malware.news Open in urlscan Pro
2606:4700:20::ac43:4a41 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Submission: On November 19 via api (November 19th 2024, 9:27:43 am UTC) from IN — Scanned from DE

Summary HTTP 45 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 6 domains to perform 45 HTTP transactions. The main IP is 2606:4700:20::ac43:4a41, located in United States and belongs to CLOUDFLARENET, US. The main domain is malware.news. The Cisco Umbrella rank of the primary domain is 935442.
TLS certificate: Issued by WE1 on November 6th 2024. Valid for: 3 months.

This is the only time malware.news was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
39	2606:4700:20:... 2606:4700:20::ac43:4a41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:81c::2008	15169 (GOOGLE) (GOOGLE)
2	2600:9000:223... 2600:9000:223c:aa00:2:e48e:e6c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c00::9d	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
45	7

39 2606:4700:20::ac43:4a41 (United States)

ASN13335 (CLOUDFLARENET, US)

malware.news	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:223c:aa00:2:e48e:e6c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

cyber.levelblue.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
39	malware.news malware.news — Cisco Umbrella Rank: 935442	1 MB
2	levelblue.com cyber.levelblue.com	145 KB
1	google.de www.google.de — Cisco Umbrella Rank: 10745	63 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 135	552 B
1	google.com region1.analytics.google.com — Cisco Umbrella Rank: 4108
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	95 KB
45	6

	Domain	Requested by
39	malware.news	malware.news
2	cyber.levelblue.com	malware.news
1	www.google.de	malware.news
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	www.googletagmanager.com	malware.news
45	6

This site contains links to these domains. Also see Links.

Domain
www.cve.org
www.zyxel.com
www.youtube.com
otx.alienvault.com
attack.mitre.org
research.checkpoint.com
blog.netlab.360.com
www.justice.gov
www.trendmicro.com
cybersecurity.att.com
discourse.org

Subject Issuer	Validity	Valid
malware.news WE1	`2024-11-06` - `2025-02-04`	3 months	crt.sh
*.google-analytics.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
attcybersecurity.bynder.com Amazon RSA 2048 M02	`2024-03-20` - `2025-04-18`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.google.de WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Frame ID: 137A18A5E0EA29B06509E5727BA75C2D
Requests: 47 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Ngioweb Remains Active 7 Years Later - Malware News - Malware Analysis, News and Indicators

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

45
Requests

100 %
HTTPS

100 %
IPv6

6
Domains

6
Subdomains

7
IPs

3
Countries

1765 kB
Transfer

7120 kB
Size

2
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cve.org/CVERecord?id=CVE-2023-28769
Title: CVE-2023-28769

Search URL Search Domain Scan URL

URL: https://www.cve.org/CVERecord?id=CVE-2023-28770
Title: CVE-2023-28770

Search URL Search Domain Scan URL

URL: https://www.cve.org/CVERecord?id=CVE-2022-45440
Title: CVE-2022-45440

Search URL Search Domain Scan URL

URL: https://www.zyxel.com/service-provider/emea/en/zyxel-security-advisory-multiple-vulnerabilities
Title: https://www.zyxel.com/service-provider/emea/en/zyxel-security-advisory-multiple-vulnerabilitie

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=k5nj7Jhwn9c.
Title: presented research at DEF CON 27

Search URL Search Domain Scan URL

URL: https://otx.alienvault.com/pulse/66c5add7ed904b891e4b73b6
Title: OTX Pulse

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/
Title: MITRE ATT&CK Matrix

Search URL Search Domain Scan URL

URL: https://research.checkpoint.com/2018/ramnits-network-proxy-servers
Title: https://research.checkpoint.com/2018/ramnits-network-proxy-servers

Search URL Search Domain Scan URL

URL: https://blog.netlab.360.com/an-analysis-of-linux-ngioweb-botnet-en
Title: https://blog.netlab.360.com/an-analysis-of-linux-ngioweb-botnet-en

Search URL Search Domain Scan URL

URL: https://blog.netlab.360.com/linux-ngioweb-v2-going-after-iot-devices-en
Title: https://blog.netlab.360.com/linux-ngioweb-v2-going-after-iot-devices-en

Search URL Search Domain Scan URL

URL: https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian
Title: https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/en_us/research/24/e/router-roulette.html
Title: https://www.trendmicro.com/en_us/research/24/e/router-roulette.html

Search URL Search Domain Scan URL

URL: https://cybersecurity.att.com/blogs/labs-research/ngioweb-remains-active-7-years-later
Title: https://cybersecurity.att.com/blogs/labs-research/ngioweb-remains-active-7-years-later

Search URL Search Domain Scan URL

URL: https://discourse.org/powered-by
Title: Powered by Discourse

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

45 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 88061 Show response
malware.news/t/ngioweb-remains-active-7-years-later/ 150 KB
30 KB 382ms
337ms Document
text/html 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13e32d3adf940ba185a6535238bf84c303047d64a42fdda015611480389fadfe

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src 'nonce-9CeUKWPVwlHBMFx2EhYQc8IpV' 'strict-dynamic'; frame-ancestors 'self'; manifest-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store
cf-cache-status: DYNAMIC
cf-ray: 8e4f2a5f5c9437e3-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src 'nonce-9CeUKWPVwlHBMFx2EhYQc8IpV' 'strict-dynamic'; frame-ancestors 'self'; manifest-src 'self'
content-security-policy-report-only: upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src 'nonce-9CeUKWPVwlHBMFx2EhYQc8IpV' 'strict-dynamic'; frame-ancestors 'self'; manifest-src 'self'
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 19 Nov 2024 09:27:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dsslwr5qEVURr4FFKosZcgqt3%2FNrKfnYbHcwNpfjP7zImeHMAJeE4EEv67PGTA7DX1E6isViQckG7U2DT%2BadbGS9uI8gAR9Z7kkBhbNlIstVb42BBWi0fncPAJwBeF4ersYz%2F%2BAXh%2FMmlg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=TCP&rtt=20740&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3990&recv_bytes=2345&delivery_rate=192612&cwnd=253&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=343&x=0"
vary: Accept-Encoding Accept
x-content-type-options: nosniff
x-discourse-cached: true
x-discourse-route: topics/show
x-discourse-trackview: 1
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-request-id: 0dacf4a1-548b-44c0-8c78-a2c9bdbf7297
x-runtime: 0.002915
x-xss-protection: 0

