU4HI8=
x-evy-trace-listener: listener_https
x-request-id: cc0de366-3f5f-479b-aabf-e2ca1508a916
x-evy-trace-route-configuration: listener_https/all
last-modified: Mon, 17 Apr 2023 15:46:35 GMT
server: cloudflare
etag: W/"21995b8612a52259cde29a69cc701923"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.nisos.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-9vnjb
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 7d73a29a79859293-FRA
expires: Wed, 14 Jun 2023 15:38:18 GMT

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
3 KB 66ms
19ms Script
application/javascript 2606:4700::6810:77be
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsadspixel.net/fb.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/6068438.js?integration=WordPress&ver=10.1.16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:77be , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eed334d1c96abd8c03aacf86a2a30fb9d391290f27e49b0fa456a7af8f1a1bf8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
x-amz-version-id: wXOaVt.1FYp5SJSGbufdokAhWgyD7J.j
via: 1.1 25d9b5959eaa82bb18ee3f35e6bf34b4.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: IAD12-P1
age: 211
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.381/bundles/pixels-release.js&cfRay=7d739d7339062c19-FRA
x-cache: Hit from cloudfront
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 1
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 29ec3d74-fa6e-41a7-aeba-4128eb824055
last-modified: Mon, 05 Jun 2023 12:31:29 UTC
server: cloudflare
etag: W/"3907b3424cd18a581148905ead09299a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-s8xd8
cf-ray: 7d73a29a7a652c1c-FRA
x-amz-cf-id: Y3JTU0ZQ9zIzE6TaieUVCt4T_1L93DNVzNuAbr22Kdb_YKRay9YcjA==
x-hs-target-asset: adsscriptloaderstatic/static-1.381/bundles/pixels-release.js

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 545 KB
88 KB 70ms
23ms Script
application/javascript 2606:4700::6811:816e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsleadflows.net/leadflows.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/6068438.js?integration=WordPress&ver=10.1.16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:816e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 53c6e25ad853b5a6ad922795465a0e178c87af06b8a7ab3bde53b7b6939902c8

Request headers

Referer: https://www.nisos.com/
Origin: https://www.nisos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-encoding: br
age: 17233
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1213/bundle/main/lead-flows-release.js&cfRay=7d71fddf3cd0162f-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"e0a28490756bd60883ddd702b459f472"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=86400, max-age=0
x-hs-target-asset: lead-flows-js/static-1.1213/bundle/main/lead-flows-release.js
date: Wed, 14 Jun 2023 15:34:02 GMT
x-amz-version-id: 8pz0uDcBGYlrsmWQyDnHbF47HkG8cM.I
via: 1.1 61bbe72b71f7b857c695c31fdeb7b3a6.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P1
x-cache: Hit from cloudfront
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 6
x-evy-trace-route-configuration: listener_https/all
x-request-id: 3f792d9d-1455-4f75-9247-c4eaa3833114
last-modified: Tue, 06 Jun 2023 12:07:08 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-frzj9
cf-ray: 7d73a29a7b17993f-FRA
x-amz-cf-id: D90L6IMg-ihfl_QE9oO-pFMGbWb612o4oLaCZPqbDUnGOHhCQVxjPA==

GET
H2 200 6068438.js Show response
js.hs-analytics.net/analytics/1686756600000/ 66 KB
21 KB 190ms
152ms Script
text/javascript 2606:4700::6810:88ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1686756600000/6068438.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/6068438.js?integration=WordPress&ver=10.1.16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:88ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bc75fde9d885436158a8f8cf693cd18c626e9ae9ebae204e19df8832220a9588

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: EEZF2MX0NBHVNW5X
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-envoy-upstream-service-time: 27
x-amz-id-2: ECRlRA/pxs5cLZGgZS6LyuI7Bgvct++YzBgEl/Wz3h4IkxrpPPks96PQhXi06wT6gz2dymnEzug=
x-evy-trace-listener: listener_https
x-request-id: 9e5c4e28-a57c-492a-bfd4-75fb8881d6f5
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 31 May 2023 18:58:16 GMT
server: cloudflare
etag: W/"53f50056e73efe4d372a3c3d7b9e2afa"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-f4w7q
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 7d73a29a6d709193-FRA
expires: Wed, 14 Jun 2023 15:39:02 GMT

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 69 KB
25 KB 65ms
18ms Script
application/javascript 2606:4700::6811:6bc7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hscollectedforms.net/collectedforms.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/6068438.js?integration=WordPress&ver=10.1.16
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:6bc7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f148a333a7585ab1391cceb303d946f5bf1b38ba6bb8eae863125ccde728bb3

Request headers

Referer: https://www.nisos.com/
Origin: https://www.nisos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-encoding: br
x-evy-trace-route-service-name: envoyset-translator
age: 33
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.378/bundles/project.js&cfRay=7d73a1ccaa2a35fc-IAD
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"b19afd994dc32a5784e74169cca8128a"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: collected-forms-embed-js/static-1.378/bundles/project.js
date: Wed, 14 Jun 2023 15:34:02 GMT
x-amz-version-id: S1jmwKbmrdTaJO._teNI0LpuWSvl4WIJ
via: 1.1 9d2dee9b44718f249b789987d2cbe62c.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
x-cache: RefreshHit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 57
x-evy-trace-route-configuration: listener_https/all
x-request-id: fa133cec-1240-4539-801b-3fd6d3ce46fd
last-modified: Tue, 13 Jun 2023 09:45:35 UTC
server: cloudflare
access-control-max-age: 3000
x-hs-cache-status: MISS
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-ksc82
cf-ray: 7d73a29a7b7135f1-FRA
x-amz-cf-id: iqgVTpI6_wmdXggonFdHq2RofQx4PmluAZlPU9uhf1tWp5g2471LWg==

