urlscan.io logo urlscan.io
SecurityTrails logo

www.fortinet.com Open in urlscan Pro
52.8.142.247  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Submission: On May 06 via api from CH
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 27 IPs in 5 countries across 16 domains to perform 52 HTTP transactions. The main IP is 52.8.142.247, located in San Jose, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is www.fortinet.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on March 19th 2019. Valid for: 2 years.
This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
6 52.8.142.247 16509 (AMAZON-02)
2 2.19.43.118 20940 (AKAMAI-ASN1)
7 104.111.217.111 16625 (AKAMAI-AS)
1 2a00:1450:400... 15169 (GOOGLE)
1 3 54.77.248.112 16509 (AMAZON-02)
1 4 52.52.145.59 16509 (AMAZON-02)
1 2.16.186.146 20940 (AKAMAI-ASN1)
4 2a00:1450:400... 15169 (GOOGLE)
1 52.51.131.19 16509 (AMAZON-02)
1 4 172.82.235.45 15224 (OMNITURE)
1 1 66.117.28.86 15224 (OMNITURE)
1 52.210.171.107 16509 (AMAZON-02)
1 34.203.158.69 14618 (AMAZON-AES)
2 23.67.137.77 20940 (AKAMAI-ASN1)
1 2 172.82.228.19 15224 (OMNITURE)
2 104.111.214.206 16625 (AKAMAI-AS)
1 2a02:26f0:60:... 20940 (AKAMAI-ASN1)
3 23.111.9.217 33438 (HIGHWINDS2)
1 50.17.52.222 14618 (AMAZON-AES)
1 54.247.170.113 16509 (AMAZON-02)
1 3 18.195.194.147 16509 (AMAZON-02)
1 66.117.29.11 15224 (OMNITURE)
1 2a03:2880:f01... 32934 (FACEBOOK)
1 54.246.117.210 16509 (AMAZON-02)
2 3 2a05:f500:11:... 14413 (LINKEDIN)
1 1 2620:109:c002... 14413 (LINKEDIN)
1 138.197.13.10 14061 (DIGITALOC...)
2 178.128.135.233 14061 (DIGITALOC...)
52 27
6    52.8.142.247 (San Jose, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-8-142-247.us-west-1.compute.amazonaws.com
www.fortinet.com
2    2.19.43.118 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-43-118.deploy.static.akamaitechnologies.com
platform-api.sharethis.com
buttons-config.sharethis.com
7    104.111.217.111 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-217-111.deploy.static.akamaitechnologies.com
assets.adobedtm.com
1    2a00:1450:4001:824::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
3    54.77.248.112 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-77-248-112.eu-west-1.compute.amazonaws.com
dpm.demdex.net
4    52.52.145.59 (San Jose, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-52-145-59.us-west-1.compute.amazonaws.com
www.fortinet.com
1    2.16.186.146 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-146.deploy.static.akamaitechnologies.com
c.sharethis.mgr.consensu.org
4    2a00:1450:4001:81f::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    52.51.131.19 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-51-131-19.eu-west-1.compute.amazonaws.com
fortinet.demdex.net
4    172.82.235.45 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: fortinet.com.ssl.sc.omtrdc.net
metrics.fortinet.com
1    66.117.28.86 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
cm.everesttech.net
1    52.210.171.107 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-210-171-107.eu-west-1.compute.amazonaws.com
dpm.demdex.net
1    34.203.158.69 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-203-158-69.compute-1.amazonaws.com
count-server.sharethis.com
2    23.67.137.77 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-67-137-77.deploy.static.akamaitechnologies.com
platform-cdn.sharethis.com
2    172.82.228.19 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: *.sc.omtrdc.net
fortinetinc.sc.omtrdc.net
2    104.111.214.206 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-214-206.deploy.static.akamaitechnologies.com
s.adroll.com
1    2a02:26f0:60:88f::3adf (European Union)

ASN20940 (AKAMAI-ASN1, US)
sjs.bizographics.com
3    23.111.9.217 (Phoenix, United States)

ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)
a.optmnstr.com
1    50.17.52.222 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-50-17-52-222.compute-1.amazonaws.com
api.opmnstr.com
1    54.247.170.113 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-247-170-113.eu-west-1.compute.amazonaws.com
d.adroll.com
3    18.195.194.147 (Cambridge, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-195-194-147.eu-central-1.compute.amazonaws.com
l.sharethis.com
1    66.117.29.11 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
fortinet.tt.omtrdc.net
1    2a03:2880:f01c:20e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
graph.facebook.com
1    54.246.117.210 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-246-117-210.eu-west-1.compute.amazonaws.com
d.adroll.com
3    2a05:f500:11:101::b93f:9005 (Ireland)

ASN14413 (LINKEDIN - LinkedIn Corporation, US)
px.ads.linkedin.com
1    2620:109:c002::6cae:a0a (United States)

ASN14413 (LINKEDIN - LinkedIn Corporation, US)
www.linkedin.com
1    138.197.13.10 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
a.mstrlytcs.com
2    178.128.135.233 (Greece)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
z.opmnstr.com
Domain Requested by
10 www.fortinet.com 1 redirects www.fortinet.com
7 assets.adobedtm.com www.fortinet.com
assets.adobedtm.com
4 metrics.fortinet.com 1 redirects www.fortinet.com
4 www.google-analytics.com www.googletagmanager.com
www.fortinet.com
4 dpm.demdex.net 1 redirects www.fortinet.com
3 px.ads.linkedin.com 2 redirects
3 l.sharethis.com 1 redirects www.fortinet.com
3 a.optmnstr.com www.googletagmanager.com
a.optmnstr.com
2 z.opmnstr.com a.optmnstr.com
2 d.adroll.com s.adroll.com
www.fortinet.com
2 s.adroll.com www.googletagmanager.com
s.adroll.com
2 fortinetinc.sc.omtrdc.net 1 redirects www.fortinet.com
2 platform-cdn.sharethis.com www.fortinet.com
1 a.mstrlytcs.com a.optmnstr.com
1 www.linkedin.com 1 redirects
1 graph.facebook.com platform-api.sharethis.com
1 fortinet.tt.omtrdc.net assets.adobedtm.com
1 api.opmnstr.com a.optmnstr.com
1 sjs.bizographics.com www.googletagmanager.com
1 count-server.sharethis.com platform-api.sharethis.com
1 cm.everesttech.net 1 redirects
1 fortinet.demdex.net assets.adobedtm.com
1 c.sharethis.mgr.consensu.org platform-api.sharethis.com
1 www.googletagmanager.com www.fortinet.com
1 buttons-config.sharethis.com platform-api.sharethis.com
1 platform-api.sharethis.com www.fortinet.com
52 26
Subject Issuer Validity Valid
www.fortinet.com
DigiCert SHA2 High Assurance Server CA		 2019-03-19 -
2021-06-09		 2 years crt.sh
*.sharethis.com
DigiCert SHA2 Secure Server CA		 2018-12-16 -
2020-03-16		 a year crt.sh
assets.adobedtm.com
DigiCert SHA2 High Assurance Server CA		 2019-03-04 -
2020-03-11		 a year crt.sh
*.google-analytics.com
Google Internet Authority G3		 2019-04-16 -
2019-07-09		 3 months crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA		 2018-01-09 -
2021-02-12		 3 years crt.sh
*.sharethis.mgr.consensu.org
DigiCert ECC Secure Server CA		 2018-07-31 -
2019-07-31		 a year crt.sh
metrics.fortinet.com
DigiCert SHA2 High Assurance Server CA		 2019-01-29 -
2021-02-02		 2 years crt.sh
*.sc.omtrdc.net
DigiCert SHA2 High Assurance Server CA		 2019-04-23 -
2020-04-14		 a year crt.sh
*.adroll.com
DigiCert SHA2 Secure Server CA		 2018-12-19 -
2020-03-19		 a year crt.sh
js.bizographics.com
DigiCert SHA2 Secure Server CA		 2018-04-13 -
2020-04-17		 2 years crt.sh
*.optmnstr.com
Go Daddy Secure Certificate Authority - G2		 2018-07-10 -
2020-07-10		 2 years crt.sh
*.opmnstr.com
Go Daddy Secure Certificate Authority - G2		 2019-04-11 -
2021-04-11		 2 years crt.sh
*.tt.omtrdc.net
DigiCert SHA2 High Assurance Server CA		 2017-10-19 -
2020-11-25		 3 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2019-03-08 -
2019-06-06		 3 months crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA		 2017-06-06 -
2019-06-11		 2 years crt.sh
*.mstrlytcs.com
Go Daddy Secure Certificate Authority - G2		 2017-08-25 -
2019-08-25		 2 years crt.sh
z.opmnstr.com
Let's Encrypt Authority X3		 2019-04-11 -
2019-07-10		 3 months crt.sh

