urlscan.io logo urlscan.io
SecurityTrails logo

www.fortinet.com Open in urlscan Pro
52.8.142.247  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Submission: On May 06 via api from CH
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 26 IPs in 6 countries across 16 domains to perform 50 HTTP transactions. The main IP is 52.8.142.247, located in San Jose, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is www.fortinet.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on March 19th 2019. Valid for: 2 years.
This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
7 52.8.142.247 16509 (AMAZON-02)
2 2.19.43.118 20940 (AKAMAI-ASN1)
7 2.21.37.83 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
1 3 54.76.193.55 16509 (AMAZON-02)
1 3 52.52.145.59 16509 (AMAZON-02)
1 2.16.186.146 20940 (AKAMAI-ASN1)
3 2a00:1450:400... 15169 (GOOGLE)
1 34.203.158.69 14618 (AMAZON-AES)
2 23.67.137.77 20940 (AKAMAI-ASN1)
2 2.21.36.181 20940 (AKAMAI-ASN1)
1 2a02:26f0:60:... 20940 (AKAMAI-ASN1)
2 23.111.9.217 33438 (HIGHWINDS2)
1 50.19.60.226 14618 (AMAZON-AES)
1 2a03:2880:f01... 32934 (FACEBOOK)
1 138.197.13.10 14061 (DIGITALOC...)
2 178.128.135.232 14061 (DIGITALOC...)
1 34.247.143.160 16509 (AMAZON-02)
1 4 172.82.235.45 15224 (OMNITURE)
1 1 66.117.28.86 15224 (OMNITURE)
1 2 34.255.28.155 16509 (AMAZON-02)
1 3 3.120.53.177 16509 (AMAZON-02)
1 66.117.29.6 15224 (OMNITURE)
1 2 172.82.228.19 15224 (OMNITURE)
2 46.51.181.97 16509 (AMAZON-02)
2 3 2620:119:50e2... 14413 (LINKEDIN)
1 1 2620:109:c002... 14413 (LINKEDIN)
50 26
7    52.8.142.247 (San Jose, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-8-142-247.us-west-1.compute.amazonaws.com
www.fortinet.com
2    2.19.43.118 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-43-118.deploy.static.akamaitechnologies.com
platform-api.sharethis.com
buttons-config.sharethis.com
7    2.21.37.83 (France)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-21-37-83.deploy.static.akamaitechnologies.com
assets.adobedtm.com
1    2a00:1450:4001:824::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
3    54.76.193.55 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-76-193-55.eu-west-1.compute.amazonaws.com
dpm.demdex.net
3    52.52.145.59 (San Jose, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-52-145-59.us-west-1.compute.amazonaws.com
www.fortinet.com
1    2.16.186.146 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-146.deploy.static.akamaitechnologies.com
c.sharethis.mgr.consensu.org
3    2a00:1450:4001:81f::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    34.203.158.69 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-203-158-69.compute-1.amazonaws.com
count-server.sharethis.com
2    23.67.137.77 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-67-137-77.deploy.static.akamaitechnologies.com
platform-cdn.sharethis.com
2    2.21.36.181 (France)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-21-36-181.deploy.static.akamaitechnologies.com
s.adroll.com
1    2a02:26f0:60:8b8::3adf (European Union)

ASN20940 (AKAMAI-ASN1, US)
sjs.bizographics.com
2    23.111.9.217 (Phoenix, United States)

ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)
a.optmnstr.com
1    50.19.60.226 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-50-19-60-226.compute-1.amazonaws.com
api.opmnstr.com
1    2a03:2880:f01c:20e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
graph.facebook.com
1    138.197.13.10 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
a.mstrlytcs.com
2    178.128.135.232 (Greece)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
z.opmnstr.com
1    34.247.143.160 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-247-143-160.eu-west-1.compute.amazonaws.com
fortinet.demdex.net
4    172.82.235.45 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: fortinet.com.ssl.sc.omtrdc.net
metrics.fortinet.com
1    66.117.28.86 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
cm.everesttech.net
2    34.255.28.155 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-255-28-155.eu-west-1.compute.amazonaws.com
dpm.demdex.net
3    3.120.53.177 (Fairfield, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-3-120-53-177.eu-central-1.compute.amazonaws.com
l.sharethis.com
1    66.117.29.6 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
fortinet.tt.omtrdc.net
2    172.82.228.19 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: *.sc.omtrdc.net
fortinetinc.sc.omtrdc.net
2    46.51.181.97 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-46-51-181-97.eu-west-1.compute.amazonaws.com
d.adroll.com
3    2620:119:50e2:105::6cae:b35 (United States)

ASN14413 (LINKEDIN - LinkedIn Corporation, US)
px.ads.linkedin.com
1    2620:109:c002::6cae:a0a (United States)