GET
H2 200 bat.js Show response
bat.bing.com/ 40 KB
12 KB 75ms
40ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TCFL7R7

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Wed, 14 Jun 2023 15:34:02 GMT
last-modified: Thu, 11 May 2023 18:08:27 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C5F69E02C6444B1192AE9DA9FCB4C004 Ref B: FRAEDGE1814 Ref C: 2023-06-14T15:34:02Z
etag: "80df77953384d91:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 12183

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 46ms
12ms Script
application/x-javascript 2a02:26f0:3100::1735:28a8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TCFL7R7

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3100::1735:28a8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 10 Jan 2023 17:22:56 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=48252
accept-ranges: bytes
content-length: 4777

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 67 KB
22 KB 52ms
10ms Script
text/javascript 2600:9000:225e:3a00:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TCFL7R7
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:3a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 226c9a2c80c75e3c5d7d197c484adb7d63e6ea36270af348bc223be73e8cd059

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

X-Amz-Version-Id: 7FBoqqSL1b96.AgPH.JEYo4TSgYS0kb0
Content-Encoding: gzip
Via: 1.1 816b7f4e336674d9d7828ef4700482e8.cloudfront.net (CloudFront)
Date: Wed, 14 Jun 2023 15:08:10 GMT
Age: 1553
X-Amz-Cf-Pop: FRA60-P4
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Tue, 09 May 2023 21:27:29 GMT
Server: AmazonS3
Etag: W/"7866810a321f41ea101e7bcfaa572323"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Access-Control-Max-Age: 600
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: C4yzDKqyWGt8TpsfrIhruj5zxiN9XGvJYs795TszwOHpBmVl2t_mSg==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 124 KB
48 KB 31ms
28ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-145073476-1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TCFL7R7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a75e7e052a2b87f6f8c7e0c0f78eebbd3008f04127cda0ff0539717ae7fa1441

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 49292
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 14 Jun 2023 15:34:02 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 255 KB
87 KB 34ms
33ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CTEG3MX1VW&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-145073476-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

04005429f31429788cc953c4fd36a05eb6ce58c963f0df9a7f4898dc73f0ae6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 88925
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 14 Jun 2023 15:34:02 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 64ms
14ms Script
text/javascript 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-145073476-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 14 Jun 2023 14:04:36 GMT
last-modified: Mon, 17 Apr 2023 22:36:01 GMT
server: Golfe2
age: 5366
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20737
expires: Wed, 14 Jun 2023 16:04:36 GMT

GET
H2 204 3206651 Show response
vc.hotjar.io/sessions/ 0
259 B 70ms
34ms XHR
text/plain 18.66.112.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vc.hotjar.io/sessions/3206651?s=0.25&r=0.01694941683730522
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.5718b73ab85bca652332.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-110.fra56.r.cloudfront.net
Software: Python/3.8 aiohttp/3.8.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
via: 1.1 1fd323b9134f7d940dac0d007036a604.cloudfront.net (CloudFront)
server: Python/3.8 aiohttp/3.8.4
x-amz-cf-pop: FRA56-P5
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-store
x-amz-cf-id: qfeSzVKu-0qNOQfAZv9Mc6UTH_gjlpKHoIPtR2STmFKG14S4R5BxYw==

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/3206651/ 148 B
322 B 140ms
46ms XHR
application/json 34.255.78.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/3206651/visit-data?sv=5
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.5718b73ab85bca652332.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.255.78.124 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-255-78-124.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: ca9d3bdace9ebc26af8da67aaf1e2392aa60db9e2b889568f318a768773c3a68

Request headers

Referer: https://www.nisos.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Wed, 14 Jun 2023 15:34:02 GMT
content-encoding: br
vary: Accept-Encoding
access-control-max-age: 86400
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, no-store
access-control-allow-credentials: true

OPTIONS
H2 200 view
js.hs-banner.com/cookie-banner-public/v1/activity/ 0
0 128ms
108ms Preflight
application/octet-stream 2606:4700::6812:19c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/cookie-banner-public/v1/activity/view
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:19c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.nisos.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://www.nisos.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-max-age: 604800
cf-cache-status: DYNAMIC
cf-ray: 7d73a29bd8fd30f9-FRA
content-length: 0
content-type: application/octet-stream
date: Wed, 14 Jun 2023 15:34:02 GMT
server: cloudflare
timing-allow-origin: *
vary: origin
x-envoy-upstream-service-time: 0
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-f4w7q
x-evy-trace-virtual-host: all
x-request-id: f67bbe61-cc55-4b5b-aa8f-7ece1ab96d38

POST
H2 204 view Show response
js.hs-banner.com/cookie-banner-public/v1/activity/ 0
191 B 123ms
122ms XHR
text/plain 2606:4700::6812:19c4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/cookie-banner-public/v1/activity/view
Requested by: Host: js.hs-banner.com
URL: https://js.hs-banner.com/6068438.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:19c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.nisos.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 14 Jun 2023 15:34:03 GMT
cf-cache-status: DYNAMIC
x-hubspot-correlation-id: ff1eedae-8207-414c-902a-336f284ec88b
x-evy-trace-route-service-name: envoyset-translator
x-envoy-upstream-service-time: 17
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: bfb08646-ef9b-4f35-911c-0b3d56ce8a32
server: cloudflare
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://www.nisos.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
vary: origin
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7dbb6c8f49-9vnjb
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 7d73a29c7a3b30f9-FRA