This page contains 6 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Frame ID: C3F5932F3438782B11F05A4BDE3C8143
Requests: 50 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Frame ID: 753DFC685EE43FE0AF0584DC945D750B
Requests: 1 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: A3A56EE377D43F7129D36AE3D3FCA2EE
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864a164746d58b700412b.html
Frame ID: 904183CE961D7304C818D14535F2CCDB
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864f264746d7629003a65.html
Frame ID: 8C368D70491C3915495BE34D5BC859CD
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa8640864746d58b700411f.html
Frame ID: B62BBC83BED38A2D0A5A8B3B70E7E3FE
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /(?:a|s)\.adroll\.com/i
  • env /^adroll_/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i
Overall confidence: 100%
Detected patterns
  • env /^google_tag_manager$/i
Overall confidence: 100%
Detected patterns
  • script /\/s[_-]code.*\.js/i
  • env /^s_(?:account|objectID|code|INST)$/i
Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

52
Requests

100 %
HTTPS

21 %
IPv6

16
Domains

26
Subdomains

27
IPs

5
Countries

912 kB
Transfer

1933 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7
  • https://dpm.demdex.net/id?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557147471745 HTTP 302
  • https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557147471745
Request Chain 19
  • https://metrics.fortinet.com/id?d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=48885899896119891624058560648070046536&ts=1557147471993 HTTP 302
  • https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=48885899896119891624058560648070046536&ts=1557147471993&AQE=1
Request Chain 20
  • https://cm.everesttech.net/cm/dd?d_uuid=48509052917063539544095115112451015360 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=XNAvUAAAFDm4vhN_
Request Chain 29
  • https://www.fortinet.com/content/fortinet-blog/us/en/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png HTTP 301
  • https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png
Request Chain 31
  • https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=48885899896119891624058560648070046536&ts=1557147471993&AQE=1 HTTP 302
  • https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=48885899896119891624058560648070046536&ts=1557147471993&AQE=1
Request Chain 38
  • https://l.sharethis.com/pview?event=pview&version=st_sop.js&lang=en&hostname=www.fortinet.com&location=%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&product=sticky-share-buttons&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&source=sharethis.js&fcmp=false&title=LockerGoga%3A%20Ransomware%20Targeting%20Critical%20Infrastructure&publisher=5977d47080bb1d0011ab6d8f&ts1557147471641=&sop=true HTTP 301
  • https://l.sharethis.com/sc?cm=ZGABC1zQL1AAAAASLxhAAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
Request Chain 45
  • https://px.ads.linkedin.com/collect/?time=1557147473560&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1 HTTP 302
  • https://px.ads.linkedin.com/collect/?time=1557147473560&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1557147473560%26pid%3D7120%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Flockergoga-ransomeware-targeting-critical-infrastructure.html%26fmt%3Djs%26s%3D1%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect/?time=1557147473560&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1&cookiesTest=true&liSync=true

52 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request lockergoga-ransomeware-targeting-critical-infrastructure.html
www.fortinet.com/blog/threat-research/ 		51 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
37a2d3ed4482161212f1fbf4706656bcc9b247035a772840ea588e712d6e0270
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
www.fortinet.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=600, public
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Mon, 06 May 2019 12:57:51 GMT
ETag
"cc1d-5882b38b65d00-gzip"
Last-Modified
Sun, 05 May 2019 22:08:20 GMT
Server
Apache
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Vary
Accept-Encoding,User-Agent
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
Content-Length
12124
Connection
keep-alive
clientlib-base.min.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 		211 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
eb6058ea8eec777d07e89407b55de7990eb296b3f5a5ee4a6b04c71d3c129c42
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:51 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:26:14 GMT
Server
Apache
ETag
"34d65-5878de44ddd80-gzip"
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
text/css
Cache-Control
max-age=43200, public
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
Content-Length
16858
X-XSS-Protection
1; mode=block
sharethis.js
platform-api.sharethis.com/js/ 		91 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e5c2f85b9e49be5acd30c8ba3767b124d8945f35000eef89902a0485c04e6040

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:51 GMT
Content-Encoding
gzip
ETag
W/"16d4e-SgmVDK5mv+C+DRaEIjQ3WYUSiQ4"
Vary
Accept-Encoding
Access-Control-Allow-Methods
DELETE, GET, HEAD, OPTIONS, POST, PUT
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Content-Length
27855
satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/ 		144 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.217.111 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-217-111.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f2bf5964adbfac80827ae87c5f7c0f05e51f416e3e2132fd93dc2e2d98f2e935