ASN14413 (LINKEDIN - LinkedIn Corporation, US)
www.linkedin.com
Domain Requested by
10 www.fortinet.com 1 redirects www.fortinet.com
7 assets.adobedtm.com www.fortinet.com
assets.adobedtm.com
5 dpm.demdex.net 2 redirects www.fortinet.com
4 metrics.fortinet.com 1 redirects www.fortinet.com
3 px.ads.linkedin.com 2 redirects
3 l.sharethis.com 1 redirects www.fortinet.com
3 www.google-analytics.com www.googletagmanager.com
www.fortinet.com
2 d.adroll.com s.adroll.com
www.fortinet.com
2 fortinetinc.sc.omtrdc.net 1 redirects www.fortinet.com
2 z.opmnstr.com a.optmnstr.com
2 a.optmnstr.com www.googletagmanager.com
www.fortinet.com
2 s.adroll.com www.googletagmanager.com
s.adroll.com
2 platform-cdn.sharethis.com www.fortinet.com
1 www.linkedin.com 1 redirects
1 fortinet.tt.omtrdc.net assets.adobedtm.com
1 cm.everesttech.net 1 redirects
1 fortinet.demdex.net assets.adobedtm.com
1 a.mstrlytcs.com a.optmnstr.com
1 graph.facebook.com platform-api.sharethis.com
1 api.opmnstr.com a.optmnstr.com
1 sjs.bizographics.com www.googletagmanager.com
1 count-server.sharethis.com platform-api.sharethis.com
1 c.sharethis.mgr.consensu.org platform-api.sharethis.com
1 www.googletagmanager.com www.fortinet.com
1 buttons-config.sharethis.com platform-api.sharethis.com
1 platform-api.sharethis.com www.fortinet.com
50 26
Subject Issuer Validity Valid
www.fortinet.com
DigiCert SHA2 High Assurance Server CA		 2019-03-19 -
2021-06-09		 2 years crt.sh
*.sharethis.com
DigiCert SHA2 Secure Server CA		 2018-12-16 -
2020-03-16		 a year crt.sh
assets.adobedtm.com
DigiCert SHA2 High Assurance Server CA		 2019-03-04 -
2020-03-11		 a year crt.sh
*.google-analytics.com
Google Internet Authority G3		 2019-04-16 -
2019-07-09		 3 months crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA		 2018-01-09 -
2021-02-12		 3 years crt.sh
*.sharethis.mgr.consensu.org
DigiCert ECC Secure Server CA		 2018-07-31 -
2019-07-31		 a year crt.sh
*.adroll.com
DigiCert SHA2 Secure Server CA		 2018-12-19 -
2020-03-19		 a year crt.sh
js.bizographics.com
DigiCert SHA2 Secure Server CA		 2018-04-13 -
2020-04-17		 2 years crt.sh
*.optmnstr.com
Go Daddy Secure Certificate Authority - G2		 2018-07-10 -
2020-07-10		 2 years crt.sh
*.opmnstr.com
Go Daddy Secure Certificate Authority - G2		 2019-04-11 -
2021-04-11		 2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2019-03-08 -
2019-06-06		 3 months crt.sh
*.mstrlytcs.com
Go Daddy Secure Certificate Authority - G2		 2017-08-25 -
2019-08-25		 2 years crt.sh
z.opmnstr.com
Let's Encrypt Authority X3		 2019-04-11 -
2019-07-10		 3 months crt.sh
metrics.fortinet.com
DigiCert SHA2 High Assurance Server CA		 2019-01-29 -
2021-02-02		 2 years crt.sh
*.tt.omtrdc.net
DigiCert SHA2 High Assurance Server CA		 2017-10-19 -
2020-11-25		 3 years crt.sh
*.sc.omtrdc.net
DigiCert SHA2 High Assurance Server CA		 2019-04-23 -
2020-04-14		 a year crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA		 2017-06-06 -
2019-06-11		 2 years crt.sh

This page contains 6 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Frame ID: 4EBC4B5C588A38B13BFEB6B99959FB45
Requests: 48 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Frame ID: 8B797DB7942EAAEFED89BEAC3951623C
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864a164746d58b700412b.html
Frame ID: 6F544C5F7BB4BCFB3A73D806BA87C93A
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864f264746d7629003a65.html
Frame ID: 6B0EA1ACF76219FD2C0FCFE7FDB30984
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa8640864746d58b700411f.html
Frame ID: 44E1AF799368E0A894688827AAC22E4B
Requests: 1 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: 1061B0B6A41E406B11CBA276AD101635
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /(?:a|s)\.adroll\.com/i
  • env /^adroll_/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i
Overall confidence: 100%
Detected patterns
  • env /^google_tag_manager$/i
Overall confidence: 100%
Detected patterns
  • script /\/s[_-]code.*\.js/i
  • env /^s_(?:account|objectID|code|INST)$/i
Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

50
Requests

100 %
HTTPS

22 %
IPv6

16
Domains

26
Subdomains

26
IPs

6
Countries

834 kB
Transfer

1855 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7
  • https://dpm.demdex.net/id?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557145636696 HTTP 302
  • https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557145636696
Request Chain 25
  • https://www.fortinet.com/content/fortinet-blog/us/en/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png HTTP 301
  • https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png
Request Chain 40
  • https://metrics.fortinet.com/id?d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=23855462590936790362671781040734590147&ts=1557145637915 HTTP 302
  • https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=23855462590936790362671781040734590147&ts=1557145637915&AQE=1
Request Chain 41
  • https://cm.everesttech.net/cm/dd?d_uuid=24221050528014198282707279840808662347 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=XNAoJwAAFE_5PRN_ HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=XNAoJwAAFE_5PRN_
Request Chain 42
  • https://l.sharethis.com/pview?event=pview&version=st_sop.js&lang=en&hostname=www.fortinet.com&location=%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&product=sticky-share-buttons&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&source=sharethis.js&fcmp=false&title=LockerGoga%3A%20Ransomware%20Targeting%20Critical%20Infrastructure&publisher=5977d47080bb1d0011ab6d8f&ts1557145636515=&sop=true HTTP 301
  • https://l.sharethis.com/sc?cm=ZGABC1zQKCYAAAASLUn2Aw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
Request Chain 45
  • https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=23855462590936790362671781040734590147&ts=1557145637915&AQE=1 HTTP 302
  • https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=23855462590936790362671781040734590147&ts=1557145637915&AQE=1
Request Chain 51
  • https://px.ads.linkedin.com/collect/?time=1557145640429&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1 HTTP 302
  • https://px.ads.linkedin.com/collect/?time=1557145640429&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1557145640429%26pid%3D7120%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Flockergoga-ransomeware-targeting-critical-infrastructure.html%26fmt%3Djs%26s%3D1%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect/?time=1557145640429&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1&cookiesTest=true&liSync=true

50 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request lockergoga-ransomeware-targeting-critical-infrastructure.html
www.fortinet.com/blog/threat-research/ 		51 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
37a2d3ed4482161212f1fbf4706656bcc9b247035a772840ea588e712d6e0270
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
www.fortinet.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=600, public
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Mon, 06 May 2019 12:27:16 GMT
ETag
"cc1d-5882b48172180-gzip"
Last-Modified
Sun, 05 May 2019 22:12:38 GMT
Server
Apache
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Vary
Accept-Encoding,User-Agent
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
Content-Length
12124
Connection
keep-alive
clientlib-base.min.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 		211 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
eb6058ea8eec777d07e89407b55de7990eb296b3f5a5ee4a6b04c71d3c129c42
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:29:16 GMT
Server
Apache
ETag
"34d65-5878def26f700-gzip"
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
text/css
Cache-Control
max-age=43200, public
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
Content-Length
16858
X-XSS-Protection
1; mode=block
sharethis.js
platform-api.sharethis.com/js/ 		91 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e5c2f85b9e49be5acd30c8ba3767b124d8945f35000eef89902a0485c04e6040