GET
H2 200 start-discourse-9f921142b762fb91207051d0a28e571b9455bab74e7d0e03726024c286cff8d5.js Show response
malware.news/assets/ 567 B
884 B 34ms
30ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/start-discourse-9f921142b762fb91207051d0a28e571b9455bab74e7d0e03726024c286cff8d5.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f921142b762fb91207051d0a28e571b9455bab74e7d0e03726024c286cff8d5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 818026
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8RHzYurRmb%2FklsmJCV%2FCiZcroKL4dkVcPIMCgCM310foLuRDTBTW6dmbfIhAfxqsdj0vlndxqwCVjcjTHUJlTuuFd%2FiVYIbC%2BQICxln%2FS%2FuJEzmMosdC%2F%2Bloe3N%2FaoSVgYz%2FcwzmsuPwPw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a617e3537e3-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21897&sent=16&recv=24&lost=0&retrans=0&sent_bytes=10296&recv_bytes=3605&delivery_rate=364401&cwnd=257&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=384&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:22 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 browser-update-6f90b23ab8d8bbdca5b58f8c616b7779f50c1315575c80eacccbc30e8bb3c32e.js Show response
malware.news/assets/ 2 KB
1 KB 34ms
31ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/browser-update-6f90b23ab8d8bbdca5b58f8c616b7779f50c1315575c80eacccbc30e8bb3c32e.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f90b23ab8d8bbdca5b58f8c616b7779f50c1315575c80eacccbc30e8bb3c32e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 818026
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8o%2F8rL861LMkSp1n7%2Buwrx7Xje0JvgI49FnTsW174weAzV0zSR08Gs8dgcVEmj0C1CY1ReoxtZ2SXPDI%2F8ErujB752ZP2NvhoAX3NCkcTv6MDd9qTD8DJZNU5SHK1YM%2B1zcJE0SSWHwIBA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a617e3637e3-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21897&sent=19&recv=24&lost=0&retrans=0&sent_bytes=11246&recv_bytes=3605&delivery_rate=364401&cwnd=257&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=384&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:22 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 browser-detect-99f42f91bffa8ca1606d62b70bb92f981d83921e78ccdbd3d9538f07007f27ac.js Show response
malware.news/assets/ 497 B
876 B 66ms
63ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/browser-detect-99f42f91bffa8ca1606d62b70bb92f981d83921e78ccdbd3d9538f07007f27ac.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 99f42f91bffa8ca1606d62b70bb92f981d83921e78ccdbd3d9538f07007f27ac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 3084790
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tVrfKa%2BMMQ3dizuvtjEDM5N3zR%2FosOxBha76uhrWwxcfz0uKy6MxxBiUw0ye0mIT8%2B1IREo8ZS6sqM5cRZuJzk6weKPm0N6V7UZu1x8bse8wVdUL3XIDWeU85%2FOeo5Nh9zc1TvNTJ3uUXg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a619e6337e3-FRA
expires: Fri, 10 Oct 2025 17:19:16 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21511&sent=142&recv=34&lost=0&retrans=0&sent_bytes=137330&recv_bytes=6183&delivery_rate=3279121&cwnd=257&unsent_bytes=31872&cid=5a9540ccbe6f1822&ts=416&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:35:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 vendor.d3163860318024d1a45415fcf58dbe4b-f6a0e31af09bc94252ffd2005ded43e70ee5ea44cbc0d90b36967a66fdf76b72.js Show response
malware.news/assets/ 430 KB
121 KB 62ms
60ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/vendor.d3163860318024d1a45415fcf58dbe4b-f6a0e31af09bc94252ffd2005ded43e70ee5ea44cbc0d90b36967a66fdf76b72.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6a0e31af09bc94252ffd2005ded43e70ee5ea44cbc0d90b36967a66fdf76b72

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 818025
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ANOVUztbdWg8%2BuZg8Ie2qw2MpmIAY%2BQnwo%2BLc8x0EROwJYXMqx3LW2zLdYxW4d8eUMol4pk7TGWtDrBxD4oqRe8IoyxrLzjqzk6HQAKBiRoPxQcUkDvxivsGbXBrqHINcZUlMIOWX0hxxQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a619e6437e3-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21511&sent=142&recv=34&lost=0&retrans=0&sent_bytes=137330&recv_bytes=6183&delivery_rate=3279121&cwnd=257&unsent_bytes=31872&cid=5a9540ccbe6f1822&ts=419&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:19:57 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 chunk.dc7a33f0346e6027c1e5.d41d8cd9.js Show response
malware.news/assets/ 5 MB
1018 KB 62ms
60ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/chunk.dc7a33f0346e6027c1e5.d41d8cd9.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08e72912ddff29f7da96ec2d3b0e425a8e50efea87d8ec9db0d7abd64047e05f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 822328
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eh%2B6oH%2BB2LUye7O3DVkkVc4Zuebt5vnxZ5VccM8fIK%2BSfvyOglTKunoCsh%2FTVK1D5a%2BqG6i2vVdNwI7kfbx7B5yAi1nhOpQM6cPzDHu1qa924fsdGZy45gXijxRa3cjhZ5O2Amht9r3xeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a619e6537e3-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21511&sent=142&recv=34&lost=0&retrans=0&sent_bytes=137330&recv_bytes=6183&delivery_rate=3279121&cwnd=257&unsent_bytes=31872&cid=5a9540ccbe6f1822&ts=419&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:19:49 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 chunk.92341f685bf1b158be8e.d41d8cd9.js Show response
malware.news/assets/ 66 KB
12 KB 52ms
50ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/chunk.92341f685bf1b158be8e.d41d8cd9.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85e2838b0d4d24942d3503bf17700732c5c6dd749dd5a87dcc921f716bfa8e8d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 818026
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6mP6UcRavtoEqzZHiq2cz2CSXXf4T5JzlSrRshNuo48kLFrrJLmdxhfBubaA5Zgbg0GYkB0sCTTVhXHOlgJ8fMApn6pmxX%2BM7oiSvgiW%2BvFhoqhVjUMrGWElexj4rWBXk3nSWwDREihJxQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a619e6637e3-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21214&sent=104&recv=33&lost=0&retrans=0&sent_bytes=89434&recv_bytes=6183&delivery_rate=1765048&cwnd=257&unsent_bytes=16862&cid=5a9540ccbe6f1822&ts=409&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:19:49 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 checklist-48229befcefff057fe27509100acef005461f4af616cf844ffd4392e10db6236.js Show response
malware.news/assets/plugins/ 4 KB
2 KB 48ms
46ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/checklist-48229befcefff057fe27509100acef005461f4af616cf844ffd4392e10db6236.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48229befcefff057fe27509100acef005461f4af616cf844ffd4392e10db6236