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 12:57:51 GMT
content-encoding
gzip
last-modified
Thu, 25 Apr 2019 23:34:48 GMT
server
Apache
etag
"479d7011b674847178716d558563c2d3:1556235288"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 06 May 2019 13:57:51 GMT
fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 		32 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:52 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:29:19 GMT
Server
Apache
ETag
"7ebb-5878def54bdc0-gzip"
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
Content-Length
1998
X-XSS-Protection
1; mode=block
clientlib-base.min.js
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 		165 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
85c6103aabd94bf4584fbdd8b15cb68c08fa52f43dc229ac034a1bf6c855c0bc
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:51 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:27:24 GMT
Server
Apache
ETag
"2931b-5878de879fb00-gzip"
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
application/javascript
Cache-Control
max-age=43200, public
transfer-encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
X-XSS-Protection
1; mode=block
5977d47080bb1d0011ab6d8f.js
buttons-config.sharethis.com/js/ 		444 B
865 B 		Script
General
Check archive.org
Download Go to
Full URL
https://buttons-config.sharethis.com/js/5977d47080bb1d0011ab6d8f.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-118.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
7f0daa7591ef2b42b26dd9d39102440c242e7fd798e7898a620e5489d67ec73e

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:51 GMT
Last-Modified
Tue, 16 Jan 2018 20:14:52 GMT
Server
AmazonS3
x-amz-request-id
33BF777283B6DCED
ETag
"6167cc13570c31ffc1713616a6fb087d"
Content-Type
text/javascript
Cache-Control
public, max-age=60
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
444
x-amz-id-2
hsILMaWrKRvq3dU3rIiiMpbXCpEB1o2SKOTVgl6vRXE0vKuZmuHru/osDcmeuqMHuHCSYNUlvNc=
gtm.js
www.googletagmanager.com/ 		60 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager (scaffolding) /
Resource Hash
604ae5068c06ac47597ed7e1c587a0ce7d8ff6e8174a979b285169f1b3277016
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 12:57:51 GMT
content-encoding
br
last-modified
Wed, 01 May 2019 22:14:49 GMT
server
Google Tag Manager (scaffolding)
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
23009
x-xss-protection
0
expires
Mon, 06 May 2019 12:57:51 GMT
rd
dpm.demdex.net/id/
Redirect Chain
  • https://dpm.demdex.net/id?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557147471745
  • https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557147471745
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557147471745
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.248.112 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-77-248-112.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Location
https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557147471745
X-TID
yOQci3sFTSU=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.fortinet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Access-Control-Allow-Origin
https://www.fortinet.com
X-TID
yOQci3sFTSU=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557147471745
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
mbox-contents-081c7224345c702ebcf6ef22d3b7449ec11ce42d.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/ 		75 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/mbox-contents-081c7224345c702ebcf6ef22d3b7449ec11ce42d.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.217.111 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-217-111.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
bf37dba5836581c0cc0451edd5c197e46a5a0e070b3f696e5b4bf7e32da1817a

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Mon, 06 May 2019 12:57:51 GMT
content-encoding
gzip
last-modified
Thu, 25 Apr 2019 23:34:48 GMT
server
Apache
etag
"eb6d969848d866a39a78150c4a347735:1556235288"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
27590
expires
Mon, 06 May 2019 13:57:51 GMT
truncated
/ 		71 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
image/png
lockergoga.png
www.fortinet.com/content/dam/fortinet-blog/article-images/lockergoga-blog/ 		110 KB
110 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/lockergoga-blog/lockergoga.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
caa02d6bc107a0f648a41c4572b8e7fd71278b2e740e4bc809594dd3dc446c8d
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:52 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:26:56 GMT
Server
Apache
ETag
"1b7e9-5878de6cebc00"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
112617
X-XSS-Protection
1; mode=block
anatova-blog-two.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/anatova-ransomware/ 		78 KB
78 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/anatova-ransomware/anatova-blog-two.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.52.145.59 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-52-145-59.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
c9e784c91038976835b53028e10a3f90e1508036aaba1859a820ffec8c2e9486
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:52 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 03:36:33 GMT
Server
Apache
ETag
"1374e-5878edfc6b240"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
79694
X-XSS-Protection
1; mode=block
TLR-img.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/tlr-q4-blog/ 		66 KB
66 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/tlr-q4-blog/TLR-img.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
af780899477625834ea7cd70915f91c4cc903413e1fd8769a9117d22adcb7865
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:52 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 03:10:12 GMT
Server
Apache
ETag
"107eb-5878e818a8d00"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
67563
X-XSS-Protection
1; mode=block
gandcrab-honor-among-thieves-thumb.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/gandcrab--honor-among-thieves/ 		64 KB
65 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/gandcrab--honor-among-thieves/gandcrab-honor-among-thieves-thumb.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.52.145.59 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-52-145-59.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
26e382d9c4380bd0293c2d41be30b754a01fb09db5d2e5c6b60bbd0368efb2ed
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:52 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:30:20 GMT
Server
Apache
ETag
"10052-5878df2f78700"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
65618
X-XSS-Protection
1; mode=block
portal.html
c.sharethis.mgr.consensu.org/v1.0/cmp/ Frame 753D 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.146 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-146.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Host
c.sharethis.mgr.consensu.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods
DELETE, GET, HEAD, OPTIONS, POST, PUT
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
ETag
W/"26b-4977387000"
Last-Modified
Tue, 01 Jan 1980 00:00:00 GMT
Vary
Accept-Encoding
Content-Length
334
Cache-Control
public, max-age=3600
Date
Mon, 06 May 2019 12:57:52 GMT
Connection
keep-alive
rd
dpm.demdex.net/id/ 		367 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557147471745
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.77.248.112 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-77-248-112.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
5d645bece527c844e39cd10f6e9c2c8034683e8608f5a678b084a46b331cb631

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v028-026986ffe.edge-irl1.demdex.com 5.52.1.20190424113352 4ms
Pragma
no-cache
Content-Encoding
gzip
X-TID
kiC0N0+iRVw=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.fortinet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
302
Expires
Thu, 01 Jan 1970 00:00:00 GMT
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Jan 2019 20:01:45 GMT
server
Golfe2
age
5122
date
Mon, 06 May 2019 11:32:29 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
17543
expires
Mon, 06 May 2019 13:32:29 GMT
collect
www.google-analytics.com/r/ 		35 B
111 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j73&a=723090342&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&ul=en-us&de=UTF-8&dt=LockerGoga%3A%20Ransomware%20Targeting%20Critical%20Infrastructure&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAAAB~&jid=555905312&gjid=631356255&cid=1747933879.1557147472&tid=UA-767980-6&_gid=269090738.1557147472&_r=1&gtm=2wg430NBSLLPJ&z=1089413769
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 06 May 2019 12:57:51 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
Cookie set dest5.html
fortinet.demdex.net/ Frame A3A5 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://fortinet.demdex.net/dest5.html?d_nsid=0
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.51.131.19 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-51-131-19.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Host
fortinet.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Accept-Encoding
gzip, deflate, br
Cookie
demdex=48509052917063539544095115112451015360
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Thu, 25 Apr 2019 10:08:22 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=48509052917063539544095115112451015360;Path=/;Domain=.demdex.net;Expires=Sat, 02-Nov-2019 12:57:52 GMT;Max-Age=15552000
Vary
Accept-Encoding, User-Agent
X-TID
ecRsKID9QEc=
Content-Length
2764
Connection
keep-alive
id
fortinetinc.sc.omtrdc.net/
Redirect Chain
  • https://metrics.fortinet.com/id?d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=48885899896119891624058560648070046536&ts=1557147471993
  • https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critic...
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=48885899896119891624058560648070046536&ts=1557147471993&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.82.235.45 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
fortinet.com.ssl.sc.omtrdc.net
Software
Omniture DC/2.0.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:52 GMT
X-Content-Type-Options
nosniff
Access-Control-Allow-Origin
https://www.fortinet.com
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 12:57:52 GMT
Server
Omniture DC/2.0.0
xserver
www108
Content-Type
text/plain
Location
https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=48885899896119891624058560648070046536&ts=1557147471993&AQE=1
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Keep-Alive
timeout=15
Expires
Sun, 05 May 2019 12:57:52 GMT