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:16 GMT
Content-Encoding
gzip
ETag
W/"16d4e-SgmVDK5mv+C+DRaEIjQ3WYUSiQ4"
Vary
Accept-Encoding
Access-Control-Allow-Methods
DELETE, GET, HEAD, OPTIONS, POST, PUT
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Content-Length
27855
satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/ 		144 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.83 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-83.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f2bf5964adbfac80827ae87c5f7c0f05e51f416e3e2132fd93dc2e2d98f2e935

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 12:27:16 GMT
content-encoding
gzip
last-modified
Thu, 25 Apr 2019 23:34:48 GMT
server
Apache
etag
"479d7011b674847178716d558563c2d3:1556235288"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 06 May 2019 13:27:16 GMT
fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 		32 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:29:19 GMT
Server
Apache
ETag
"7ebb-5878def54bdc0-gzip"
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
Content-Length
1998
X-XSS-Protection
1; mode=block
clientlib-base.min.js
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 		165 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
85c6103aabd94bf4584fbdd8b15cb68c08fa52f43dc229ac034a1bf6c855c0bc
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:16 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:26:14 GMT
Server
Apache
ETag
"2931b-5878de44ddd80-gzip"
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
application/javascript
Cache-Control
max-age=43200, public
transfer-encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
X-XSS-Protection
1; mode=block
5977d47080bb1d0011ab6d8f.js
buttons-config.sharethis.com/js/ 		444 B
865 B 		Script
General
Check archive.org
Download Go to
Full URL
https://buttons-config.sharethis.com/js/5977d47080bb1d0011ab6d8f.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-118.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
7f0daa7591ef2b42b26dd9d39102440c242e7fd798e7898a620e5489d67ec73e

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:16 GMT
Last-Modified
Tue, 16 Jan 2018 20:14:52 GMT
Server
AmazonS3
x-amz-request-id
33BF777283B6DCED
ETag
"6167cc13570c31ffc1713616a6fb087d"
Content-Type
text/javascript
Cache-Control
public, max-age=60
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
444
x-amz-id-2
hsILMaWrKRvq3dU3rIiiMpbXCpEB1o2SKOTVgl6vRXE0vKuZmuHru/osDcmeuqMHuHCSYNUlvNc=
gtm.js
www.googletagmanager.com/ 		60 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager (scaffolding) /
Resource Hash
604ae5068c06ac47597ed7e1c587a0ce7d8ff6e8174a979b285169f1b3277016
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 12:27:16 GMT
content-encoding
br
last-modified
Wed, 01 May 2019 22:14:49 GMT
server
Google Tag Manager (scaffolding)
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
23009
x-xss-protection
0
expires
Mon, 06 May 2019 12:27:16 GMT
rd
dpm.demdex.net/id/
Redirect Chain
  • https://dpm.demdex.net/id?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557145636696
  • https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557145636696
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557145636696
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.76.193.55 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-76-193-55.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Location
https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557145636696
X-TID
rrzbRCEBSPA=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.fortinet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Access-Control-Allow-Origin
https://www.fortinet.com
X-TID
rrzbRCEBSPA=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557145636696
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
mbox-contents-081c7224345c702ebcf6ef22d3b7449ec11ce42d.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/ 		75 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/mbox-contents-081c7224345c702ebcf6ef22d3b7449ec11ce42d.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.83 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-83.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
bf37dba5836581c0cc0451edd5c197e46a5a0e070b3f696e5b4bf7e32da1817a

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Mon, 06 May 2019 12:27:16 GMT
content-encoding
gzip
last-modified
Thu, 25 Apr 2019 23:34:48 GMT
server
Apache
etag
"eb6d969848d866a39a78150c4a347735:1556235288"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
27590
expires
Mon, 06 May 2019 13:27:16 GMT
truncated
/ 		71 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
image/png
lockergoga.png
www.fortinet.com/content/dam/fortinet-blog/article-images/lockergoga-blog/ 		110 KB
110 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/lockergoga-blog/lockergoga.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
caa02d6bc107a0f648a41c4572b8e7fd71278b2e740e4bc809594dd3dc446c8d
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:16 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:26:56 GMT
Server
Apache
ETag
"1b7e9-5878de6cebc00"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
112617
X-XSS-Protection
1; mode=block
anatova-blog-two.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/anatova-ransomware/ 		78 KB
78 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/anatova-ransomware/anatova-blog-two.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
c9e784c91038976835b53028e10a3f90e1508036aaba1859a820ffec8c2e9486
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:17 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 05:59:10 GMT
Server
Apache
ETag
"1374e-58790ddd02780"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
79694
X-XSS-Protection
1; mode=block
TLR-img.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/tlr-q4-blog/ 		66 KB
66 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/tlr-q4-blog/TLR-img.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.52.145.59 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-52-145-59.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
af780899477625834ea7cd70915f91c4cc903413e1fd8769a9117d22adcb7865
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:17 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 03:10:12 GMT
Server
Apache
ETag
"107eb-5878e818a8d00"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
67563
X-XSS-Protection
1; mode=block
gandcrab-honor-among-thieves-thumb.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/gandcrab--honor-among-thieves/ 		64 KB
65 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/gandcrab--honor-among-thieves/gandcrab-honor-among-thieves-thumb.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
26e382d9c4380bd0293c2d41be30b754a01fb09db5d2e5c6b60bbd0368efb2ed
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:17 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:30:20 GMT
Server
Apache
ETag
"10052-5878df2f78700"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
65618
X-XSS-Protection
1; mode=block
portal.html
c.sharethis.mgr.consensu.org/v1.0/cmp/ Frame 8B79 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.146 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-146.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Host
c.sharethis.mgr.consensu.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods
DELETE, GET, HEAD, OPTIONS, POST, PUT
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
ETag
W/"26b-4977387000"
Last-Modified
Tue, 01 Jan 1980 00:00:00 GMT
Vary
Accept-Encoding
Content-Length
334
Cache-Control
public, max-age=3600
Date
Mon, 06 May 2019 12:27:17 GMT
Connection
keep-alive
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Jan 2019 20:01:45 GMT
server
Golfe2
age
3287
date
Mon, 06 May 2019 11:32:29 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
17543
expires
Mon, 06 May 2019 13:32:29 GMT
collect
www.google-analytics.com/r/ 		35 B
111 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j73&a=184993851&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&ul=en-us&de=UTF-8&dt=LockerGoga%3A%20Ransomware%20Targeting%20Critical%20Infrastructure&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAAAB~&jid=1890814757&gjid=973305731&cid=2139039732.1557145637&tid=UA-767980-6&_gid=1775809529.1557145637&_r=1&gtm=2wg430NBSLLPJ&z=897889808
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 06 May 2019 12:27:16 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
satellite-5aa864a164746d58b700412b.html
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ Frame 6F54 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864a164746d58b700412b.html
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.83 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-83.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
assets.adobedtm.com
:scheme
https
:path
/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864a164746d58b700412b.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html