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 818026
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jz683CMTpSfM%2F2zD9v32Ob2jTQddykgz1%2BOjxndQFlLTpvwp5HQiS6lUtgSVxwU1BtrSoHKIgopi54PtOWKCK443wcVFXE8ZMABjdXQIB58KJCM0kEbxw%2F4Nyo1CSBJaL7HErCXtJu0aqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a619e6737e3-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21174&sent=101&recv=32&lost=0&retrans=0&sent_bytes=85991&recv_bytes=6183&delivery_rate=1378650&cwnd=257&unsent_bytes=20305&cid=5a9540ccbe6f1822&ts=407&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 discourse-details-be420de1cdbbc41691234abe548124043e201bc6b576570af28c0d960ad35a0c.js Show response
malware.news/assets/plugins/ 1 KB
1 KB 48ms
46ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-details-be420de1cdbbc41691234abe548124043e201bc6b576570af28c0d960ad35a0c.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: be420de1cdbbc41691234abe548124043e201bc6b576570af28c0d960ad35a0c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 370924
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FuUHJ5g9ppMQCqODQ2HgeXAGtbApNszUFYRunkcr4w%2BKoN8Yt8gX3OUA3HWlQIfHZ3D8jrn6Z2va5LayqwFvxvqAp0MRKpGYkAv%2F10vdBGaUIJK%2FuA%2BGqPgZSpWVn8h6sOZU59GCVETa8A%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a619e6a37e3-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21174&sent=101&recv=32&lost=0&retrans=0&sent_bytes=85991&recv_bytes=6183&delivery_rate=1378650&cwnd=257&unsent_bytes=20305&cid=5a9540ccbe6f1822&ts=407&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 discourse-lazy-videos-da6a701d09603c2e1bf81930868aa84af4b9fb58607f1dc8b88dfeb8ed6127f2.js Show response
malware.news/assets/plugins/ 6 KB
2 KB 48ms
46ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-lazy-videos-da6a701d09603c2e1bf81930868aa84af4b9fb58607f1dc8b88dfeb8ed6127f2.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da6a701d09603c2e1bf81930868aa84af4b9fb58607f1dc8b88dfeb8ed6127f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 818026
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L%2F9IUlHTfyX7FjqgIMiMlgF5A7YieN3VQK3RSQrLm7W%2BRKIGKPr9UDXW45p3RmxiPxxHM7qloMUTuKzLSegXzSfW1OvlR3Esv4j5L7DlqNc4dChNLnmji9G%2Bjr7ZN1wk5K3M9TSDsPOPYg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a619e6b37e3-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21214&sent=104&recv=33&lost=0&retrans=0&sent_bytes=89434&recv_bytes=6183&delivery_rate=1765048&cwnd=257&unsent_bytes=16862&cid=5a9540ccbe6f1822&ts=407&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 discourse-local-dates-508f34e4c906329b9d84609309e5e1f86c721c36d67f58edf00920eaab24843d.js Show response
malware.news/assets/plugins/ 30 KB
9 KB 52ms
50ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-local-dates-508f34e4c906329b9d84609309e5e1f86c721c36d67f58edf00920eaab24843d.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 508f34e4c906329b9d84609309e5e1f86c721c36d67f58edf00920eaab24843d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 818026
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YowBRf7s6vbEolXPaCrxy%2Fn6QvNHPZ5qbnbhWJGHXhMOm0xvPSM6gAfCyizJ6KJeGEewdvEOONi%2F501QFlKtpx3wARgPBcgSlFiQRuLjWwLAtF4lYJWgFZQfL5DQPfCwGX70B64PH1Ffgw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a619e6d37e3-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21214&sent=104&recv=33&lost=0&retrans=0&sent_bytes=89434&recv_bytes=6183&delivery_rate=1765048&cwnd=257&unsent_bytes=16862&cid=5a9540ccbe6f1822&ts=410&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:47 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 discourse-presence-072656be372e90afa4bdc01d17154e4296da5a750d0a0122deb432524b55905a.js Show response
malware.news/assets/plugins/ 10 KB
2 KB 50ms
48ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-presence-072656be372e90afa4bdc01d17154e4296da5a750d0a0122deb432524b55905a.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 072656be372e90afa4bdc01d17154e4296da5a750d0a0122deb432524b55905a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 818026
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6muj3O1FfifCQ%2Bwj6sj2m14mPVwWflYeN%2Fl5Hy%2Bq73Cf3PFnRoOmA6x%2F%2FRBYBfXCDKND5GrLfrjqfPizlKFla6sjdhGstJOpon7mmf3OWhjRZH7sGRE7IVu0oEVXZyJsNfe%2BAjxd2o7aHA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a619e6f37e3-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21214&sent=104&recv=33&lost=0&retrans=0&sent_bytes=89434&recv_bytes=6183&delivery_rate=1765048&cwnd=257&unsent_bytes=16862&cid=5a9540ccbe6f1822&ts=409&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:47 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 docker_manager_admin-b6a39549af39cfd4edc125b6b3309e052f9360651652b65de6ae95adddddc8c3.js Show response
malware.news/assets/plugins/ 32 KB
7 KB 51ms
49ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/docker_manager_admin-b6a39549af39cfd4edc125b6b3309e052f9360651652b65de6ae95adddddc8c3.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6a39549af39cfd4edc125b6b3309e052f9360651652b65de6ae95adddddc8c3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 818025
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xEFMNw%2B%2BU%2BzWYuUwubOs8n9CAIx45aVFSWDasn%2FHSsdv3uZh6xotwyvvCTBZlkIejE6V%2BrLCgHOPkN6Iv4yTlSF97yHcaSeE%2BMNh7%2BVaT96i9Au%2Bh8c9FgGRr%2FYrI8OUxPugRnRQNXF1kA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a619e7037e3-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21214&sent=104&recv=33&lost=0&retrans=0&sent_bytes=89434&recv_bytes=6183&delivery_rate=1765048&cwnd=257&unsent_bytes=16862&cid=5a9540ccbe6f1822&ts=409&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:47 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 footnote-b30502d9bd28251a1683c8d09ed164bc6650c5c67c4375e6a42adf95b3ee8110.js Show response
malware.news/assets/plugins/ 3 KB
2 KB 48ms
46ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/footnote-b30502d9bd28251a1683c8d09ed164bc6650c5c67c4375e6a42adf95b3ee8110.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b30502d9bd28251a1683c8d09ed164bc6650c5c67c4375e6a42adf95b3ee8110

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 818026
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rc67Rsv0mefaUnUpbE%2FB5D4yGZst%2FguuVAA3LhY8116PHI3e%2BVSk4I0xyvWRN%2Fhfx%2B6uRLTi3CKxx7AcPuYo7CHpJ5g0H93ZC%2BoCyYSFaj2OU0KCz200suOSJ%2FnXQ2ogAhS533TNrSVadg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a619e7137e3-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21214&sent=104&recv=33&lost=0&retrans=0&sent_bytes=89434&recv_bytes=6183&delivery_rate=1765048&cwnd=257&unsent_bytes=16862&cid=5a9540ccbe6f1822&ts=408&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:47 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 footnote_extra-295b457b90cb18fedfdb544868c494c71842a27c0781d3042fa4fd26589204fa.js Show response
malware.news/assets/plugins/ 6 KB
3 KB 51ms
49ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/footnote_extra-295b457b90cb18fedfdb544868c494c71842a27c0781d3042fa4fd26589204fa.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d42ebdcddd972fdff22dca8398998a80ce50b0ec08915e8e8b9682a941b8651