Redirect headers

Date
Mon, 06 May 2019 12:57:52 GMT
X-Content-Type-Options
nosniff
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 12:57:52 GMT
Server
Omniture DC/2.0.0
xserver
www108
Location
https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=48885899896119891624058560648070046536&ts=1557147471993&AQE=1
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.fortinet.com
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Keep-Alive
timeout=15
Expires
Sun, 05 May 2019 12:57:52 GMT
ibs:dpid=411&dpuuid=XNAvUAAAFDm4vhN_
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=48509052917063539544095115112451015360
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=XNAvUAAAFDm4vhN_
42 B
769 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XNAvUAAAFDm4vhN_
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.210.171.107 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-210-171-107.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v028-0b996802c.edge-irl1.demdex.com 5.52.1.20190424113352 3ms
Pragma
no-cache
X-TID
710s04QQTZw=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date
Mon, 06 May 2019 12:57:51 GMT
Server
AMO-cookiemap/1.1
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XNAvUAAAFDm4vhN_
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=15,max=100
Content-Length
0
satellite-5aa864a164746d58b700412b.html
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ Frame 9041 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864a164746d58b700412b.html
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.217.111 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-217-111.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
assets.adobedtm.com
:scheme
https
:path
/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864a164746d58b700412b.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html

Response headers

status
200
server
Apache
etag
"52fa849a16651953dc915efbae88d0cc:1556235289"
last-modified
Thu, 25 Apr 2019 23:34:49 GMT
accept-ranges
bytes
content-type
text/html
vary
Accept-Encoding
content-encoding
gzip
content-length
803
cache-control
max-age=3600
expires
Mon, 06 May 2019 13:57:52 GMT
date
Mon, 06 May 2019 12:57:52 GMT
timing-allow-origin
*
satellite-5aa864f264746d7629003a65.html
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ Frame 8C36 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864f264746d7629003a65.html
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.217.111 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-217-111.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
assets.adobedtm.com
:scheme
https
:path
/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864f264746d7629003a65.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html

Response headers

status
200
server
Apache
etag
"8227658d1e33b9eaa91028e35c3beb4f:1556235289"
last-modified
Thu, 25 Apr 2019 23:34:49 GMT
accept-ranges
bytes
content-type
text/html
vary
Accept-Encoding
content-encoding
gzip
content-length
782
cache-control
max-age=3600
expires
Mon, 06 May 2019 13:57:52 GMT
date
Mon, 06 May 2019 12:57:52 GMT
timing-allow-origin
*
satellite-5aa8640864746d58b700411f.html
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ Frame B62B 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa8640864746d58b700411f.html
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.217.111 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-217-111.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
assets.adobedtm.com
:scheme
https
:path
/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa8640864746d58b700411f.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html

Response headers

status
200
server
Apache
etag
"94b6dd03c710fe7140881c36dbb5ab47:1556235289"
last-modified
Thu, 25 Apr 2019 23:34:49 GMT
accept-ranges
bytes
content-type
text/html
vary
Accept-Encoding
content-encoding
gzip
content-length
899
cache-control
max-age=3600
expires
Mon, 06 May 2019 13:57:52 GMT
date
Mon, 06 May 2019 12:57:52 GMT
timing-allow-origin
*
s-code-contents-678d604999b9203058dbe982c7a7ddbf795bb1f4.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/ 		34 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/s-code-contents-678d604999b9203058dbe982c7a7ddbf795bb1f4.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.217.111 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-217-111.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
68588db4f09f1982d74887644c54e581cc6ed7e267f836a480c29ef1a3c0a7a0

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 12:57:52 GMT
content-encoding
gzip
last-modified
Thu, 25 Apr 2019 23:34:48 GMT
server
Apache
etag
"9a1e762486f8afef7a6f384a1e9c253d:1556235288"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
13170
expires
Mon, 06 May 2019 13:57:52 GMT
satellite-59ceae2064746d21fe0037dd.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ 		1 KB
693 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-59ceae2064746d21fe0037dd.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.217.111 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-217-111.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
24038492cb3d19fef34ce0a9bc55033f3030c04eeea97a93c22b2ec8914c1316

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 12:57:52 GMT
content-encoding
gzip
last-modified
Thu, 25 Apr 2019 23:34:49 GMT
server
Apache
etag
"d8619d86a5e27900726ec96a76ead3cc:1556235289"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
459
expires
Mon, 06 May 2019 13:57:52 GMT
get_counts
count-server.sharethis.com/v2.0/ 		327 B
402 B 		Script
General
Check archive.org
Download Go to
Full URL
https://count-server.sharethis.com/v2.0/get_counts?cb=window.__sharethis__.cb3&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&refDomain=www.fortinet.com&sop=true
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.203.158.69 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-203-158-69.compute-1.amazonaws.com
Software
/
Resource Hash
a93d1dfea16ac5c30f63a64073fe4f27b936c092ea5bdfd971685b2c36a642e9

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:52 GMT
Content-Encoding
gzip
Connection
keep-alive
Content-Length
245
Content-Type
application/json
arrow_left.svg
platform-cdn.sharethis.com/img/ 		565 B
949 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/arrow_left.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.137.77 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-137-77.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:52 GMT
Last-Modified
Fri, 04 Jan 2019 18:31:05 GMT
Server
AmazonS3
x-amz-request-id
0163F18421DACD1D
ETag
"b55d8d2b9321e381a3c38a4bddb74037"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
565
x-amz-id-2
8jJiqlKh2b3lHnxok3IzRGezuoyDDxdXXyKuWiW/txNQ3pFQpk7mgpRHvu4X21bKgCpU+1HbAQA=
arrow_right.svg
platform-cdn.sharethis.com/img/ 		565 B
949 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/arrow_right.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.137.77 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-137-77.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:52 GMT
Last-Modified
Fri, 04 Jan 2019 18:31:05 GMT
Server
AmazonS3
x-amz-request-id
25AF35FCA1CA0833
ETag
"9928d025bd5792b718ee0a185f62e67c"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
565
x-amz-id-2
dCLdKn3tqyYf73xYAQUSaaDmWFfnexgsyr3d9weFnmy16Czo0dkgZ132+KcPFu8T818B6DBtLKs=
image_873699664.img.png
www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/
Redirect Chain
  • https://www.fortinet.com/content/fortinet-blog/us/en/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png
  • https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png
92 KB
93 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.52.145.59 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-52-145-59.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
db48939bec021c7c13015d86307bafa2a2f8b832700fa92806d67bb32112462e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:52 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 07:37:33 GMT
Server
Apache
ETag
"1705b-587923da8c940"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
94299
X-XSS-Protection
1; mode=block