Response headers

status
200
server
Apache
etag
"52fa849a16651953dc915efbae88d0cc:1556235289"
last-modified
Thu, 25 Apr 2019 23:34:49 GMT
accept-ranges
bytes
content-type
text/html
vary
Accept-Encoding
content-encoding
gzip
content-length
803
cache-control
max-age=3600
expires
Mon, 06 May 2019 13:27:16 GMT
date
Mon, 06 May 2019 12:27:16 GMT
timing-allow-origin
*
satellite-5aa864f264746d7629003a65.html
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ Frame 6B0E 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864f264746d7629003a65.html
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.83 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-83.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
assets.adobedtm.com
:scheme
https
:path
/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864f264746d7629003a65.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html

Response headers

status
200
server
Apache
etag
"8227658d1e33b9eaa91028e35c3beb4f:1556235289"
last-modified
Thu, 25 Apr 2019 23:34:49 GMT
accept-ranges
bytes
content-type
text/html
vary
Accept-Encoding
content-encoding
gzip
content-length
782
cache-control
max-age=3600
expires
Mon, 06 May 2019 13:27:16 GMT
date
Mon, 06 May 2019 12:27:16 GMT
timing-allow-origin
*
satellite-5aa8640864746d58b700411f.html
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ Frame 44E1 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa8640864746d58b700411f.html
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.83 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-83.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
assets.adobedtm.com
:scheme
https
:path
/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa8640864746d58b700411f.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html

Response headers

status
200
server
Apache
etag
"94b6dd03c710fe7140881c36dbb5ab47:1556235289"
last-modified
Thu, 25 Apr 2019 23:34:49 GMT
accept-ranges
bytes
content-type
text/html
vary
Accept-Encoding
content-encoding
gzip
content-length
899
cache-control
max-age=3600
expires
Mon, 06 May 2019 13:27:16 GMT
date
Mon, 06 May 2019 12:27:16 GMT
timing-allow-origin
*
s-code-contents-678d604999b9203058dbe982c7a7ddbf795bb1f4.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/ 		34 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/s-code-contents-678d604999b9203058dbe982c7a7ddbf795bb1f4.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.83 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-83.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
68588db4f09f1982d74887644c54e581cc6ed7e267f836a480c29ef1a3c0a7a0

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 12:27:17 GMT
content-encoding
gzip
last-modified
Thu, 25 Apr 2019 23:34:48 GMT
server
Apache
etag
"9a1e762486f8afef7a6f384a1e9c253d:1556235288"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
13170
expires
Mon, 06 May 2019 13:27:17 GMT
satellite-59ceae2064746d21fe0037dd.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ 		1 KB
693 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-59ceae2064746d21fe0037dd.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.37.83 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-37-83.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
24038492cb3d19fef34ce0a9bc55033f3030c04eeea97a93c22b2ec8914c1316

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 12:27:16 GMT
content-encoding
gzip
last-modified
Thu, 25 Apr 2019 23:34:49 GMT
server
Apache
etag
"d8619d86a5e27900726ec96a76ead3cc:1556235289"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
459
expires
Mon, 06 May 2019 13:27:16 GMT
get_counts
count-server.sharethis.com/v2.0/ 		327 B
402 B 		Script
General
Check archive.org
Download Go to
Full URL
https://count-server.sharethis.com/v2.0/get_counts?cb=window.__sharethis__.cb3&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&refDomain=www.fortinet.com&sop=true
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.203.158.69 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-203-158-69.compute-1.amazonaws.com
Software
/
Resource Hash
a93d1dfea16ac5c30f63a64073fe4f27b936c092ea5bdfd971685b2c36a642e9

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:17 GMT
Content-Encoding
gzip
Connection
keep-alive
Content-Length
245
Content-Type
application/json
arrow_left.svg
platform-cdn.sharethis.com/img/ 		565 B
949 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/arrow_left.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.137.77 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-137-77.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:17 GMT
Last-Modified
Fri, 04 Jan 2019 18:31:05 GMT
Server
AmazonS3
x-amz-request-id
0163F18421DACD1D
ETag
"b55d8d2b9321e381a3c38a4bddb74037"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
565
x-amz-id-2
8jJiqlKh2b3lHnxok3IzRGezuoyDDxdXXyKuWiW/txNQ3pFQpk7mgpRHvu4X21bKgCpU+1HbAQA=
arrow_right.svg
platform-cdn.sharethis.com/img/ 		565 B
949 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/arrow_right.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.137.77 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-137-77.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:17 GMT
Last-Modified
Fri, 04 Jan 2019 18:31:05 GMT
Server
AmazonS3
x-amz-request-id
25AF35FCA1CA0833
ETag
"9928d025bd5792b718ee0a185f62e67c"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
565
x-amz-id-2
dCLdKn3tqyYf73xYAQUSaaDmWFfnexgsyr3d9weFnmy16Czo0dkgZ132+KcPFu8T818B6DBtLKs=
image_873699664.img.png
www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/
Redirect Chain
  • https://www.fortinet.com/content/fortinet-blog/us/en/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png
  • https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png
92 KB
93 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.52.145.59 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-52-145-59.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
db48939bec021c7c13015d86307bafa2a2f8b832700fa92806d67bb32112462e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:17 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 07:37:33 GMT
Server
Apache
ETag
"1705b-587923da8c940"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
94299
X-XSS-Protection
1; mode=block