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/4343073/domain/nisos.com/ 36 B
377 B 58ms
16ms XHR
application/json 2600:9000:237d:ec00:2:53b2:240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/4343073/domain/nisos.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:237d:ec00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://www.nisos.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 14:01:50 GMT
content-encoding: gzip
via: 1.1 ef6c1b0d6b04f2b7f81eb00fa448b890.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P2
age: 5531
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=11068
x-amz-cf-id: iHKne07KgDvtZaYZ6Mp9aBBbhlpq77xbEQGhR5MEd8G55MCFSpzjTg==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4343073&time=1686756842832&url=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4343073&time=1686756842832&url=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D4343073%26time%3D1686756842832%26url%3Dhttps%253A%252F%252Fwww.nisos.com%252Frese...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=4343073&time=1686756842832&url=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&cookiesTest=true&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4343073&time=1686756842832&url=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&cookiesTest=true&liSync=tr...

0
265 B

208ms
157ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4343073&time=1686756842832&url=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&cookiesTest=true&liSync=true&e_ipv6=AQKOS61cXEvFXwAAAYi6it-csD4iuzBEGmUvtpRHjRZQf9M8l2NFgibKBXRwGDK41YAYFGw_I1Kr
Requested by: Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:03 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 885722FCBBF143D8BF7B52391BD1D461 Ref B: FRAEDGE1811 Ref C: 2023-06-14T15:34:03Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX+GK58cC8ojehsyQQxeA==

Redirect headers

date: Wed, 14 Jun 2023 15:34:03 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: C4ED5FB2DEBC4D658F03044982CD3ED8 Ref B: FRAEDGE1519 Ref C: 2023-06-14T15:34:03Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=4343073&time=1686756842832&url=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&cookiesTest=true&liSync=true&e_ipv6=AQKOS61cXEvFXwAAAYi6it-csD4iuzBEGmUvtpRHjRZQf9M8l2NFgibKBXRwGDK41YAYFGw_I1Kr
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX+GK55XoEsAdtZw7iZtw==

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/exp/ZCNLOBHP6JAMPK46MHW4HJ/ 38 B
795 B 13ms
11ms Script
application/javascript 2600:9000:225e:3a00:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/ZCNLOBHP6JAMPK46MHW4HJ/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:3a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e6c19d4ee9832249a4a542057fe1cda984efb525973cb294831ec5ecc42367f7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

X-Amz-Version-Id: DjOpQH2sw6uC5p3PKudk47QAd2CrhYAs
Date: Wed, 14 Jun 2023 07:55:47 GMT
Via: 1.1 816b7f4e336674d9d7828ef4700482e8.cloudfront.net (CloudFront)
Age: 27496
X-Amz-Cf-Pop: FRA60-P4
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 38
Last-Modified: Tue, 21 Mar 2023 16:36:52 GMT
Server: AmazonS3
Etag: "f5a64db38c4218cefe3f9d7531faf9a1"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 600
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: oIejIwhPgjoEouqvYW5Oa_5eAKSQQrHDRyBFSkbJZzKV4UtyftnrnA==

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/pre/
Redirect Chain

https://s.adroll.com/j/pre/ZCNLOBHP6JAMPK46MHW4HJ/FQF5LWUC4ZDBZCUBYYYETE/fpconsent.js
https://s.adroll.com/j/pre/index.js

0
756 B

9ms
9ms

Script
application/javascript

2600:9000:225e:3a00:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/index.js
Requested by: Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
Protocol: HTTP/1.1
Server: 2600:9000:225e:3a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

X-Amz-Version-Id: nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Date: Tue, 13 Jun 2023 20:37:02 GMT
Via: 1.1 b2ba97e9b6a83eff85433dad7f6e6288.cloudfront.net (CloudFront)
Age: 68221
X-Amz-Cf-Pop: FRA60-P4
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Last-Modified: Wed, 15 Jan 2020 23:54:18 GMT
Server: AmazonS3
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 600
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: QqtJNiSrp09AlZ-ylk6jo7t4rQQbCwhPQlS1R0DEYhuUNRh67JV16w==

Redirect headers

Date: Wed, 14 Jun 2023 07:55:46 GMT
Via: 1.1 816b7f4e336674d9d7828ef4700482e8.cloudfront.net (CloudFront)
Age: 27496
X-Amz-Cf-Pop: FRA60-P4
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Server: AmazonS3
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/xml
Location: https://s.adroll.com/j/pre/index.js
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: jjeby1QUAdQxlQI4T_bx4ZPBXdsHAFOEnItCIhx1IWk8Bl9YSooQxQ==

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/ZCNLOBHP6JAMPK46MHW4HJ/FQF5LWUC4ZDBZCUBYYYETE/ 0
807 B 36ms
18ms Script
text/javascript 2600:9000:225e:3a00:6:9280:1080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/ZCNLOBHP6JAMPK46MHW4HJ/FQF5LWUC4ZDBZCUBYYYETE/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:3a00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

X-Amz-Version-Id: Eox1lmY_Ux6DZUKk7GfLKfthSrWj5yne
Date: Wed, 14 Jun 2023 15:34:02 GMT
Via: 1.1 b2ba97e9b6a83eff85433dad7f6e6288.cloudfront.net (CloudFront)
Age: 41
X-Amz-Cf-Pop: FRA60-P4
X-Amz-Server-Side-Encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 0
Last-Modified: Tue, 13 Jun 2023 12:12:21 GMT
Server: AmazonS3
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Access-Control-Max-Age: 600
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: YaM02VBM6OjfkY9xJkqYlpLDFnBgzcO4YdeSoK27_LMgTMHBp9SA6A==