Redirect headers

Location
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png
Date
Mon, 06 May 2019 12:57:52 GMT
Server
Apache
Connection
keep-alive
Content-Length
367
Content-Type
text/html; charset=iso-8859-1
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
image/gif
id
metrics.fortinet.com/
Redirect Chain
  • https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critic...
  • https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-c...
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=48885899896119891624058560648070046536&ts=1557147471993&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.82.228.19 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
*.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:52 GMT
X-Content-Type-Options
nosniff
Access-Control-Allow-Origin
null
P3P
CP="This is not a P3P policy"
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 12:57:52 GMT
Server
Omniture DC
xserver
www284
Content-Type
text/plain
Location
https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=48885899896119891624058560648070046536&ts=1557147471993&AQE=1
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Expires
Sun, 05 May 2019 12:57:52 GMT

Redirect headers

Date
Mon, 06 May 2019 12:57:52 GMT
X-Content-Type-Options
nosniff
P3P
CP="This is not a P3P policy"
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 12:57:52 GMT
Server
Omniture DC
xserver
www284
Location
https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=48885899896119891624058560648070046536&ts=1557147471993&AQE=1
Content-Type
text/plain
Access-Control-Allow-Origin
null
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Expires
Sun, 05 May 2019 12:57:52 GMT
roundtrip.js
s.adroll.com/j/ 		32 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.206 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-206.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
6d73aa32774fb131ebbc1faf3f931aaf66e998f808757cbafbcc737f8d769580

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
ea1u3hYQrubY64bATByV7XbdUEwnubrR
Content-Encoding
gzip
x-amz-request-id
78178995BFA9B911
x-amz-server-side-encryption
AES256
Access-Control-Max-Age
600
Date
Mon, 06 May 2019 12:57:52 GMT
Connection
keep-alive
Content-Length
10245
x-amz-id-2
k4ljptkHWQEn1gZQXBAd3ucQCD6jaG5iq1H5yya9xUOVRXeJ6GzAj5lH6PSn8x3O3b/1vsM/aXI=
Last-Modified
Wed, 20 Feb 2019 19:22:50 GMT
Server
AmazonS3
ETag
"a75c16aa500b21e32e06699919372ec4"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
insight.min.js
sjs.bizographics.com/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sjs.bizographics.com/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:60:88f::3adf , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:52 GMT
Content-Encoding
gzip
Last-Modified
Mon, 03 Dec 2018 23:03:30 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=53770
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4571
api.min.js
a.optmnstr.com/app/js/ 		176 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.optmnstr.com/app/js/api.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.217 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
696bac8666ce5bf4e390c7f71dc783a17fb56a3b429c6ff35dd5ad52ae254988

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 12:57:52 GMT
content-encoding
gzip
last-modified
Wed, 01 May 2019 20:28:04 GMT
server
NetDNA-cache/2.2
x-amz-request-id
0EB5603AAEA8151F
etag
W/"893ec539b14306fc6cd144c53e9daa66"
x-cache
HIT
content-type
application/javascript
status
200
cache-control
max-age=2592000
x-amz-id-2
Ux9RiJdNMR2AUJqZZSbvaCtZV3cyg4JI/s5J2WQp5hO18lqTnuTUQt35CUa7jJRMX6BPMKjZS+M=
expires
Wed, 05 Jun 2019 12:57:52 GMT
39852
api.opmnstr.com/v2/embed/ 		163 KB
16 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.opmnstr.com/v2/embed/39852
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.17.52.222 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-50-17-52-222.compute-1.amazonaws.com
Software
Pagely Gateway/1.5.1 /
Resource Hash
04c7fc62027de4c79f20a877f16b3fe9ecc2c45c647cb632b92f0d442784991c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

x-user-agent
standard
content-encoding
gzip
x-cache-config
0 0
server
Pagely Gateway/1.5.1
status
200
date
Mon, 06 May 2019 12:57:55 GMT
x-cache-status
HIT
vary
Accept-Encoding, User-Agent
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-OptinMonster-Account
access-control-allow-headers
X-CSRF-Token
x-optinmonster-account
45602
7OBVBCAQE5FHDPFEAD5T4D
d.adroll.com/consent/check/ 		40 B
200 B 		Script
General
Check archive.org
Download Go to
Full URL
https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D?_s=84db74b51a5fcfd0849923c8c77118d7
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.247.170.113 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-247-170-113.eu-west-1.compute.amazonaws.com
Software
nginx/1.14.1 /
Resource Hash
6f43e1e85c42d5e449308701054501d9867a7254c9a8734406afbc89b3dfe5b4

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:52 GMT
Server
nginx/1.14.1
Connection
keep-alive
Content-Length
40
Content-Type
application/javascript
id
metrics.fortinet.com/ 		49 B
526 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=48885899896119891624058560648070046536&ts=1557147471993&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.82.235.45 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
fortinet.com.ssl.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
bfec638a8f1fbfe057ee1c4bd3718ea4dfbd5e065581460697e1603085e23c4e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
null
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Mon, 06 May 2019 12:57:52 GMT
X-Content-Type-Options
nosniff
Server
Omniture DC
xserver
www292
Vary
Origin
X-C
ms-6.6.0
P3P
CP="This is not a P3P policy"
Access-Control-Allow-Origin
null
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/x-javascript
Keep-Alive
timeout=15
Content-Length
49
X-XSS-Protection
1; mode=block
sc
l.sharethis.com/
Redirect Chain
  • https://l.sharethis.com/pview?event=pview&version=st_sop.js&lang=en&hostname=www.fortinet.com&location=%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&prod...
  • https://l.sharethis.com/sc?cm=ZGABC1zQL1AAAAASLxhAAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://l.sharethis.com/sc?cm=ZGABC1zQL1AAAAASLxhAAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.194.147 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-195-194-147.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:52 GMT
Location
/sc?cm=ZGABC1zQL1AAAAASLxhAAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
Access-Control-Max-Age
1728000
P3p
policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Access-Control-Allow-Origin
https://www.fortinet.com
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
*
Content-Length
224
Stid
ZGABC1zQL1AAAAASLxhAAw==