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 370924
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PGpYM4c5EFQ3lWqXOWEKv0M28a4K%2F4tttY2Kq5VlgSl0yLUf0zp1uStZYCbe6II0n5zSfvOWDoR2fMpc%2F3qvvwRJYqUBKBv7nqQcQsdP9i8iR74H12RjjFXIPvfcdQ0ljWOHhC9MK3ZajA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a619e7237e3-FRA
expires: Mon, 12 May 2025 01:37:00 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21214&sent=104&recv=33&lost=0&retrans=0&sent_bytes=89434&recv_bytes=6183&delivery_rate=1765048&cwnd=257&unsent_bytes=16862&cid=5a9540ccbe6f1822&ts=409&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Mar 2024 04:05:57 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 poll-c5731add591c9f35fc4899817ccf6b7ef5015b50c20cd3bb07801625cfedbe7e.js Show response
malware.news/assets/plugins/ 89 KB
21 KB 65ms
63ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/poll-c5731add591c9f35fc4899817ccf6b7ef5015b50c20cd3bb07801625cfedbe7e.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5731add591c9f35fc4899817ccf6b7ef5015b50c20cd3bb07801625cfedbe7e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 818026
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NJsQodKs6L7F2fOtGizIZ%2FcOSUeASXdM1zPQzmGICpE6V2J5KeOI%2BpejxkIMoZnXEYyfq9AH9Dr2ssNPd49ynlNgiOYLMAoUovKwocAcKlL5ldVDcFWMqPLosJw2QfTQYNOwtR3a%2FR5%2FWA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a619e7337e3-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21511&sent=142&recv=34&lost=0&retrans=0&sent_bytes=137330&recv_bytes=6183&delivery_rate=3279121&cwnd=257&unsent_bytes=31872&cid=5a9540ccbe6f1822&ts=416&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:47 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 spoiler-alert-18509682c8a5b9385e58b9d3ed88d6b42a4ac83a0efec3b028fda569d81fcaa2.js Show response
malware.news/assets/plugins/ 3 KB
2 KB 49ms
47ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/spoiler-alert-18509682c8a5b9385e58b9d3ed88d6b42a4ac83a0efec3b028fda569d81fcaa2.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 18509682c8a5b9385e58b9d3ed88d6b42a4ac83a0efec3b028fda569d81fcaa2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 818026
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OB9VECXLVMrU5h%2FOT47i3cCmYHFsogEsbqbMAJtFRciZi9Nim0HbHy%2FI1PQhmfCW%2F3d1JS3naFlp1%2FafmiMrjUVZgh2%2B%2B7z1154LEZpfEAMMPZdpDVxJRUjcf0kX%2FiW4TbaooCC%2Bznkvbw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a619e7537e3-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21214&sent=104&recv=33&lost=0&retrans=0&sent_bytes=89434&recv_bytes=6183&delivery_rate=1765048&cwnd=257&unsent_bytes=16862&cid=5a9540ccbe6f1822&ts=408&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:20:47 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 en-4da8a5259a9777f1cd3433a17475c015331c74f52693962a1031c13ae8416c59.js Show response
malware.news/assets/locales/ 322 KB
95 KB 62ms
60ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/locales/en-4da8a5259a9777f1cd3433a17475c015331c74f52693962a1031c13ae8416c59.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0525596819094f44d7abb830e075097897b46e67ed3314ee3676b54fc222263c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 822319
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aVkMTJ3wUmiRdMDrVQ%2BQXTMX89n%2BT31bDBh8hwaZ7PcBvRuiYJweKtPf2K4yn6mIoJ7vkff%2F3DHcv91Vv4NLQo5yEoH9JBVc32gTkxN4ny8G7jR%2BY3onTpAEpYu4MXoTq%2BFTsA0rFaUVPw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a619e7637e3-FRA
expires: Sun, 09 Nov 2025 19:24:10 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21511&sent=142&recv=34&lost=0&retrans=0&sent_bytes=137330&recv_bytes=6183&delivery_rate=3279121&cwnd=257&unsent_bytes=31872&cid=5a9540ccbe6f1822&ts=421&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Nov 2024 19:21:33 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 mf Show response
malware.news/extra-locales/ 18 KB
3 KB 535ms
533ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/extra-locales/mf?v=50fc7aac4b913b2fb6284a3ad8efa92b

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e8184a4bb598f1bd378dad0b24dc19aaa26071c75e055ebf173f91e62658c6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

x-request-id: 7d0a33c3-db1d-4cdf-81e8-98374ae8b381
content-encoding: gzip
cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tJIh26xjjP5PbG5K%2FYjg4xZkWA3%2FzR7qCxJ%2B3fiJueraoeAs5lvttXyEpfOS8bMhFkz%2BTF%2FsP%2F82fycZ1ChcXQ9bWDrUuHlZ6enM%2FJXDppglkrfSKT8QtD%2FLeY9OC7FjSC%2Bsby0yqD8A9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21137&sent=1202&recv=589&lost=0&retrans=0&sent_bytes=1505729&recv_bytes=6183&delivery_rate=20672543&cwnd=1043&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=897&x=0"
date: Tue, 19 Nov 2024 09:27:39 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding, Accept
x-runtime: 0.193648
x-frame-options: SAMEORIGIN
cache-control: max-age=31556952, public, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e4f2a619e7737e3-FRA
x-discourse-route: extra_locales/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 269 KB
95 KB 97ms
40ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-SVDG4GL741

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

975a0c9e175607969d929f8023fb942d677231520396964279f7ba7b561dcbf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 19 Nov 2024 09:27:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 96535
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 google-universal-analytics-v4-e154af4adb3c483a3aba7f9a7229b8881cdc5cf369290923d965a2ad30163ae8.js Show response
malware.news/assets/ 533 B
654 B 64ms
64ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/google-universal-analytics-v4-e154af4adb3c483a3aba7f9a7229b8881cdc5cf369290923d965a2ad30163ae8.js
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e154af4adb3c483a3aba7f9a7229b8881cdc5cf369290923d965a2ad30163ae8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 2955969
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KkPmDrDdeThe9ccrB3R0otmII07TzBLd1MrNfXXxmUwF1%2B4QzHVikMNzz8beYviKG%2BWvWnJ%2BCFdw3g74jvyPhNS2Sj6ZRK3GShSIYP97o393vZFxXArjHqogkVI5CUTUZ5Y9GZk09bCa6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e4f2a619e7837e3-FRA
expires: Tue, 29 Apr 2025 14:41:33 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=21511&sent=142&recv=34&lost=0&retrans=0&sent_bytes=137330&recv_bytes=6183&delivery_rate=3279121&cwnd=257&unsent_bytes=31872&cid=5a9540ccbe6f1822&ts=416&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-type: application/javascript
last-modified: Sat, 09 Mar 2024 04:04:58 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 color_definitions_base__2_5875a49f7a1a2f6dfdacc9c6ee7ac82548345c00.css
malware.news/stylesheets/ 4 KB
2 KB 37ms
34ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/color_definitions_base__2_5875a49f7a1a2f6dfdacc9c6ee7ac82548345c00.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5db83bcef43ac8fdafad6b53d7b080a2f4a00ccb306e5fa85793138e82d65244

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

x-request-id: 288873b3-4d6f-46dd-977f-62dfacc5886d
content-encoding: gzip
cf-cache-status: HIT
age: 818026
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pgCEmwvjaD%2BjgCavLGjwdWVJ1QVQWMo%2BxO9Biq8QJtbY8Mf2Y8D%2FQxLOuQIG8e5bf20MTI4IP3iJE7w7r4XGtegmPA%2F5nDy4pNOjawnyusCP4VQCVSX17Tp2fMsKYncL7GOI5T9TD4AkqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21897&sent=22&recv=24&lost=0&retrans=0&sent_bytes=12534&recv_bytes=3605&delivery_rate=364401&cwnd=257&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=384&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-disposition: inline; filename="color_definitions_base__2_5875a49f7a1a2f6dfdacc9c6ee7ac82548345c00.css"; filename*=UTF-8''color_definitions_base__2_5875a49f7a1a2f6dfdacc9c6ee7ac82548345c00.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:48 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e4f2a617e3737e3-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 desktop_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 721 KB
111 KB 46ms
43ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/desktop_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6ac36c965849ccf6567568611d6c7eb178a1b2b0325c90f570ca07e9fc9329b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

x-request-id: b1e0eff9-375e-43b8-b843-428a22d6f4fe
content-encoding: gzip
cf-cache-status: HIT
age: 818026
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kvgOFDVy0kSQBzmj8SJkZ%2FGFL8sVHwBbin%2BjywjtNR2x9phEqfX0qLbbhKUKwThwQuTIKDSSGWi2FqUht7w3QRgVck%2FOBkoXgVH21HBMTnw%2FblsJGk1scEqoiB011gQ%2Fj84YvY73LTr%2F0g%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21897&sent=47&recv=24&lost=0&retrans=0&sent_bytes=25306&recv_bytes=3605&delivery_rate=364401&cwnd=257&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=390&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-disposition: inline; filename="desktop_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''desktop_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:42 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e4f2a617e3837e3-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 checklist_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 5 KB
2 KB 35ms
33ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/checklist_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3210e81db34d0cf4dbf5ad179f4c0cbbe1a53f4d2b2f8d265087efa34e386210