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 115 B
448 B 126ms
111ms XHR
application/json 2606:4700::6811:6bc7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=6068438&utk=
Requested by: Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:6bc7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 486c0b266a6576698325f0f56089aa3891fdc3f6f0d8f162435e3bfca57848fb

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.nisos.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:03 GMT
content-encoding: br
cf-cache-status: DYNAMIC
x-hubspot-correlation-id: 85cbdb01-0d52-415d-a842-b525ac1c7db8
x-evy-trace-route-service-name: envoyset-translator
x-envoy-upstream-service-time: 2
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 70ba5fb2-b453-4a26-af85-2307d1a73de6
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.nisos.com
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-57ff77fcd-qrxbq
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 7d73a29c1d4435f1-FRA

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
206 B 18ms
17ms XHR
text/plain 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j100&a=503011578&t=pageview&_s=1&dl=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&ul=en-us&de=UTF-8&dt=Page%20not%20found%20-%20Nisos&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=1422360943&gjid=205553035&cid=351063578.1686756843&tid=UA-145073476-1&_gid=1946730238.1686756843&_r=1&gtm=457e36c0&jsscut=1&z=1488125399

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.nisos.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 14 Jun 2023 15:34:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.nisos.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
253 B 51ms
18ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-CTEG3MX1VW&gtm=45je36c0&_p=503011578&_gaz=1&cid=351063578.1686756843&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1686756842&sct=1&seg=0&dl=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&dt=Page%20not%20found%20-%20Nisos&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CTEG3MX1VW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Jun 2023 15:34:03 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.nisos.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
244 B 69ms
26ms Ping
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-CTEG3MX1VW&cid=351063578.1686756843&gtm=45je36c0&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CTEG3MX1VW&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Jun 2023 15:34:03 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.nisos.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 78ms
41ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-CTEG3MX1VW&cid=351063578.1686756843&gtm=45je36c0&aip=1&z=1035076816

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Jun 2023 15:34:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 149003803.js Show response
bat.bing.com/p/action/ 0
117 B 171ms
171ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/149003803.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Wed, 14 Jun 2023 15:34:02 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 608D8608E52B4A7B82E86BFBE9C14537 Ref B: FRAEDGE1814 Ref C: 2023-06-14T15:34:02Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
286 B 33ms
33ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=149003803&tm=gtm002&Ver=2&mid=3cfc0c7a-6b66-4d0c-9d8e-ab636b78f1f8&sid=e3faf2400ac811ee8f111528cb27d236&vid=e3fb19000ac811eea72eff84af284763&vids=1&msclkid=N&gtm_tag_source=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Page%20not%20found%20-%20Nisos&p=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&r=&lt=903&evt=pageLoad&sv=1&rn=534399

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 14 Jun 2023 15:34:02 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 63CE0A8E5E434FFEB66D1FCA0F3A6B63 Ref B: FRAEDGE1814 Ref C: 2023-06-14T15:34:02Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
content.hotjar.io/ 56 B
161 B 178ms
98ms XHR
application/json 54.229.94.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.hotjar.io/?gzip=1
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.5718b73ab85bca652332.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.229.94.52 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-94-52.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: afc128e8702d24a42f3ca35b782c7016b7c27608d7431f278c3e2d136d077fb9

Request headers

Referer: https://www.nisos.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 14 Jun 2023 15:34:03 GMT
content-length: 56
vary: Origin
content-type: application/json

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 43ms
26ms XHR
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-145073476-1&cid=351063578.1686756843&jid=1422360943&gjid=205553035&_gid=1946730238.1686756843&_u=YEBAAUAAAAAAACAAI~&z=336583065

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.nisos.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 14 Jun 2023 15:34:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.nisos.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ZCNLOBHP6JAMPK46MHW4HJ Show response
d.adroll.com/consent/check/ 463 B
556 B 599ms
194ms Script
application/javascript 2600:1f14:cc6:ea04:4d6d:dcdd:12a6:3f04
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/ZCNLOBHP6JAMPK46MHW4HJ?pv=56190532501.95922&arrfrr=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&_s=15ceada91729085bc999916815027cae&_b=2
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f14:cc6:ea04:4d6d:dcdd:12a6:3f04 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: de99d69fdf03c393ee84673d2ad8a3ff30daf9e4875b8958e82be5b78fd3cc64

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:03 GMT
server: nginx/1.22.1
content-length: 463
content-type: application/javascript

GET
H/1.1 200
OK counters.gif
forms.hsforms.com/embed/v3/ 35 B
983 B 144ms
124ms Image
image/gif 2606:4700::6811:d6f3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=2

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:d6f3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Wed, 14 Jun 2023 15:34:03 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
CF-Cache-Status: DYNAMIC
X-HubSpot-Correlation-Id: be1547c7-5cc5-4691-bbae-96aa923df4da
x-evy-trace-route-service-name: envoyset-translator
x-envoy-upstream-service-time: 2
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 5c02319b-a42f-4021-b89e-b32837e41380
Server: cloudflare
X-Trace: 2B2940799E39E0F004E7E2042D8482A42416F1CB02000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-759c64d45c-dfxrz
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 7d73a29cf98f1cc3-FRA