Redirect headers

Date
Mon, 06 May 2019 12:57:52 GMT
Access-Control-Allow-Origin
https://www.fortinet.com
Access-Control-Max-Age
1728000
P3p
policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Location
/sc?cm=ZGABC1zQL1AAAAASLxhAAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
*
Content-Length
224
Stid
ZGABC1zQL1AAAAASLxhAAw==
s04319818897764
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.10.0-D7QN/ 		43 B
545 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.10.0-D7QN/s04319818897764?AQB=1&ndh=1&pf=1&t=6%2F4%2F2019%2012%3A57%3A52%201%200&sdid=0E5ADF6AFDC3F54A-2C0A4754C6103956&D=D%3D&mid=48885899896119891624058560648070046536&aamlh=6&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Alockergoga-ransomeware-targeting-critical-infrastructure&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&events=event3&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&v3=%2B1&c7=Entire%20Site&c8=New&v25=48885899896119891624058560648070046536&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Alockergoga-ransomeware-targeting-critical-infrastructure&v35=Enabled&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.82.235.45 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
fortinet.com.ssl.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:52 GMT
X-C
ms-6.6.0
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 12:57:52 GMT
Server
Omniture DC
xserver
www7145
ETag
"3343948733731635200-5198070490773598074"
Vary
*
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Keep-Alive
timeout=15
Expires
Sun, 05 May 2019 12:57:52 GMT
json
fortinet.tt.omtrdc.net/m2/fortinet/mbox/ 		96 B
206 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fortinet.tt.omtrdc.net/m2/fortinet/mbox/json?mbox=target-global-mbox&mboxSession=2b2faa7e5e6d46d282eda683723f0675&mboxPC=&mboxPage=7204904a32f04a49aef4bbf92b16cb8c&mboxRid=7a637928d6c4443f9700b076049c109a&mboxVersion=1.6.4&mboxCount=1&mboxTime=1557147471778&mboxHost=www.fortinet.com&mboxURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&mboxReferrer=&browserHeight=1200&browserWidth=1600&browserTimeOffset=0&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&mboxMCSDID=0E5ADF6AFDC3F54A-2C0A4754C6103956&vst.trk=nsmetrics.fortinet.com&vst.trks=metrics.fortinet.com&mboxMCGVID=48885899896119891624058560648070046536&mboxAAMB=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&mboxMCGLH=6
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/mbox-contents-081c7224345c702ebcf6ef22d3b7449ec11ce42d.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
66.117.29.11 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
/
Resource Hash
99347038ebb2499e7422df667fd50ba356486719ff7f8cd2976ebb64801f839d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

pragma
no-cache
date
Mon, 06 May 2019 12:57:52 GMT
status
200
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.fortinet.com
cache-control
no-cache
access-control-allow-credentials
true
timing-allow-origin
*
content-length
96
x-request-id
7a637928d6c4443f9700b076049c109a
consent.js
s.adroll.com/j/ 		67 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/consent.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.206 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-206.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
4983cd18419e417077dcc013922828394049ce6c65db6a782d2d73f225d46089

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
yvF3y5OARyGYjZyuW4BqgiCbPvLhhPrH
Content-Encoding
gzip
x-amz-request-id
7EBD99F69567301D
x-amz-server-side-encryption
AES256
Access-Control-Max-Age
600
Date
Mon, 06 May 2019 12:57:52 GMT
Connection
keep-alive
Content-Length
15051
x-amz-id-2
ZAMLcakp6pamVvhjTbjoBOeKm/lFBqsh3HyHLH8XDul6YO1D/T5bOMFfxhZ5XZIR3NTSb8PhK6U=
Last-Modified
Thu, 06 Dec 2018 16:37:43 GMT
Server
AmazonS3
ETag
"53cd26585ff224c6851303016ec98536"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=300, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
/
graph.facebook.com/ 		585 B
774 B 		Script
General
Check archive.org
Download Go to
Full URL
https://graph.facebook.com/?id=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&callback=window.__sharethis__.cb4
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:20e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
a845f8ef9d6435077c09c3a9ec401f17f9d6b58f0f49f6014d2ff7c04d4be73c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-app-usage
{"call_count":0,"total_cputime":0,"total_time":0}
status
200
date
Mon, 06 May 2019 12:57:52 GMT
x-fb-rev
1000675714
content-length
327
pragma
no-cache
x-fb-debug
r5o2kLD4RZ3JGIysJTbNtxmYPBKojOMOB0sU77Y8RtQFpqPiKJCxDdw2+6VwKhA4qbyImW2jX75EFhioqWIFNg==
x-fb-trace-id
Ap9U9BQszyH
etag
"6d3dddee4e0071d077d11dfab9d235838b02e9fe"
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
x-fb-request-id
ABWw92Y1-mEhli8kMbvzLY9
cache-control
private, no-cache, no-store, must-revalidate
facebook-api-version
v2.9
expires
Sat, 01 Jan 2000 00:00:00 GMT
sc
l.sharethis.com/ 		52 B
696 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://l.sharethis.com/sc?cm=ZGABC1zQL1AAAAASLxhAAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.194.147 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-195-194-147.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
0439d5ff7e89ea41396a2c040cae35697488e06c41b28c6dcb179c995bc5081f

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

Date
Mon, 06 May 2019 12:57:53 GMT
Access-Control-Max-Age
1728000
P3p
policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Access-Control-Allow-Origin
https://www.fortinet.com
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Headers
*
Content-Length
52
Stid
ZGAMPlzQL1EAAAASPJ5lAw==
hod
d.adroll.com/consent/ 		42 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d.adroll.com/consent/hod?_e=view_banner&_s=84db74b51a5fcfd0849923c8c77118d7&_b=626d9f6089ce68&_a=7OBVBCAQE5FHDPFEAD5T4D
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.246.117.210 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-246-117-210.eu-west-1.compute.amazonaws.com
Software
nginx/1.14.1 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:57:53 GMT
Cache-Control
no-transform,public,max-age=300,s-maxage=900
Server
nginx/1.14.1
Connection
keep-alive
Content-Length
42
Vary
Cookie
Content-Type
image/gif
/
px.ads.linkedin.com/collect/
Redirect Chain
  • https://px.ads.linkedin.com/collect/?time=1557147473560&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1
  • https://px.ads.linkedin.com/collect/?time=1557147473560&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1557147473560%26pid%3D7120%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-rese...
  • https://px.ads.linkedin.com/collect/?time=1557147473560&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s...
0
103 B 		Script
General
Check archive.org
Download Go to
Full URL
https://px.ads.linkedin.com/collect/?time=1557147473560&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1&cookiesTest=true&liSync=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 12:57:54 GMT
content-encoding
gzip
server
Play
vary
Accept-Encoding
x-li-fabric
prod-lor1
status
200
x-li-proto
http/2
x-li-pop
prod-tln1
content-type
application/javascript
content-length
20
x-li-uuid
kIorl2IZnBXAqQqG/CoAAA==