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

x-request-id: 3099f5d1-17d7-4ac8-b0a1-2c8174bf917f
content-encoding: gzip
cf-cache-status: HIT
age: 818026
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F%2BwtVpYYFzmgpRh9UvnA65%2FMnHHzGiplxG5DtEYsa9ASHP7uGCjhHB5zTpVW3OhhID8gLpyHtD7P%2Fe3QC6U6ihdtuQ44LwLB7Jjlf33CVSRMRcFOo0TLOYDj%2F77yzEBVxAAQ%2FcNusHxdTg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21897&sent=26&recv=24&lost=0&retrans=0&sent_bytes=14585&recv_bytes=3605&delivery_rate=364401&cwnd=257&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=384&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-disposition: inline; filename="checklist_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''checklist_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e4f2a617e3937e3-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-details_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 3 KB
1 KB 38ms
36ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-details_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

05cd38562b6bd50256ac866bfb550135934771b1afb1eb0127dcd8ed2fbdacf6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

x-request-id: 43f77564-11eb-4009-9546-4bfc645980da
content-encoding: gzip
cf-cache-status: HIT
age: 762510
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GIrtJfBM150lwTo0nhlbBHep7wQ6Iubwz3SbFj8oaMOM4T3HOydVrY38LHAgqY1T4l3RnZwX%2B1TfECuXLxaNSrIWoJCTpd7YWTC7n%2FcEb0NBhtNpDq6r2XvsugOVaJAHzPbHVs4rjni0Vg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21897&sent=38&recv=24&lost=0&retrans=0&sent_bytes=21200&recv_bytes=3605&delivery_rate=364401&cwnd=257&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=385&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-disposition: inline; filename="discourse-details_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''discourse-details_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e4f2a617e3a37e3-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-lazy-videos_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 7 KB
4 KB 35ms
33ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-lazy-videos_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

254c1df8945252e32e84cb5e6a27f1a4be608015da6523a2f546c8a3b411d6a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

x-request-id: 16ee2fa5-eb07-4cec-ba9a-87c807a4cd33
content-encoding: gzip
cf-cache-status: HIT
age: 818026
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u1cK0Yq4f%2F%2B3vBMELRukDHQEclIoI0Wk%2FvuywTMFP1AgtmduRlbrzK6SYwdfN%2B3NS5MJRYZj%2F4GSeH5A%2FrKULcW1dTGfDVBgbI5dUjDcYFFMOR%2B7R5no%2F%2BgSjD2bQRNiNvsqPvdTpcQHEA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21897&sent=29&recv=24&lost=0&retrans=0&sent_bytes=16583&recv_bytes=3605&delivery_rate=364401&cwnd=257&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=385&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-disposition: inline; filename="discourse-lazy-videos_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''discourse-lazy-videos_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e4f2a617e3b37e3-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-local-dates_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 856 B
1002 B 37ms
35ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-local-dates_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eea9a523d4db379cf8df984a1e29425971a0a887e69ebd5fffcf87b207dea982

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

x-request-id: 7e8d191d-618d-49df-a5c1-f6888a3809a7
content-encoding: gzip
cf-cache-status: HIT
age: 822332
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IM60LBd0fRoSE1KvR%2BbTCNToja3E04JFfAiENqcxl3JNmZzZY5TKqicg6L5eZxhRGgSYG7gntNCUD1GyxllnYl8ZamhkxHsaWsxiQm7hlyfuIa0I1VJo4SlULsAxtOljCCmMmlnXFZu5Pw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21897&sent=44&recv=24&lost=0&retrans=0&sent_bytes=24238&recv_bytes=3605&delivery_rate=364401&cwnd=257&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=386&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-disposition: inline; filename="discourse-local-dates_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''discourse-local-dates_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e4f2a617e3c37e3-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-narrative-bot_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 171 B
756 B 37ms
35ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-narrative-bot_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f894e10b15e5045352c8ded91c7e3194eca94cefb94260d8a222cb6943831965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

x-request-id: 8424eea4-83f4-434f-989b-40a2a0eb6713
content-encoding: gzip
cf-cache-status: HIT
age: 818025
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0riTr1apafzsw72vGDNiXtvIC15WKuesyodlb0lINrRa%2Bw%2B%2BBOBfIRa5Pcrp0DIOFxvwa3uDiMhOSovfDu1cciGOfhiYwzf3d4ZI69ZsZy2%2Bj%2FMqnaVZw8iK%2BnsqA2gxkXWVHBdq9tVILA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21897&sent=35&recv=24&lost=0&retrans=0&sent_bytes=20378&recv_bytes=3605&delivery_rate=364401&cwnd=257&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=385&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-disposition: inline; filename="discourse-narrative-bot_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''discourse-narrative-bot_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e4f2a617e3e37e3-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-presence_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 1 KB
1 KB 38ms
37ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-presence_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f3dfbf92751007bf7123860118ef29e50e4ed0b0c7bd6059f44c912e161640f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

x-request-id: 65590104-4930-4499-82cd-b21aa440e53c
content-encoding: gzip
cf-cache-status: HIT
age: 818026
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=friMb1y7zriVfFo%2Bx0d8OmWQfX5UYfEKiu0O8xnmROE4khUwep%2Bu1642NXCjhhARxuw7cTDIyuqJHHv8zi%2BdMb3gaPXTJtTkNVOBCc%2BJHhHBsxytyt8EAQjZEHFYYkzQeY4Qmrdprg78Jg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21897&sent=41&recv=24&lost=0&retrans=0&sent_bytes=22757&recv_bytes=3605&delivery_rate=364401&cwnd=257&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=385&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-disposition: inline; filename="discourse-presence_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''discourse-presence_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e4f2a617e3f37e3-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 docker_manager_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 3 KB
2 KB 63ms
62ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/docker_manager_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb73247ea0b8cd13f9cc740f6c5d319ed7b77df2d73fb96f142a540e83fde0f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

x-request-id: c159bd82-47dd-43d9-b3b6-60c500ed68ad
content-encoding: gzip
cf-cache-status: HIT
age: 818025
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9kpU38bHSfwAeswHTsyqvCF2quGkyISaldXiPq0GFOxoo4gzeBqEnKnlrlKef%2BkYAmtI%2Fc05%2FnnaQjg%2BenqznfOgUsMaESW25T1cMubz%2BzbKPKJb6MGFzd3B%2BvhD2qvWLG%2B0QybmnKWPUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21174&sent=101&recv=32&lost=0&retrans=0&sent_bytes=85991&recv_bytes=6183&delivery_rate=1378650&cwnd=257&unsent_bytes=20305&cid=5a9540ccbe6f1822&ts=406&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-disposition: inline; filename="docker_manager_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''docker_manager_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e4f2a619e5a37e3-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 footnote_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 2 KB
1 KB 67ms
65ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/footnote_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d4e1d8a7be66468bdd7dca8c2dfcda327e8d5af5a390482bc2942b8f45666142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

x-request-id: ca152658-164e-4335-8a8a-c15132b755ef
content-encoding: gzip
cf-cache-status: HIT
age: 822332
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XjzE%2BQSo1gZKkPxq3WDZgpjt1wcZNuHYQ5CiSytXBRJ2U%2BGANz7W27C0P43d2WN1Lkt85WRIhle2uS6xO1ST4gBboBQtH0nSKpj32mCq14jwjohCbDGlJHlVR1djZzip1lure4iDlDOFxw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21214&sent=104&recv=33&lost=0&retrans=0&sent_bytes=89434&recv_bytes=6183&delivery_rate=1765048&cwnd=257&unsent_bytes=16862&cid=5a9540ccbe6f1822&ts=409&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-disposition: inline; filename="footnote_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''footnote_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e4f2a619e5c37e3-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 poll_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 13 KB
4 KB 62ms
60ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/poll_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b31913414ff7bbbf49f273a06ec4cd11e42d55cf0145a998e508b6cf59d93750