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 76ms
40ms Image
image/gif 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-145073476-1&cid=351063578.1686756843&jid=1422360943&_u=YEBAAUAAAAAAACAAI~&z=1792210660

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Jun 2023 15:34:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 39ms
38ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-145073476-1&cid=351063578.1686756843&jid=1422360943&_u=YEBAAUAAAAAAACAAI~&z=1792210660

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Jun 2023 15:34:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
192 B 134ms
110ms XHR
text/html 23.36.163.106
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.163.106 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-163-106.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:03 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.nisos.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 23 B
306 B 74ms
8ms XHR
text/html 2a02:26f0:3100::210:6e5b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3100::210:6e5b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 0ecdd1c67e2f0f4c370f118e55269664f8221cd4107973408c9c691594218fd3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Jun 2023 15:34:03 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.nisos.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a00:c98:2050:a007:2::8
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="468543_34631255_41292849_23_879_7_0_-";dur=1
content-length: 23
expires: Wed, 14 Jun 2023 15:34:03 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 323ms
291ms Image
image/gif 23.36.163.106
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=3dfff14e51083acf56ac79a38773850e&svisitor=null&visitor=9495a636-44f2-471b-8b84-d24267d59099&session=cdca2205-551c-4e81-8a08-c0a5e8d7373b&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2014%20Jun%202023%2015%3A34%3A02%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2014%20Jun%202023%2015%3A34%3A02%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%223dfff14e51083acf56ac79a38773850e%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2014%20Jun%202023%2015%3A34%3A02%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2014%20Jun%202023%2015%3A34%3A02%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Page%20not%20found%20-%20Nisos%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&pageViewId=e1d37ca2-12f9-4066-8d1e-3d9b9ee676b2

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.163.106 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-163-106.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:04 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 145ms
125ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3485376358&v=1.1&a=6068438&ct=standard-page&pu=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&t=Page+not+found+-+Nisos&cts=1686756843719&vi=4c7c229adadb529511198f3753706284&nc=true&ce=false&pt=1&cc=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 697ad417-d724-4037-a998-a4803c81be4d
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 6
alt-svc: h3=":443"; ma=86400
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 55b7f792-4a6a-4691-8de6-14119fd7182e
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mKAoblR%2BmNrZoX81%2BOHmLvEGggxnSgfn3oPSXN9uR13u5bdVfkJmehsjlOwZodYu%2Bg6Z5Da3h6VFEW0KwyAAo83f%2Bi3veGUbm%2FNeAEQjytvxe2Wz7V9cgVs4hUlZEPBQfmhEEjNJ4YT%2Bnq7Lw8Xz"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-5f6448c676-mc94g
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 7d73a2a16de0bbaf-FRA
x-robots-tag: none

GET
H3 200 alt-nisos-logo.png
www.nisos.com/wp-content/uploads/2023/04/ 18 KB
19 KB 41ms
41ms Image
image/png 162.159.134.42
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.nisos.com/wp-content/uploads/2023/04/alt-nisos-logo.png

Requested by

Host: www.nisos.com
URL: https://www.nisos.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.4

Protocol

Security

QUIC, , AES_128_GCM

Server

162.159.134.42 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57f4680898f2af59bf83a8bedb562603677780be4133457db08e6314c6438723

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/research/trigona-ransomware-explained/***IOCs:***IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:03 GMT
ki-cache-tag: 55585fc0-2726-4e8a-bfac-54fdf091b637,9e1cc11f922671cae97c6059e0bef5e438bbaee348bf1fa087f49aef62e5be2d
cf-cache-status: HIT
ki-edge: v=19.0.6;mv=1.1.3
x-content-type-options: nosniff
age: 1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 18447
last-modified: Mon, 17 Apr 2023 14:31:45 GMT
server: cloudflare
etag: "643d5851-480f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rVfPiS1wX5qqOXvfp3eUVJkYWaISUcaWbi4A5FehnxgFa%2BMixxJkrjSHWn%2BmXcVh5j1y%2BI9e12buxP9p3eRvHu4kY96d%2FuvasF8EzNlphp8lEMDUAkw81TbeygnJ3vU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=2592000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 7d73a2a159fb6927-FRA
ki-cf-cache-status: HIT
x-edge-location-klb: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 321ms
321ms Image
image/gif 23.36.163.106
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=3dfff14e51083acf56ac79a38773850e&svisitor=null&visitor=9495a636-44f2-471b-8b84-d24267d59099&session=cdca2205-551c-4e81-8a08-c0a5e8d7373b&event=ipv6&q=%7B%22address%22%3A%222a00%3Ac98%3A2050%3Aa007%3A2%3A%3A8%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Page%20not%20found%20-%20Nisos%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&pageViewId=e1d37ca2-12f9-4066-8d1e-3d9b9ee676b2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.163.106 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-163-106.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:04 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 221ms
221ms Image
image/gif 23.36.163.106
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.36.163.106 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-36-163-106.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.nisos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:34:04 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET img.gif
b.6sc.co/v1/beacon/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=3dfff14e51083acf56ac79a38773850e&svisitor=null&visitor=9495a636-44f2-471b-8b84-d24267d59099&session=cdca2205-551c-4e81-8a08-c0a5e8d7373b&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2014%20Jun%202023%2015%3A34%3A05%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2014%20Jun%202023%2015%3A34%3A04%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223204%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Page%20not%20found%20-%20Nisos%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&pageViewId=e1d37ca2-12f9-4066-8d1e-3d9b9ee676b2