Redirect headers

date
Mon, 06 May 2019 12:57:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
302
x-li-pop
prod-edc2
content-length
20
x-li-uuid
vfaTn2AZnBWAUqEgMSsAAA==
pragma
no-cache
server
Play
x-frame-options
sameorigin
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
vary
Accept-Encoding
strict-transport-security
max-age=2592000
x-li-fabric
prod-lor1
location
https://px.ads.linkedin.com/collect/?time=1557147473560&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1&cookiesTest=true&liSync=true
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT
collect
www.google-analytics.com/r/ 		35 B
111 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j73&a=723090342&t=timing&_s=2&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&ul=en-us&de=UTF-8&dt=LockerGoga%3A%20Ransomware%20Targeting%20Critical%20Infrastructure&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&plt=2817&pdt=19&dns=33&rrt=1&srt=321&tcp=480&dit=1387&clt=1387&_gst=1226&_gbt=1251&_cst=1026&_cbt=1220&_u=YEBAAAAB~&jid=2093693984&gjid=57899081&cid=1747933879.1557147472&tid=UA-767980-6&_gid=269090738.1557147472&_r=1&gtm=2wg430NBSLLPJ&z=100314886
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 06 May 2019 12:57:53 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
b5fcd7bd32e11550704192-blog-banner-1024x160-TLR-Q4-2018.jpg
a.optmnstr.com/users/df0603609574/images/ 		78 KB
78 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.optmnstr.com/users/df0603609574/images/b5fcd7bd32e11550704192-blog-banner-1024x160-TLR-Q4-2018.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.217 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
c001e01a6b6a23f4619521bb9a5cdea66124971ab04cf0211649015b0c4af1b1

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 12:57:56 GMT
x-amz-request-id
A72C287067CE6966
x-cache
HIT
status
200
x-amz-meta-date
1550704192
content-length
79452
x-amz-id-2
slvpkKABbzI4epoFWAmFMjSGt4+l253KuFjJHitlCw+Z+7RSFY1Qo4uBRbvNAWKCT8sjvd6IhTw=
x-amz-meta-level
pro
last-modified
Wed, 20 Feb 2019 23:09:53 GMT
server
NetDNA-cache/2.2
x-amz-meta-accountid
45602
etag
"fc7ddf45e300c64bfc4cb7ddc8c325c8"
content-type
image/jpeg
x-amz-meta-userid
39852
x-amz-meta-title
b5fcd7bd32e11550704192-blog-banner-1024x160-TLR-Q4-2018.jpg
cache-control
max-age=2592000
accept-ranges
bytes
expires
Wed, 05 Jun 2019 12:57:56 GMT
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dbeeb3fa5f0188835b6b6208bc89d641f030e79e27ad5712d427eabd79e6095a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
image/png
b5fcd7bd32e11550704192-blog-banner-1024x160-TLR-Q4-2018.jpg
a.optmnstr.com/users/df0603609574/images/ 		78 KB
78 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.optmnstr.com/users/df0603609574/images/b5fcd7bd32e11550704192-blog-banner-1024x160-TLR-Q4-2018.jpg
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.217 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
c001e01a6b6a23f4619521bb9a5cdea66124971ab04cf0211649015b0c4af1b1

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 12:57:56 GMT
x-amz-request-id
A72C287067CE6966
x-cache
HIT
status
200
x-amz-meta-date
1550704192
content-length
79452
x-amz-id-2
slvpkKABbzI4epoFWAmFMjSGt4+l253KuFjJHitlCw+Z+7RSFY1Qo4uBRbvNAWKCT8sjvd6IhTw=
x-amz-meta-level
pro
last-modified
Wed, 20 Feb 2019 23:09:53 GMT
server
NetDNA-cache/2.2
x-amz-meta-accountid
45602
etag
"fc7ddf45e300c64bfc4cb7ddc8c325c8"
content-type
image/jpeg
x-amz-meta-userid
39852
x-amz-meta-title
b5fcd7bd32e11550704192-blog-banner-1024x160-TLR-Q4-2018.jpg
cache-control
max-age=2592000
accept-ranges
bytes
expires
Wed, 05 Jun 2019 12:57:56 GMT
a
a.mstrlytcs.com/v1/ 		0
132 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://a.mstrlytcs.com/v1/a?ty=impression&aid=39852&cid=41325&sid=81773&v=5
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
138.197.13.10 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

status
200
date
Mon, 06 May 2019 12:57:56 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://www.fortinet.com
content-type
text/plain; charset=UTF-8
q
z.opmnstr.com/v2/ 		0
204 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://z.opmnstr.com/v2/q?aid=39852&cid=qxx1b0gslklfu2kjckea&sid=5ab4105aee546&gaid=1306710&gas=5ab42b3012fe2&v=5
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.128.135.233 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
kong/0.14.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

Access-Control-Allow-Origin
https://www.fortinet.com
Date
Mon, 06 May 2019 12:57:56 GMT
Access-Control-Allow-Credentials
true
Server
kong/0.14.1
Connection
keep-alive
i
z.opmnstr.com/v3/ 		0
204 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://z.opmnstr.com/v3/i?aid=39852&cid=qxx1b0gslklfu2kjckea&sid=5ab4105aee546&rt=false&dv=desktop&cty=inline&url=blog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&v=5
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.128.135.233 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
kong/0.14.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

Access-Control-Allow-Origin
https://www.fortinet.com
Date
Mon, 06 May 2019 12:57:56 GMT
Access-Control-Allow-Credentials
true
Server
kong/0.14.1
Connection
keep-alive
collect
www.google-analytics.com/r/ 		35 B
111 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j73&a=723090342&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&ul=en-us&de=UTF-8&dt=LockerGoga%3A%20Ransomware%20Targeting%20Critical%20Infrastructure&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Blog%20-%20Threat%20Research&ea=impression&el=qxx1b0gslklfu2kjckea&_u=6HBAAEAB~&jid=354417475&gjid=466337382&cid=155559583.1557147476&tid=UA-767980-1&_gid=1037679517.1557147476&_r=1&z=1130638315
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 06 May 2019 12:57:56 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