Redirect headers

Location
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png
Date
Mon, 06 May 2019 12:27:17 GMT
Server
Apache
Connection
keep-alive
Content-Length
367
Content-Type
text/html; charset=iso-8859-1
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
image/gif
roundtrip.js
s.adroll.com/j/ 		32 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.36.181 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-36-181.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
6d73aa32774fb131ebbc1faf3f931aaf66e998f808757cbafbcc737f8d769580

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
ea1u3hYQrubY64bATByV7XbdUEwnubrR
Content-Encoding
gzip
x-amz-request-id
C536B1FAEBC1E4D9
x-amz-server-side-encryption
AES256
Access-Control-Max-Age
600
Date
Mon, 06 May 2019 12:27:20 GMT
Connection
keep-alive
Content-Length
10245
x-amz-id-2
BqT884hb7nN51TPwVeBq4SmjKLkPl1DCsoBLR1w4Li5m00MipfD+pI0Z79FeUxcldAGfRc7hFts=
Last-Modified
Wed, 20 Feb 2019 19:22:50 GMT
Server
AmazonS3
ETag
"a75c16aa500b21e32e06699919372ec4"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
insight.min.js
sjs.bizographics.com/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sjs.bizographics.com/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:60:8b8::3adf , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:17 GMT
Content-Encoding
gzip
Last-Modified
Mon, 03 Dec 2018 23:03:30 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=55681
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4571
api.min.js
a.optmnstr.com/app/js/ 		176 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.optmnstr.com/app/js/api.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.217 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
696bac8666ce5bf4e390c7f71dc783a17fb56a3b429c6ff35dd5ad52ae254988

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 12:27:17 GMT
content-encoding
gzip
last-modified
Wed, 01 May 2019 20:28:04 GMT
server
NetDNA-cache/2.2
x-amz-request-id
0EB5603AAEA8151F
etag
W/"893ec539b14306fc6cd144c53e9daa66"
x-cache
HIT
content-type
application/javascript
status
200
cache-control
max-age=2592000
x-amz-id-2
Ux9RiJdNMR2AUJqZZSbvaCtZV3cyg4JI/s5J2WQp5hO18lqTnuTUQt35CUa7jJRMX6BPMKjZS+M=
expires
Wed, 05 Jun 2019 12:27:17 GMT
39852
api.opmnstr.com/v2/embed/ 		163 KB
16 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.opmnstr.com/v2/embed/39852
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.19.60.226 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-50-19-60-226.compute-1.amazonaws.com
Software
Pagely Gateway/1.5.1 /
Resource Hash
04c7fc62027de4c79f20a877f16b3fe9ecc2c45c647cb632b92f0d442784991c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

x-user-agent
standard
content-encoding
gzip
x-cache-config
0 0
server
Pagely Gateway/1.5.1
status
200
date
Mon, 06 May 2019 12:27:17 GMT
x-cache-status
HIT
vary
Accept-Encoding, User-Agent
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-OptinMonster-Account
access-control-allow-headers
X-CSRF-Token
x-optinmonster-account
45602
/
graph.facebook.com/ 		585 B
772 B 		Script
General
Check archive.org
Download Go to
Full URL
https://graph.facebook.com/?id=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&callback=window.__sharethis__.cb4
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:20e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
a845f8ef9d6435077c09c3a9ec401f17f9d6b58f0f49f6014d2ff7c04d4be73c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-app-usage
{"call_count":0,"total_cputime":0,"total_time":0}
status
200
date
Mon, 06 May 2019 12:27:17 GMT
x-fb-rev
1000675714
content-length
327
pragma
no-cache
x-fb-debug
wmvGl3kbmFCZV+l6kIZpGYnxC1o5otDxW1fvT1wxSxwbpQYw2a/D1Zliv0tClMfsNa1O6rUDoQO2QHOoqu+sww==
x-fb-trace-id
DhldQafVAzu
etag
"6d3dddee4e0071d077d11dfab9d235838b02e9fe"
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
x-fb-request-id
AG5SG2dMsVfyCFA0-m2fdOu
cache-control
private, no-cache, no-store, must-revalidate
facebook-api-version
v2.9
expires
Sat, 01 Jan 2000 00:00:00 GMT
b5fcd7bd32e11550704192-blog-banner-1024x160-TLR-Q4-2018.jpg
a.optmnstr.com/users/df0603609574/images/ 		78 KB
78 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.optmnstr.com/users/df0603609574/images/b5fcd7bd32e11550704192-blog-banner-1024x160-TLR-Q4-2018.jpg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.217 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
c001e01a6b6a23f4619521bb9a5cdea66124971ab04cf0211649015b0c4af1b1