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=3dfff14e51083acf56ac79a38773850e&svisitor=null&visitor=9495a636-44f2-471b-8b84-d24267d59099&session=cdca2205-551c-4e81-8a08-c0a5e8d7373b&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2014%20Jun%202023%2015%3A34%3A06%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2014%20Jun%202023%2015%3A34%3A05%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224205%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Page%20not%20found%20-%20Nisos%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&pageViewId=e1d37ca2-12f9-4066-8d1e-3d9b9ee676b2

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=3dfff14e51083acf56ac79a38773850e&svisitor=null&visitor=9495a636-44f2-471b-8b84-d24267d59099&session=cdca2205-551c-4e81-8a08-c0a5e8d7373b&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2014%20Jun%202023%2015%3A34%3A07%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2014%20Jun%202023%2015%3A34%3A06%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225206%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Page%20not%20found%20-%20Nisos%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.nisos.com%2Fresearch%2Ftrigona-ransomware-explained%2F***IOCs%3A***IP&pageViewId=e1d37ca2-12f9-4066-8d1e-3d9b9ee676b2

Verdicts & Comments Add Verdict or Comment

201 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

25 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.nisos.com/	1970-01-20 14:42:12	Name: _gcl_au Value: 1.1.1846083222.1686756843
.nisos.com/	1970-01-20 21:18:12	Name: _hjSessionUser_3206651 Value: eyJpZCI6ImY3NzllZGRmLWMxNTgtNTRmMS05Y2E3LTVlNGFkZDBkYWFhZiIsImNyZWF0ZWQiOjE2ODY3NTY4NDI3MzUsImV4aXN0aW5nIjpmYWxzZX0=
.nisos.com/	1970-01-20 12:32:38	Name: _hjFirstSeen Value: 1
.nisos.com/	1970-01-20 12:32:36	Name: _hjIncludedInSessionSample_3206651 Value: 1
.nisos.com/	1970-01-20 12:32:38	Name: _hjSession_3206651 Value: eyJpZCI6IjVlNjRmY2MxLTU5ZTItNDFmNS05YTJiLWM1NDI3YzU4NTAwMiIsImNyZWF0ZWQiOjE2ODY3NTY4NDI3NDcsImluU2FtcGxlIjp0cnVlfQ==
.nisos.com/	1970-01-20 12:32:38	Name: _hjAbsoluteSessionInProgress Value: 1
.nisos.com/	1970-01-20 12:34:03	Name: _gid Value: GA1.2.1946730238.1686756843
.nisos.com/	1970-01-20 12:32:36	Name: _gat_gtag_UA_145073476_1 Value: 1
.nisos.com/	1970-01-20 22:08:36	Name: _ga_CTEG3MX1VW Value: GS1.1.1686756842.1.0.1686756842.60.0.0
.nisos.com/	1970-01-20 22:08:36	Name: _ga Value: GA1.1.351063578.1686756843
.nisos.com/	1970-01-20 12:34:03	Name: _uetsid Value: e3faf2400ac811ee8f111528cb27d236
.nisos.com/	1970-01-20 21:54:12	Name: _uetvid Value: e3fb19000ac811eea72eff84af284763
www.nisos.com/	1970-01-20 12:34:03	Name: ln_or Value: eyI0MzQzMDczIjoiZCJ9
.bing.com/	1970-01-20 21:54:12	Name: MUID Value: 134FFB5CB08E651202A0E86CB18E64A1
.linkedin.com/	1970-01-20 14:42:12	Name: li_sugr Value: 4d75e8df-89bb-4299-82f3-3cfaea456204
.linkedin.com/	1970-01-20 21:18:12	Name: bcookie Value: "v=2&80938463-2f22-458c-838e-f4d35bb4c34a"
.linkedin.com/	1970-01-20 12:34:03	Name: lidc Value: "b=TGST03:s=T:r=T:a=T:p=T:g=2995:u=1:x=1:i=1686756842:t=1686843242:v=2:sig=AQEk5FPkGrefI0pfRzrwd3_OXrfqXIYr"
.linkedin.com/	1970-01-20 13:15:48	Name: UserMatchHistory Value: AQKGr2DqFzYtugAAAYi6it5gjjkMIA8S2mHmGnA9FpRSo-PTbx_RS_5oKKnR4adnKpsL_kb16GDljw
.linkedin.com/	1970-01-20 13:15:48	Name: AnalyticsSyncHistory Value: AQI5S6LD1w6QsQAAAYi6it5gx99Dq9D8Um69CkYRYgBkNm_YLFO0pIGvpkoyVtxpFfHVebAYxpVKCS4660jCNQ
.www.linkedin.com/	1970-01-20 21:18:12	Name: bscookie Value: "v=1&202306141534032775048a-9bb5-43c6-81dd-2edbbacd3dacAQEdyB8ZTqrLgOOFidypTJp7Xa-UdaLB"
.linkedin.com/	1970-01-20 16:51:48	Name: li_gc Value: MTswOzE2ODY3NTY4NDM7MjswMjGtM5rVolC7FAm48gMGIJKZHA5vOBEFoN7yzm9eUvvkow==
www.nisos.com/	1970-01-20 22:08:36	Name: _gd_visitor Value: 9495a636-44f2-471b-8b84-d24267d59099
www.nisos.com/	1970-01-20 12:32:51	Name: _gd_session Value: cdca2205-551c-4e81-8a08-c0a5e8d7373b
.hubspot.com/	1970-01-20 12:32:38	Name: __cf_bm Value: yM6ztfxnJD0l1n0_PT25muq0dqM9tHQhY8OPp2BtLe0-1686756843-0-Acs+lJCv43CCdLS6JkHLRD/cDgEGk6Q0U8pkIk7vwnKthsZqNazRnlD9lr6W5tsFmZLmro9L5OFQBg27s8jLwmk=
.6sc.co/	1970-01-20 22:08:36	Name: 6suuid Value: 4ea1241717150400ecdd896462000000ddc01200