138 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| __stdos__ boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus function| __sharethis__docReady object| __sharethis__ object| dataLayer function| e function| Visitor object| _satellite object| s_c_il number| s_c_in function| targetPageParams object| adobe object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate function| postscribe object| google_tag_manager string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| fortinet_blog object| EasyAutocomplete object| search_config object| keywords object| siteId object| lang object| options boolean| searchFired boolean| blogFilter string| documentsQuery string| blogCategories string| authorsList string| yearsList object| lastQuery number| totalReturn number| lastRow object| lastWordsForCounting function| htmlEncode function| hideAutoComplete function| sitesearch_init function| sitesearch_search_callback function| sitesearch_countall_callback function| sitesearch_do_search function| sitesearch_do_force_search function| sitesearch_spellcheck_callback function| sitesearch_do_spellcheck function| sitesearch_do_suggest_search function| sitesearch_query_searchresult_callback function| sitesearch_do_query_searchresult function| sitesearch_click_page_callback function| sitesearch_click_page function| search_action function| sitesearch_search_fortiguard function| count_facets_type function| shuffle_facets function| csCookies object| cookieScriptWindow object| cookieScripts string| cookieScriptSrc function| cookieQuery string| cookieScriptPosition string| cookieScriptSource string| cookieScriptDomain string| cookieScriptReadMore string| cookieId number| cookieScriptDebug boolean| cookieScriptShowBadge string| cookieScriptCurrentUrl string| pagePath string| cookieScriptTitle string| cookieScriptDesc string| cookieScriptAccept string| cookieScriptMore string| cookieScriptCopyrights string| cookieBackground function| setImmediate function| clearImmediate function| $ function| jQuery undefined| Cookies string| cookieScriptReject function| cookieScriptLoadJavaScript function| InjectCookieScript string| cookieScriptStatsDomain function| cookieScriptCreateCookie function| cookieScriptReadCookie function| cookieScriptAddBox object| cookieScriptCurrentValue string| adroll_adv_id string| adroll_pix_id boolean| __adroll_loaded string| _bizo_data_partner_id undefined| _bizo_data_partner_title undefined| _bizo_data_partner_domain undefined| _bizo_data_partner_company undefined| _bizo_data_partner_location undefined| _bizo_data_partner_employee_range undefined| _bizo_data_partner_sics undefined| _bizo_data_partner_email function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq object| t function| OptinMonsterApp boolean| om_loaded object| om45602_39852 string| adroll_sid object| __adroll boolean| adroll_optout object| adroll_ext_network object| adroll_callbacks function| adroll_tpc_callback object| s_i_fortinetincproduction object| __adroll_consent boolean| __adroll_consent_is_gdpr object| $jscomp string| BANNER_VERSION object| __adroll_consent_banner function| _bizo_local_logger function| _bizo_fire_partners boolean| _bizo_main_already_called object| _omapp object| omajiy6yksgfbr0illbjel object| ombs6hw8oho0l8z5lmhzmv object| omqxx1b0gslklfu2kjckea object| omtaoi2gud8wo2ip9kbnpv function| fbAsyncInit

3 Cookies

Domain/Path Name / Value
.fortinet.com/ Name: _gat_UA-767980-6
Value: 1
www.fortinet.com/ Name: st_shares_https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Value: [object Object]
.fortinet.com/ Name: mbox
Value: session#2b2faa7e5e6d46d282eda683723f0675#1557149334

9 Console Messages

Source Level URL
Text
console-api warning URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api warning URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[object Object]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
console.groupEnd
console-api warning URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[object Object]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
console.groupEnd

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.mstrlytcs.com
a.optmnstr.com
api.opmnstr.com
assets.adobedtm.com
buttons-config.sharethis.com
c.sharethis.mgr.consensu.org
cm.everesttech.net
count-server.sharethis.com
d.adroll.com
dpm.demdex.net
fortinet.demdex.net
fortinet.tt.omtrdc.net
fortinetinc.sc.omtrdc.net
graph.facebook.com
l.sharethis.com
metrics.fortinet.com
platform-api.sharethis.com
platform-cdn.sharethis.com
px.ads.linkedin.com
s.adroll.com
sjs.bizographics.com
www.fortinet.com
www.google-analytics.com
www.googletagmanager.com
www.linkedin.com
z.opmnstr.com
104.111.214.206
104.111.217.111
138.197.13.10
172.82.228.19
172.82.235.45
178.128.135.233
18.195.194.147
2.16.186.146
2.19.43.118
23.111.9.217
23.67.137.77
2620:109:c002::6cae:a0a
2a00:1450:4001:81f::200e
2a00:1450:4001:824::2008
2a02:26f0:60:88f::3adf
2a03:2880:f01c:20e:face:b00c:0:2
2a05:f500:11:101::b93f:9005
34.203.158.69
50.17.52.222
52.210.171.107
52.51.131.19
52.52.145.59
52.8.142.247
54.246.117.210
54.247.170.113
54.77.248.112
66.117.28.86
66.117.29.11
0439d5ff7e89ea41396a2c040cae35697488e06c41b28c6dcb179c995bc5081f
04c7fc62027de4c79f20a877f16b3fe9ecc2c45c647cb632b92f0d442784991c
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e
24038492cb3d19fef34ce0a9bc55033f3030c04eeea97a93c22b2ec8914c1316
26e382d9c4380bd0293c2d41be30b754a01fb09db5d2e5c6b60bbd0368efb2ed
37a2d3ed4482161212f1fbf4706656bcc9b247035a772840ea588e712d6e0270
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
4983cd18419e417077dcc013922828394049ce6c65db6a782d2d73f225d46089
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38
5d645bece527c844e39cd10f6e9c2c8034683e8608f5a678b084a46b331cb631
604ae5068c06ac47597ed7e1c587a0ce7d8ff6e8174a979b285169f1b3277016
68588db4f09f1982d74887644c54e581cc6ed7e267f836a480c29ef1a3c0a7a0
696bac8666ce5bf4e390c7f71dc783a17fb56a3b429c6ff35dd5ad52ae254988
6d73aa32774fb131ebbc1faf3f931aaf66e998f808757cbafbcc737f8d769580
6f43e1e85c42d5e449308701054501d9867a7254c9a8734406afbc89b3dfe5b4
7f0daa7591ef2b42b26dd9d39102440c242e7fd798e7898a620e5489d67ec73e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85c6103aabd94bf4584fbdd8b15cb68c08fa52f43dc229ac034a1bf6c855c0bc
99347038ebb2499e7422df667fd50ba356486719ff7f8cd2976ebb64801f839d
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a845f8ef9d6435077c09c3a9ec401f17f9d6b58f0f49f6014d2ff7c04d4be73c
a93d1dfea16ac5c30f63a64073fe4f27b936c092ea5bdfd971685b2c36a642e9
af780899477625834ea7cd70915f91c4cc903413e1fd8769a9117d22adcb7865
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b
bf37dba5836581c0cc0451edd5c197e46a5a0e070b3f696e5b4bf7e32da1817a
bfec638a8f1fbfe057ee1c4bd3718ea4dfbd5e065581460697e1603085e23c4e
c001e01a6b6a23f4619521bb9a5cdea66124971ab04cf0211649015b0c4af1b1
c9e784c91038976835b53028e10a3f90e1508036aaba1859a820ffec8c2e9486
caa02d6bc107a0f648a41c4572b8e7fd71278b2e740e4bc809594dd3dc446c8d
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
db48939bec021c7c13015d86307bafa2a2f8b832700fa92806d67bb32112462e
dbeeb3fa5f0188835b6b6208bc89d641f030e79e27ad5712d427eabd79e6095a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5c2f85b9e49be5acd30c8ba3767b124d8945f35000eef89902a0485c04e6040
eb6058ea8eec777d07e89407b55de7990eb296b3f5a5ee4a6b04c71d3c129c42
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2bf5964adbfac80827ae87c5f7c0f05e51f416e3e2132fd93dc2e2d98f2e935