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

x-request-id: 2dd0623d-96c9-48cb-ac12-2f2f4eef79df
content-encoding: gzip
cf-cache-status: HIT
age: 822306
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jCWtZQ7z2S%2FNdu2sjeA71m14heuK2DuTsvzCaVyylqkS0YTxmkKerjoYqpxNMtQux9slohwUq8%2Fngm3jgD38qaiopFrR%2FWXKERwlukD%2FDmwlyttXzg1ZWPWRVrcFSnCqaIRma1r1Pk29uA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21597&sent=93&recv=28&lost=0&retrans=0&sent_bytes=76662&recv_bytes=6183&delivery_rate=381737&cwnd=257&unsent_bytes=29634&cid=5a9540ccbe6f1822&ts=405&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-disposition: inline; filename="poll_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''poll_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:46 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e4f2a619e5d37e3-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 spoiler-alert_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 1 KB
1 KB 68ms
67ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/spoiler-alert_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

da53e3c659e805a26124ef2113f088ef6dd66d36814c62a3ad3b6ad177ef8b75

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

x-request-id: 7154f3c5-fa67-4fc7-8dbd-f6338e26f07f
content-encoding: gzip
cf-cache-status: HIT
age: 822330
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=628uQ3OLqjpLzEGCVXMUgXFaQKEOonC3t1rZKy0evJEvmdQpxD3dBWqqEVmsDzOWa3lnxmaWUJpMbhX3sQlpzBlrhDX6ILnt8cnZShVe30p8sw90lThLFOlcsF%2BWvWJVvECcFXtzds8nYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21214&sent=104&recv=33&lost=0&retrans=0&sent_bytes=89434&recv_bytes=6183&delivery_rate=1765048&cwnd=257&unsent_bytes=16862&cid=5a9540ccbe6f1822&ts=410&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-disposition: inline; filename="spoiler-alert_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''spoiler-alert_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:47 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e4f2a619e6037e3-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 poll_desktop_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
malware.news/stylesheets/ 486 B
772 B 63ms
62ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/poll_desktop_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

61cebcc6c197dc2ab70050e4e318e731564461ffea6f676c101592e3b77e22a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

x-request-id: 9ae70abe-ad13-45a7-843a-c2eee246ed51
content-encoding: gzip
cf-cache-status: HIT
age: 818026
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=elfe4J0RbYHpvD3UxawVq9dvoSET54LsY6KI1ZSoRX400b5RRyXbQ%2FN9QMA%2BVySHnsMvlw2ysbLpX%2Bp0d1j%2FXGGGymG%2FmdshruKqAY8Xfy2qCgMlg2TjZ19pczyzlI4C2kvd6sXVM8bo6A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21255&sent=93&recv=31&lost=0&retrans=0&sent_bytes=76662&recv_bytes=6183&delivery_rate=1156794&cwnd=257&unsent_bytes=29634&cid=5a9540ccbe6f1822&ts=406&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-disposition: inline; filename="poll_desktop_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css"; filename*=UTF-8''poll_desktop_8a1a104c35f37afe0b9e3cede77fd0f2f921db29.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:47 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e4f2a619e6137e3-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 desktop_theme_2_be2225fcdc7dc6bdbe3821fc0d054dd51ef27988.css
malware.news/stylesheets/ 108 B
978 B 62ms
61ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/desktop_theme_2_be2225fcdc7dc6bdbe3821fc0d054dd51ef27988.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d6159259c7edbfddc1b4de1d432c34dea8cfb429af0f583ad2c3048ece27dcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

x-request-id: d551d24f-82db-42fb-996b-1ea9dfb2552f
content-encoding: gzip
cf-cache-status: HIT
age: 822318
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iaBgvQnCl0e5YZnJMll27jE9RmLdkksSSpHab9s17BlZ%2B6oc738LDkQymjNVsma%2F7vkfr9pXzr3eBWRStd9pcENIella5wgyGBsPPkruKmrJgtWS3UnV8kV9c%2B0PpUC11yuyTcSkOH9nOg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21255&sent=93&recv=31&lost=0&retrans=0&sent_bytes=76662&recv_bytes=6183&delivery_rate=1156794&cwnd=257&unsent_bytes=29634&cid=5a9540ccbe6f1822&ts=406&x=0"
date: Tue, 19 Nov 2024 09:27:38 GMT
content-disposition: inline; filename="desktop_theme_2_be2225fcdc7dc6bdbe3821fc0d054dd51ef27988.css"; filename*=UTF-8''desktop_theme_2_be2225fcdc7dc6bdbe3821fc0d054dd51ef27988.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sat, 09 Nov 2024 19:21:48 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e4f2a619e6237e3-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
DATA 200
OK truncated
/ 42 B
42 B Image
image/svg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c138c32d8539bcf7541029bddec47bc83534b02a92893b90ecee469a1fccfbcc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 svg-2-ebd30ca654fdbd40604e7a7f5127b1bce16eb12b.js Show response
malware.news/svg-sprite/malware.news/ 138 KB
44 KB 31ms
31ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/svg-sprite/malware.news/svg-2-ebd30ca654fdbd40604e7a7f5127b1bce16eb12b.js

Requested by

Host: malware.news
URL: https://malware.news/assets/chunk.dc7a33f0346e6027c1e5.d41d8cd9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e16bb6b35c3614177667b6323a7258bebe6a29b7526ca990c257fa906b7e4911

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

x-request-id: 76fd9abf-f37e-4c3d-a724-b2eadc11ed3b
content-encoding: gzip
cf-cache-status: HIT
age: 370924
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aVQnKToD6DCGXrAwoySiO%2F4fFx5xVplQOKjWExHKaQFcN25v1Ag8kKgis04LFh%2FpXu1BTr0s9LkpiFKrat7J7vB5Qv3fuuXBfOuDzQgtitC9yPWhBBb2ULSVH%2FdrLVHIIl5Gp%2BLQRyH19Q%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=21314&sent=1207&recv=593&lost=0&retrans=0&sent_bytes=1508796&recv_bytes=6487&delivery_rate=20672543&cwnd=1043&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=1107&x=0"
date: Tue, 19 Nov 2024 09:27:39 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding, Accept
last-modified: Sun, 09 Nov 2014 19:24:11 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e4f2a6609d837e3-FRA
x-discourse-route: svg_sprite/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 ba8ee0a927a69022c651441ac23d01bcdbc09785.png
malware.news/uploads/default/original/3X/b/a/ 9 KB
9 KB 30ms
30ms Image
image/png 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://malware.news/uploads/default/original/3X/b/a/ba8ee0a927a69022c651441ac23d01bcdbc09785.png
Requested by: Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 041dc75fa9294876d29e6d78e76c9f7f3202f1763480da93d6ce2414d0a095c3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cf-cache-status: HIT
age: 2955969
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xo00vbyU5k%2FSzioxp12M9oLCB2iOwH6fWpv6ur0n8%2BwwIlE6BAKKlGz1jCBiAhfLa2Q7QpAQCD1i2H2rf2%2B4KvIjss%2BRVY%2BDfwQva55DZgH5kDaRgFUjhgA2ax2i%2FOkzDBjgVIL8WehkmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Wed, 03 Sep 2025 05:48:43 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=26630&sent=1247&recv=603&lost=0&retrans=0&sent_bytes=1555371&recv_bytes=6650&delivery_rate=20672543&cwnd=1043&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=1237&x=0"
date: Tue, 19 Nov 2024 09:27:39 GMT
content-type: image/png
last-modified: Sat, 22 Dec 2018 04:38:37 GMT
vary: Accept-Encoding
cache-control: max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e4f2a66da7337e3-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8758
server: cloudflare