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.nisos.com/research/trigona-ransomware-explained/*IOCs:IP Message*: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://lltrck.com/scripts/lt-v3.js?llid=33234 Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b.6sc.co
bat.bing.com
c.6sc.co
cdn.linkedin.oribi.io
content.hotjar.io
d.adroll.com
fonts.googleapis.com
fonts.gstatic.com
forms.hscollectedforms.net
forms.hsforms.com
in.hotjar.com
ipv6.6sc.co
j.6sc.co
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsleadflows.net
ka-f.fontawesome.com
kit.fontawesome.com
lltrck.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
s.adroll.com
script.hotjar.com
snap.licdn.com
static.hotjar.com
stats.g.doubleclick.net
track.hubspot.com
vc.hotjar.io
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.nisos.com
b.6sc.co
13.107.42.14
13.227.219.3
162.159.134.42
18.66.112.110
18.66.192.125
2001:4860:4802:34::36
2001:4860:4802:38::178
23.36.163.106
2600:1f14:cc6:ea04:4d6d:dcdd:12a6:3f04
2600:9000:225e:3a00:6:9280:1080:93a1
2600:9000:237d:ec00:2:53b2:240:93a1
2606:4700::6810:77be
2606:4700::6810:88ce
2606:4700::6811:6bc7
2606:4700::6811:816e
2606:4700::6811:d6f3
2606:4700::6812:1634
2606:4700::6812:19c4
2606:4700::6812:863b
2606:4700::6813:9b53
2606:4700:e6::ac40:ca1c
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:809::2003
2a00:1450:4001:80b::2004
2a00:1450:4001:813::200a
2a00:1450:4001:828::2003
2a00:1450:4001:830::2008
2a00:1450:400c:c00::9b
2a02:26f0:3100::1735:28a8
2a02:26f0:3100::210:6e5b
34.255.78.124
52.200.29.199
54.229.94.52
04005429f31429788cc953c4fd36a05eb6ce58c963f0df9a7f4898dc73f0ae6f
0521badda7c602b73185aa5e23dd04fcb5f5ce5e0f1d693ff2cf9474178c1fee
0a75aa5bab9865958cd01d39856dc37e96491296ef55f5d2fdce2915b1ea1c58
0e53a639010f02dd7e7c3859f82daeffa535fc069b3e4145640af023dc386f86
0ecdd1c67e2f0f4c370f118e55269664f8221cd4107973408c9c691594218fd3
10fd67d6c6eac5cdfda0b370fb6b23bc1fc4b9f1f1a7cb8b401aac906f2a6822
12d03201aa733372057226d7a64c2fa3544859acb87fd88347950d1fbe66727a
1ca76922f55b389b8f590ae7e3bcc3a2dccdce3aff1e5a4335af081b76a414ea
20476c3fffc3c6f35095c566e8eff0342e3ddb73841c39b58455dc970522e7f7
226c9a2c80c75e3c5d7d197c484adb7d63e6ea36270af348bc223be73e8cd059
2414767fbf3e93d3269cb3795b6c667da0f58a8f662dfd8aabb0807243d1134f
26764edc2000ff1b83064a99effb1fe10e7cddf5b1a2c406a6d10a86b852eda6
2b4e13a4e12823ec6fe43ef5d7775abe7c9badf09c6f51693eb7722a924c68e9
2d6a60541b6205300575d1c6a1e92c4c139f4dccadfe00ff9b3a85ceb6c81110
3175dd776c73e3f90beb2340fd7d138a7fce24c1054a73f08216b1aa7e357534
36e3278d17196da0532b353687c478f36936ecc8b6493d0b176ba69fdff05427
427edd6de036cf6d976fe0126fe3b9f30aceae3185bc4c7169f85b35aa7619c3
43b5c9ad80f0a5d1c63568583e9cf6cd5ca8454a680f4ee80d5d63d00b15a360
43bfa4cb8df3cc265a138e9e526679040ac26b50498319031ad41b77c6f01f84
462747422c6af30aa81a0373fa1cfd736455cef52bdbb816f67be9531d84eace
46bbc7b22b8c58dc664cd4b31da0906636b96c8d64b839b1671d3eff081f6c1e
486c0b266a6576698325f0f56089aa3891fdc3f6f0d8f162435e3bfca57848fb
4aec96eddab69454e554bb60664da2e5043c363ebef6921644f619523e7274d7
50c36bc2a71485bc6939c1f5de3d1b38ff260d9de91dac1855df0b50c35d81bd
53c6e25ad853b5a6ad922795465a0e178c87af06b8a7ab3bde53b7b6939902c8
5489746d9317f7924511ff59d5781ef51906900a231fe46684c1e512a09ef076
56c81b4086d742cf938f6fbc06de7dab26cce2ea6a889b6cf94a356251495631
57f4680898f2af59bf83a8bedb562603677780be4133457db08e6314c6438723
5bad0658ea23d85d08fe0c5484686cf9c7e7ebefefc47627c8013a0f1647c289
67154bc8868a4e60ffeb64c6512e70acb648a5420a5eb7eaf86b20bb0a8457e3
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
67eb879fb1645c73ccbaac598e815fd3901eb5114228021d686b8b5e470edbbd
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6ca9f43967b272f585a9feb7ffc604462bea2cd2339e0a173899fe45e95b37c5
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