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 12:27:17 GMT
x-amz-request-id
A72C287067CE6966
x-cache
HIT
status
200
x-amz-meta-date
1550704192
content-length
79452
x-amz-id-2
slvpkKABbzI4epoFWAmFMjSGt4+l253KuFjJHitlCw+Z+7RSFY1Qo4uBRbvNAWKCT8sjvd6IhTw=
x-amz-meta-level
pro
last-modified
Wed, 20 Feb 2019 23:09:53 GMT
server
NetDNA-cache/2.2
x-amz-meta-accountid
45602
etag
"fc7ddf45e300c64bfc4cb7ddc8c325c8"
content-type
image/jpeg
x-amz-meta-userid
39852
x-amz-meta-title
b5fcd7bd32e11550704192-blog-banner-1024x160-TLR-Q4-2018.jpg
cache-control
max-age=2592000
accept-ranges
bytes
expires
Wed, 05 Jun 2019 12:27:17 GMT
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dbeeb3fa5f0188835b6b6208bc89d641f030e79e27ad5712d427eabd79e6095a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
image/png
a
a.mstrlytcs.com/v1/ 		0
132 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://a.mstrlytcs.com/v1/a?ty=impression&aid=39852&cid=41325&sid=81773&v=5
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
138.197.13.10 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

status
200
date
Mon, 06 May 2019 12:27:17 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://www.fortinet.com
content-type
text/plain; charset=UTF-8
q
z.opmnstr.com/v2/ 		0
204 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://z.opmnstr.com/v2/q?aid=39852&cid=qxx1b0gslklfu2kjckea&sid=5ab4105aee546&gaid=1306710&gas=5ab42b3012fe2&v=5
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.128.135.232 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
kong/0.14.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

Access-Control-Allow-Origin
https://www.fortinet.com
Date
Mon, 06 May 2019 12:27:17 GMT
Access-Control-Allow-Credentials
true
Server
kong/0.14.1
Connection
keep-alive
i
z.opmnstr.com/v3/ 		0
204 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://z.opmnstr.com/v3/i?aid=39852&cid=qxx1b0gslklfu2kjckea&sid=5ab4105aee546&rt=false&dv=desktop&cty=inline&url=blog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&v=5
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.128.135.232 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
kong/0.14.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

Access-Control-Allow-Origin
https://www.fortinet.com
Date
Mon, 06 May 2019 12:27:18 GMT
Access-Control-Allow-Credentials
true
Server
kong/0.14.1
Connection
keep-alive
collect
www.google-analytics.com/r/ 		35 B
111 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j73&a=184993851&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&ul=en-us&de=UTF-8&dt=LockerGoga%3A%20Ransomware%20Targeting%20Critical%20Infrastructure&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Blog%20-%20Threat%20Research&ea=impression&el=qxx1b0gslklfu2kjckea&_u=6HDAAEAB~&jid=1071908412&gjid=1235471708&cid=2139039732.1557145637&tid=UA-767980-1&_gid=1775809529.1557145637&_r=1&z=1868855772
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 06 May 2019 12:27:17 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
rd
dpm.demdex.net/id/ 		367 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557145636696
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.76.193.55 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-76-193-55.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ccedb1a72caaadd439c20e9779abcd7a2a0829103dd5a93aeb5ce1f5e3bfd911

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v028-010537d0a.edge-irl1.demdex.com 5.52.1.20190424113352 5ms
Pragma
no-cache
Content-Encoding
gzip
X-TID
o5MWAjN/Trs=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.fortinet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
302
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Cookie set dest5.html
fortinet.demdex.net/ Frame 1061 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://fortinet.demdex.net/dest5.html?d_nsid=0
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.247.143.160 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-247-143-160.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Host
fortinet.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Accept-Encoding
gzip, deflate, br
Cookie
demdex=24221050528014198282707279840808662347
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Thu, 25 Apr 2019 10:04:19 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=24221050528014198282707279840808662347;Path=/;Domain=.demdex.net;Expires=Sat, 02-Nov-2019 12:27:20 GMT;Max-Age=15552000
Vary
Accept-Encoding, User-Agent
X-TID
LamLt/DHRB0=
Content-Length
2764
Connection
keep-alive
id
fortinetinc.sc.omtrdc.net/
Redirect Chain
  • https://metrics.fortinet.com/id?d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=23855462590936790362671781040734590147&ts=1557145637915
  • https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critic...
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=23855462590936790362671781040734590147&ts=1557145637915&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.82.235.45 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
fortinet.com.ssl.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 06 May 2019 12:27:19 GMT
Last-Modified
Tue, 07 May 2019 12:27:19 GMT
Server
Omniture DC
xserver
www7145
Location
https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=23855462590936790362671781040734590147&ts=1557145637915&AQE=1
P3P
CP="This is not a P3P policy"
Access-Control-Allow-Origin
https://www.fortinet.com
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
text/plain
Keep-Alive
timeout=15
Content-Length
0
Expires
Sun, 05 May 2019 12:27:19 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 06 May 2019 12:27:19 GMT
Last-Modified
Tue, 07 May 2019 12:27:19 GMT
Server
Omniture DC
Access-Control-Allow-Origin
https://www.fortinet.com
xserver
www7145
P3P
CP="This is not a P3P policy"
Location
https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=23855462590936790362671781040734590147&ts=1557145637915&AQE=1
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
text/plain
Keep-Alive
timeout=15
Content-Length
0
Expires
Sun, 05 May 2019 12:27:19 GMT
demconf.jpg
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=24221050528014198282707279840808662347
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=XNAoJwAAFE_5PRN_
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=XNAoJwAAFE_5PRN_
42 B
769 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=XNAoJwAAFE_5PRN_
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.255.28.155 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-255-28-155.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v028-086a282a2.edge-irl1.demdex.com 5.52.1.20190424113352 5ms
Pragma
no-cache
X-TID
A7f39CFhTYc=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
X-TID
quc9dq9LSIg=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=XNAoJwAAFE_5PRN_
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sc
l.sharethis.com/
Redirect Chain
  • https://l.sharethis.com/pview?event=pview&version=st_sop.js&lang=en&hostname=www.fortinet.com&location=%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&prod...
  • https://l.sharethis.com/sc?cm=ZGABC1zQKCYAAAASLUn2Aw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://l.sharethis.com/sc?cm=ZGABC1zQKCYAAAASLUn2Aw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.120.53.177 Fairfield, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-120-53-177.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:18 GMT
Location
/sc?cm=ZGABC1zQKCYAAAASLUn2Aw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
Access-Control-Max-Age
1728000
P3p
policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Access-Control-Allow-Origin
https://www.fortinet.com
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
*
Content-Length
224
Stid
ZGABC1zQKCYAAAASLUn2Aw==