GET
H2 200 24_2.png
malware.news/user_avatar/malware.news/malbot/48/ 3 KB
3 KB 32ms
31ms Image
image/jpeg 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://malware.news/user_avatar/malware.news/malbot/48/24_2.png

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

acb53c4533765bc5dc1225c4850964ddb2ed637a7a1cf420c446a08104085da8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cf-bgj: h2pri
cf-cache-status: HIT
age: 3075531
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8x6l36zkaP%2FQDp59s69V7wYP6UPWZsV6WT9A%2B4lLVDAIppm5jlo9tFMzFJv3B536tcSivYMQG6kPFyZZ4fPUvCY7giBocX%2F37TWOlthyKF%2FYtrpCrEyztqpuiLo%2Fh57HntN%2FxmmxOmLDfA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server-timing: cfL4;desc="?proto=TCP&rtt=22461&sent=1256&recv=613&lost=0&retrans=0&sent_bytes=1564725&recv_bytes=6732&delivery_rate=20672543&cwnd=1043&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=1274&x=0"
date: Tue, 19 Nov 2024 09:27:39 GMT
content-type: image/jpeg
last-modified: Sat, 09 Mar 2024 04:15:49 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8e4f2a670a9637e3-FRA
accept-ranges: bytes
content-length: 2626
x-discourse-route: user_avatars/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 Ngioweb-image1.png
cyber.levelblue.com/m/7a11edf052714329/original/ 111 KB
110 KB 95ms
43ms Image
image/png 2600:9000:223c:aa00:2:e48e:e6c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyber.levelblue.com/m/7a11edf052714329/original/Ngioweb-image1.png

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223c:aa00:2:e48e:e6c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d2ad7f25bf039bd84d266d188c38cf375632da78e0ca6a6368737cd130dd4e21

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

content-encoding: gzip
age: 172141
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: _uR4NDs5-RtN_yBtXJo5bfUYHt45YJhojLRAUiNnWzhVYscSb3AbVg==
date: Sun, 17 Nov 2024 09:38:38 GMT
content-type: image/png
content-disposition: inline;filename="Ngioweb-image1.png"
strict-transport-security: max-age=63072000; includeSubdomains
x-api-correlation-id: 321b2f19-9e44-5bc3-afe4-c63309d5bb9d
cache-control: public, max-age=172800
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 3f52d342c56014599dee37446f6c9f2e.cloudfront.net (CloudFront)
permissions-policy: camera=(), geolocation=(), microphone=()
accept-ranges: bytes
access-control-allow-origin: *
x-amz-cf-pop: FRA56-P2
server: nginx

GET
H2 200 Ngioweb-image2.png
cyber.levelblue.com/m/6cf5fe3f98429193/original/ 34 KB
35 KB 75ms
24ms Image
image/png 2600:9000:223c:aa00:2:e48e:e6c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cyber.levelblue.com/m/6cf5fe3f98429193/original/Ngioweb-image2.png

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223c:aa00:2:e48e:e6c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d3ebc62bf3d4ec13de671968d1a5bf43eaa094ef3d76ad7baa27246f28741d3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

content-encoding: gzip
age: 126635
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: 8k96bXYWZryCHP_nhDBGyKHBK8sGS3RmayZevu_WVIsan5qKQbmbrQ==
date: Sun, 17 Nov 2024 22:17:04 GMT
content-type: image/png
content-disposition: inline;filename="Ngioweb-image2.png"
strict-transport-security: max-age=63072000; includeSubdomains
x-api-correlation-id: 0747bcfe-a2ff-dd5a-d21d-b7640afb0c30
cache-control: public, max-age=172800
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 3f52d342c56014599dee37446f6c9f2e.cloudfront.net (CloudFront)
permissions-policy: camera=(), geolocation=(), microphone=()
accept-ranges: bytes
access-control-allow-origin: *
x-amz-cf-pop: FRA56-P2
server: nginx

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 75ms
27ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-SVDG4GL741&gtm=45je4be0v9121104881za200&_p=1732008459023&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&cid=2140427045.1732008459&ecid=9725733&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&dl=%2Ft%2Fngioweb-remains-active-7-years-later%2F88061&dt=Ngioweb%20Remains%20Active%207%20Years%20Later%20-%20Malware%20News%20-%20Malware%20Analysis%2C%20News%20and%20Indicators&sid=1732008459&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.autoLinkConfig=%5Bobject%20Object%5D&tfd=1290
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SVDG4GL741
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://malware.news
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 09:27:39 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
552 B 84ms
29ms Ping
text/plain 2a00:1450:400c:c00::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-SVDG4GL741&cid=2140427045.1732008459&gtm=45je4be0v9121104881za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102077855
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SVDG4GL741
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://malware.news
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 19 Nov 2024 09:27:39 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 77ms
45ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-SVDG4GL741&cid=2140427045.1732008459&gtm=45je4be0v9121104881za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102077855&tag_exp=101925629~102067555~102067808~102077855&z=390857936

Requested by

Host: malware.news
URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 19 Nov 2024 09:27:39 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 a0086c91da850eb004fb4af82117ab347b9e272a_2_32x32.png
malware.news/uploads/default/optimized/3X/a/0/ 2 KB
2 KB 33ms
32ms Other
image/png 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/uploads/default/optimized/3X/a/0/a0086c91da850eb004fb4af82117ab347b9e272a_2_32x32.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7afa12ce5701916349284e884f7fddcf56832f30d041982b6f9a484b64084f5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061

Response headers

cf-cache-status: HIT
age: 3079372
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1dL5pZaCVyRP7YXSzUpMNVJy0qbUnDP%2FQFRW6pNnoMGkNep%2BfxuqSAtWN%2F3sBpV33tATVZH%2BjdaAsHAoMYfwpNAfAkR5jKp4P2msrZGbr06EIRSjGbsEXWfhqIFNEwc7b8xNMYKe%2FcR2rQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: Sun, 09 Mar 2025 04:07:40 GMT
server-timing: cfL4;desc="?proto=TCP&rtt=22286&sent=1261&recv=615&lost=0&retrans=0&sent_bytes=1568118&recv_bytes=6920&delivery_rate=20672543&cwnd=1043&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=1377&x=0"
date: Tue, 19 Nov 2024 09:27:39 GMT
content-type: image/png
last-modified: Sat, 01 Jun 2019 22:43:41 GMT
vary: Accept-Encoding
cache-control: max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8e4f2a67bb3937e3-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1851
server: cloudflare

POST
H2 200 poll
malware.news/message-bus/dace113abe70447b9d4a33cd756b6aca/ 240 B
0 142ms
141ms XHR
text/plain 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/message-bus/dace113abe70447b9d4a33cd756b6aca/poll