71e85b13d24a31d782e71da9f9192b5160369ec5ad1cb37988555d3eb93225d9
71f229efc891fac06cdafe9765967f3dc1ce71db155e7130042e7e64aab7f43a
73881513a7e7f8944a311bea8e80e9fad946e256ae74d62b5c8d469dc6df0186
754233622f501da9f79ca0d4626d442150d84aee8a909201132fa960b2bf803c
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7f148a333a7585ab1391cceb303d946f5bf1b38ba6bb8eae863125ccde728bb3
7f8b63bff49fba3c5bae30f4eb39f2fd6d088fbe9d7292bdf37b0ef4a1ec68d6
80fa756dda143f69fb3ce750e905cc8188150dc4c6b7539bf3627fe26530b405
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8c90d3c0b0e49b95857fbd4a60728451deb97ac4079be355467deac9ee7de4a4
8e71262c3e6d9eac19580f7725c2f1619790e8feb7fa6f536c029d94dcedc128
8ef3755c1c0e73dd384a7a7c4d07fb899808284d0639a70d7db43fc51c3e6419
9198751141182778ff336c74f4d7e3ad6757f13199c7958dcb7be81182fa2c34
925d5ba38a0c2f9ab7df22566d1b0eec56615e69ea93b84c5e79a7f3074eb02a
97490bd354a26885acf09c0ba5b4c3c76d12bb55193f13456d3aa2ded6eda6fd
9810aee7e6d57d8cceaa96322b88e6df46710194689ae12b284149148cabc2f3
99a15b32a81b6f965c2e5bd6c582f7ffc73adfa751fc2465a00f3104e7a6cf95
a1786585ac9beb929463e7f963468e7e40da9b7b0111a0aab6673abdd2309b0b
a75e7e052a2b87f6f8c7e0c0f78eebbd3008f04127cda0ff0539717ae7fa1441
aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4
afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a
afc128e8702d24a42f3ca35b782c7016b7c27608d7431f278c3e2d136d077fb9
b5cec8800ffe6b92993466f61ec4f4d5ee6dee946a942b9356559821585fb650
b6aed488d128d02850cfb20b4de28a2eceffddd04342f413bbe88a141235a976
ba2eeab126375c9cc2fabe9a6fe35f25dea57c52df280e6e24a790f5f45be878
ba7e231732c5791c70061b395c1d28b929f28ed1f6ec000fad64727a36c46da3
bc75fde9d885436158a8f8cf693cd18c626e9ae9ebae204e19df8832220a9588
bd94017c98cb7e9337f4bcc1e3dbf22ad1e048853d188bf896591d9e1f11af67
ca3af915877e0f119ce0df14dfce6249f76222c600e23882fa7c7f99788971cc
ca7dce2391845e8aec7da135f33fabd10f74eed28a532ac66fd01f761fcfb42f
ca9d3bdace9ebc26af8da67aaf1e2392aa60db9e2b889568f318a768773c3a68
db5ffd916dbeb4938cc236cb3a42e73a56987f28c5deb9f3beccbe2c4af19307
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de99d69fdf03c393ee84673d2ad8a3ff30daf9e4875b8958e82be5b78fd3cc64
e00add38134eac2fb8e8e9c09cbfff7bbe57952b210322eb2eecb0a21fc055eb
e103f8eeb3f4ba878184dea6d2137c6d5d2e0356e62fb5b8385c3d0e0ec598fd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6c19d4ee9832249a4a542057fe1cda984efb525973cb294831ec5ecc42367f7
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
ea452eadc5efaf0bc3c4c5285e5f1b4f4c92a5b01c26c99d7f5f89c9442749ac
eabc19480b6212343af7996aa06029eb00e8a05d9709b4c8b05e3222558a12f1
ece9d22203d0bc59232a7ff5bc7b4df4342c89630387b0366595ba92b724957e
edab33ffa43d915a22d81599b90cbb00b4cb988809ea65d55b60f70c892a3426
eed334d1c96abd8c03aacf86a2a30fb9d391290f27e49b0fa456a7af8f1a1bf8
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f40767552e5e94b2d5f9a65d7f640cfa7d225298023dbd682095e040809a3d1a
f458a5ebc15497471776087f952bf006491e6be2f96c4c4cf055c27fbe795daa
f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f
f820d93daf383e178bda2912f5bee00e90e56390597820622643fa8e5e487143
fa5ba6fab394d537af1ad89a49479e9953ab0f96251532163c794a3ccea938e3
fbcc9f3151a357828aa120dc98bafa35359d42c83b4cd39693009f43e2ae9098
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

www.nisos.com Open in urlscan Pro 162.159.134.42 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

110 Requests

95 %HTTPS

74 %IPv6

26 Domains

38 Subdomains

34 IPs

5 Countries

1159 kBTransfer

4247 kBSize

25 Cookies

4 Outgoing links

Redirected requests

110 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.nisos.com Open in urlscan Pro
162.159.134.42 Public Scan

Screenshot
Live screenshot

Full Image

110
Requests

95 %
HTTPS

74 %
IPv6

26
Domains

38
Subdomains

34
IPs

5
Countries

1159 kB
Transfer

4247 kB
Size

25
Cookies

110 HTTP transactions
0 data transactions