Redirect headers

Date
Mon, 06 May 2019 12:27:18 GMT
Access-Control-Allow-Origin
https://www.fortinet.com
Access-Control-Max-Age
1728000
P3p
policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Location
/sc?cm=ZGABC1zQKCYAAAASLUn2Aw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
*
Content-Length
224
Stid
ZGABC1zQKCYAAAASLUn2Aw==
sc
l.sharethis.com/ 		52 B
475 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://l.sharethis.com/sc?cm=ZGABC1zQKCYAAAASLUn2Aw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.120.53.177 Fairfield, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-120-53-177.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
937c3efffd1989c955004ba481f718b9392fc86f82010290bee98d9930058e3d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

Date
Mon, 06 May 2019 12:27:18 GMT
Access-Control-Max-Age
1728000
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://www.fortinet.com
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Stid
ZGABC1zQKCYAAAASLUn2Aw==
Access-Control-Allow-Headers
*
Content-Length
52
json
fortinet.tt.omtrdc.net/m2/fortinet/mbox/ 		96 B
356 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fortinet.tt.omtrdc.net/m2/fortinet/mbox/json?mbox=target-global-mbox&mboxSession=24ef621934a841978d8c4a2303a804a5&mboxPC=&mboxPage=95f715bddb86417f8816d13036e6d63d&mboxRid=4ff411a8e47445b5a0d0743154ef4338&mboxVersion=1.6.4&mboxCount=1&mboxTime=1557145636800&mboxHost=www.fortinet.com&mboxURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&mboxReferrer=&browserHeight=1200&browserWidth=1600&browserTimeOffset=0&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&mboxMCSDID=0E08098990899431-042C218A261C522D&vst.trk=nsmetrics.fortinet.com&vst.trks=metrics.fortinet.com
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/mbox-contents-081c7224345c702ebcf6ef22d3b7449ec11ce42d.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
66.117.29.6 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
/
Resource Hash
987cc8d4917c821c783e6d42b5bc88708b736ad5784af2623aea8778d8151961

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

pragma
no-cache
date
Mon, 06 May 2019 12:27:18 GMT
status
200
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.fortinet.com
cache-control
no-cache
access-control-allow-credentials
true
timing-allow-origin
*
content-length
96
x-request-id
4ff411a8e47445b5a0d0743154ef4338
id
metrics.fortinet.com/
Redirect Chain
  • https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critic...
  • https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-c...
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=23855462590936790362671781040734590147&ts=1557145637915&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.82.228.19 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
*.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:19 GMT
X-Content-Type-Options
nosniff
Access-Control-Allow-Origin
null
P3P
CP="This is not a P3P policy"
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 12:27:19 GMT
Server
Omniture DC
xserver
www197
Content-Type
text/plain
Location
https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=23855462590936790362671781040734590147&ts=1557145637915&AQE=1
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Expires
Sun, 05 May 2019 12:27:19 GMT

Redirect headers

Date
Mon, 06 May 2019 12:27:19 GMT
X-Content-Type-Options
nosniff
P3P
CP="This is not a P3P policy"
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 12:27:19 GMT
Server
Omniture DC
xserver
www197
Location
https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=23855462590936790362671781040734590147&ts=1557145637915&AQE=1
Content-Type
text/plain
Access-Control-Allow-Origin
null
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Expires
Sun, 05 May 2019 12:27:19 GMT
id
metrics.fortinet.com/ 		49 B
526 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=23855462590936790362671781040734590147&ts=1557145637915&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.82.235.45 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
fortinet.com.ssl.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
6bcf74ea09f3338064e1cf83dc8fc5109613390f5c7d40b0aa2f7f8ee0cc3559
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
null
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Mon, 06 May 2019 12:27:20 GMT
X-Content-Type-Options
nosniff
Server
Omniture DC
xserver
www288
Vary
Origin
X-C
ms-6.6.0
P3P
CP="This is not a P3P policy"
Access-Control-Allow-Origin
null
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/x-javascript
Keep-Alive
timeout=15
Content-Length
49
X-XSS-Protection
1; mode=block
7OBVBCAQE5FHDPFEAD5T4D
d.adroll.com/consent/check/ 		40 B
200 B 		Script
General
Check archive.org
Download Go to
Full URL
https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D?_s=3250405143c4c6523c2a9fc6e2bf0458
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.51.181.97 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-46-51-181-97.eu-west-1.compute.amazonaws.com
Software
nginx/1.14.1 /
Resource Hash
6f43e1e85c42d5e449308701054501d9867a7254c9a8734406afbc89b3dfe5b4

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:20 GMT
Server
nginx/1.14.1
Connection
keep-alive
Content-Length
40
Content-Type
application/javascript
consent.js
s.adroll.com/j/ 		67 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/consent.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.36.181 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-36-181.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
4983cd18419e417077dcc013922828394049ce6c65db6a782d2d73f225d46089