Requested by

Host: malware.news
URL: https://malware.news/assets/chunk.dc7a33f0346e6027c1e5.d41d8cd9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Discourse-Deferred-Track-View: true
X-CSRF-Token: undefined
Discourse-Deferred-Track-View-Topic-Id: 88061
Referer: https://malware.news/t/ngioweb-remains-active-7-years-later/88061
X-SILENCE-LOGGER: true
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: text/plain, */*; q=0.01
Discourse-Present: true
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-max-age: 7200
content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=emJwIDzfq9ZgdE9S8Y8TZm8R3WTlfANrzmQyaeu40kreynUC%2BUbGwQoboCmJMwAayuBF%2B8K1Rbff2myJoYM8CNh%2F5PplckuTKe%2Bysy9lUHeYfLiR21ehAZuBPCN4rIqJeE867N3%2BnTrvdg%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET, POST
x-content-type-options: nosniff
expires: 0
server-timing: cfL4;desc="?proto=TCP&rtt=21844&sent=1266&recv=619&lost=0&retrans=0&sent_bytes=1570577&recv_bytes=7485&delivery_rate=20672543&cwnd=1043&unsent_bytes=0&cid=5a9540ccbe6f1822&ts=1706&x=0"
date: Tue, 19 Nov 2024 09:27:39 GMT
content-type: text/plain; charset=utf-8
access-control-allow-headers: X-SILENCE-LOGGER, X-Shared-Session-Key, Dont-Chunk, Discourse-Present, Discourse-Deferred-Track-View
cache-control: must-revalidate, private, max-age=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 8e4f2a691c7e37e3-FRA
access-control-allow-origin: https://malware.news
server: cloudflare

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.malware.news/	1970-01-21 10:42:48	Name: _ga_SVDG4GL741 Value: GS1.1.1732008459.1.0.1732008459.60.0.9725733
			.malware.news/	1970-01-21 10:42:48	Name: _ga Value: GA1.1.2140427045.1732008459

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061 Message: The Content Security Policy directive 'upgrade-insecure-requests' is ignored when delivered in a report-only policy.
recommendation	verbose	URL: https://malware.news/t/ngioweb-remains-active-7-years-later/88061 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src 'nonce-9CeUKWPVwlHBMFx2EhYQc8IpV' 'strict-dynamic'; frame-ancestors 'self'; manifest-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cyber.levelblue.com
malware.news
region1.analytics.google.com
stats.g.doubleclick.net
www.google.de
www.googletagmanager.com
2001:4860:4802:32::36
2600:9000:223c:aa00:2:e48e:e6c0:93a1
2606:4700:20::ac43:4a41
2a00:1450:4001:808::2003
2a00:1450:4001:81c::2008
2a00:1450:400c:c00::9d
041dc75fa9294876d29e6d78e76c9f7f3202f1763480da93d6ce2414d0a095c3
0525596819094f44d7abb830e075097897b46e67ed3314ee3676b54fc222263c
05cd38562b6bd50256ac866bfb550135934771b1afb1eb0127dcd8ed2fbdacf6
072656be372e90afa4bdc01d17154e4296da5a750d0a0122deb432524b55905a
08e72912ddff29f7da96ec2d3b0e425a8e50efea87d8ec9db0d7abd64047e05f
0d6159259c7edbfddc1b4de1d432c34dea8cfb429af0f583ad2c3048ece27dcf
13e32d3adf940ba185a6535238bf84c303047d64a42fdda015611480389fadfe
18509682c8a5b9385e58b9d3ed88d6b42a4ac83a0efec3b028fda569d81fcaa2
254c1df8945252e32e84cb5e6a27f1a4be608015da6523a2f546c8a3b411d6a8
2e8184a4bb598f1bd378dad0b24dc19aaa26071c75e055ebf173f91e62658c6a
3210e81db34d0cf4dbf5ad179f4c0cbbe1a53f4d2b2f8d265087efa34e386210
48229befcefff057fe27509100acef005461f4af616cf844ffd4392e10db6236
508f34e4c906329b9d84609309e5e1f86c721c36d67f58edf00920eaab24843d
5d42ebdcddd972fdff22dca8398998a80ce50b0ec08915e8e8b9682a941b8651
5db83bcef43ac8fdafad6b53d7b080a2f4a00ccb306e5fa85793138e82d65244
61cebcc6c197dc2ab70050e4e318e731564461ffea6f676c101592e3b77e22a3
6ac36c965849ccf6567568611d6c7eb178a1b2b0325c90f570ca07e9fc9329b3
6f90b23ab8d8bbdca5b58f8c616b7779f50c1315575c80eacccbc30e8bb3c32e
85e2838b0d4d24942d3503bf17700732c5c6dd749dd5a87dcc921f716bfa8e8d
975a0c9e175607969d929f8023fb942d677231520396964279f7ba7b561dcbf0
99f42f91bffa8ca1606d62b70bb92f981d83921e78ccdbd3d9538f07007f27ac
9f921142b762fb91207051d0a28e571b9455bab74e7d0e03726024c286cff8d5
acb53c4533765bc5dc1225c4850964ddb2ed637a7a1cf420c446a08104085da8
b30502d9bd28251a1683c8d09ed164bc6650c5c67c4375e6a42adf95b3ee8110
b31913414ff7bbbf49f273a06ec4cd11e42d55cf0145a998e508b6cf59d93750
b6a39549af39cfd4edc125b6b3309e052f9360651652b65de6ae95adddddc8c3
be420de1cdbbc41691234abe548124043e201bc6b576570af28c0d960ad35a0c
c138c32d8539bcf7541029bddec47bc83534b02a92893b90ecee469a1fccfbcc
c5731add591c9f35fc4899817ccf6b7ef5015b50c20cd3bb07801625cfedbe7e
c7afa12ce5701916349284e884f7fddcf56832f30d041982b6f9a484b64084f5
d2ad7f25bf039bd84d266d188c38cf375632da78e0ca6a6368737cd130dd4e21
d3ebc62bf3d4ec13de671968d1a5bf43eaa094ef3d76ad7baa27246f28741d3a
d4e1d8a7be66468bdd7dca8c2dfcda327e8d5af5a390482bc2942b8f45666142
da53e3c659e805a26124ef2113f088ef6dd66d36814c62a3ad3b6ad177ef8b75
da6a701d09603c2e1bf81930868aa84af4b9fb58607f1dc8b88dfeb8ed6127f2
e154af4adb3c483a3aba7f9a7229b8881cdc5cf369290923d965a2ad30163ae8
e16bb6b35c3614177667b6323a7258bebe6a29b7526ca990c257fa906b7e4911
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eea9a523d4db379cf8df984a1e29425971a0a887e69ebd5fffcf87b207dea982
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3dfbf92751007bf7123860118ef29e50e4ed0b0c7bd6059f44c912e161640f2
f6a0e31af09bc94252ffd2005ded43e70ee5ea44cbc0d90b36967a66fdf76b72
f894e10b15e5045352c8ded91c7e3194eca94cefb94260d8a222cb6943831965
fb73247ea0b8cd13f9cc740f6c5d319ed7b77df2d73fb96f142a540e83fde0f9

malware.news Open in urlscan Pro 2606:4700:20::ac43:4a41 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

45 Requests

100 %HTTPS

100 %IPv6

6 Domains

6 Subdomains

7 IPs

3 Countries

1765 kBTransfer

7120 kBSize

2 Cookies

14 Outgoing links

Redirected requests

45 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

malware.news Open in urlscan Pro
2606:4700:20::ac43:4a41 Public Scan

Screenshot
Live screenshot

Full Image

45
Requests

100 %
HTTPS

100 %
IPv6

6
Domains

6
Subdomains

7
IPs

3
Countries

1765 kB
Transfer

7120 kB
Size

2
Cookies

45 HTTP transactions
2 data transactions