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
yvF3y5OARyGYjZyuW4BqgiCbPvLhhPrH
Content-Encoding
gzip
x-amz-request-id
C660C44E50C70FE5
x-amz-server-side-encryption
AES256
Access-Control-Max-Age
600
Date
Mon, 06 May 2019 12:27:20 GMT
Connection
keep-alive
Content-Length
15051
x-amz-id-2
D7ez5VHgmq75oSk+RV5Bvhwc+NyzWhhLo0yRY2QgLPT4BylissuMXb5SUYS+jrJbzj5Q5WIVZIU=
Last-Modified
Thu, 06 Dec 2018 16:37:43 GMT
Server
AmazonS3
ETag
"53cd26585ff224c6851303016ec98536"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=300, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
hod
d.adroll.com/consent/ 		42 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d.adroll.com/consent/hod?_e=view_banner&_s=3250405143c4c6523c2a9fc6e2bf0458&_b=626d9f6089ce68&_a=7OBVBCAQE5FHDPFEAD5T4D
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.51.181.97 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-46-51-181-97.eu-west-1.compute.amazonaws.com
Software
nginx/1.14.1 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:20 GMT
Cache-Control
no-transform,public,max-age=300,s-maxage=900
Server
nginx/1.14.1
Connection
keep-alive
Content-Length
42
Vary
Cookie
Content-Type
image/gif
s06147430165848
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.10.0-D7QN/ 		43 B
616 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.10.0-D7QN/s06147430165848?AQB=1&ndh=1&pf=1&t=6%2F4%2F2019%2012%3A27%3A20%201%200&sdid=0E08098990899431-042C218A261C522D&D=D%3D&mid=23855462590936790362671781040734590147&aamlh=6&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Alockergoga-ransomeware-targeting-critical-infrastructure&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&events=event3&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&v3=%2B1&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Alockergoga-ransomeware-targeting-critical-infrastructure&v35=Enabled&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.82.235.45 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
fortinet.com.ssl.sc.omtrdc.net
Software
Omniture DC/2.0.0 /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 12:27:20 GMT
X-Content-Type-Options
nosniff
X-C
ms-6.6.0
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
43
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 12:27:20 GMT
Server
Omniture DC/2.0.0
xserver
www106
ETag
"3343944799541592064-6621348139817241565"
Vary
*
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Keep-Alive
timeout=15
Expires
Sun, 05 May 2019 12:27:20 GMT
/
px.ads.linkedin.com/collect/
Redirect Chain
  • https://px.ads.linkedin.com/collect/?time=1557145640429&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1
  • https://px.ads.linkedin.com/collect/?time=1557145640429&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1557145640429%26pid%3D7120%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-rese...
  • https://px.ads.linkedin.com/collect/?time=1557145640429&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s...
0
103 B 		Script
General
Check archive.org
Download Go to
Full URL
https://px.ads.linkedin.com/collect/?time=1557145640429&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1&cookiesTest=true&liSync=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:119:50e2:105::6cae:b35 , United States, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 12:27:21 GMT
content-encoding
gzip
server
Play
vary
Accept-Encoding
x-li-fabric
prod-lor1
status
200
x-li-proto
http/2
x-li-pop
prod-ela1
content-type
application/javascript
content-length
20
x-li-uuid
fzbR4bUXnBXgLM2BEisAAA==

Redirect headers

date
Mon, 06 May 2019 12:27:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
302
x-li-pop
prod-edc2
content-length
20
x-li-uuid
Ifjg1LUXnBVgBlFFbysAAA==
pragma
no-cache
server
Play
x-frame-options
sameorigin
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
vary
Accept-Encoding
strict-transport-security
max-age=2592000
x-li-fabric
prod-lor1
location
https://px.ads.linkedin.com/collect/?time=1557145640429&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1&cookiesTest=true&liSync=true
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

138 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| __stdos__ boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus function| __sharethis__docReady object| __sharethis__ object| dataLayer function| e function| Visitor object| _satellite object| s_c_il number| s_c_in function| targetPageParams object| adobe object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate function| postscribe object| google_tag_manager string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| fortinet_blog object| EasyAutocomplete object| search_config object| keywords object| siteId object| lang object| options boolean| searchFired boolean| blogFilter string| documentsQuery string| blogCategories string| authorsList string| yearsList object| lastQuery number| totalReturn number| lastRow object| lastWordsForCounting function| htmlEncode function| hideAutoComplete function| sitesearch_init function| sitesearch_search_callback function| sitesearch_countall_callback function| sitesearch_do_search function| sitesearch_do_force_search function| sitesearch_spellcheck_callback function| sitesearch_do_spellcheck function| sitesearch_do_suggest_search function| sitesearch_query_searchresult_callback function| sitesearch_do_query_searchresult function| sitesearch_click_page_callback function| sitesearch_click_page function| search_action function| sitesearch_search_fortiguard function| count_facets_type function| shuffle_facets function| csCookies object| cookieScriptWindow object| cookieScripts string| cookieScriptSrc function| cookieQuery string| cookieScriptPosition string| cookieScriptSource string| cookieScriptDomain string| cookieScriptReadMore string| cookieId number| cookieScriptDebug boolean| cookieScriptShowBadge string| cookieScriptCurrentUrl string| pagePath string| cookieScriptTitle string| cookieScriptDesc string| cookieScriptAccept string| cookieScriptMore string| cookieScriptCopyrights string| cookieBackground function| setImmediate function| clearImmediate function| $ function| jQuery undefined| Cookies string| cookieScriptReject function| cookieScriptLoadJavaScript function| InjectCookieScript string| cookieScriptStatsDomain function| cookieScriptCreateCookie function| cookieScriptReadCookie function| cookieScriptAddBox object| cookieScriptCurrentValue string| adroll_adv_id string| adroll_pix_id boolean| __adroll_loaded string| _bizo_data_partner_id undefined| _bizo_data_partner_title undefined| _bizo_data_partner_domain undefined| _bizo_data_partner_company undefined| _bizo_data_partner_location undefined| _bizo_data_partner_employee_range undefined| _bizo_data_partner_sics undefined| _bizo_data_partner_email function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq object| t function| OptinMonsterApp boolean| om_loaded object| om45602_39852 object| _omapp object| omajiy6yksgfbr0illbjel object| ombs6hw8oho0l8z5lmhzmv object| omqxx1b0gslklfu2kjckea object| omtaoi2gud8wo2ip9kbnpv function| fbAsyncInit string| adroll_sid object| __adroll boolean| adroll_optout object| adroll_ext_network object| adroll_callbacks function| adroll_tpc_callback object| __adroll_consent boolean| __adroll_consent_is_gdpr object| $jscomp string| BANNER_VERSION object| __adroll_consent_banner object| s_i_fortinetincproduction function| _bizo_local_logger function| _bizo_fire_partners boolean| _bizo_main_already_called

0 Cookies

9 Console Messages

Source Level URL
Text
console-api warning URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api warning URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[object Object]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
console.groupEnd
console-api warning URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[object Object]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
console.groupEnd

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.mstrlytcs.com
a.optmnstr.com
api.opmnstr.com
assets.adobedtm.com
buttons-config.sharethis.com
c.sharethis.mgr.consensu.org
cm.everesttech.net
count-server.sharethis.com
d.adroll.com
dpm.demdex.net
fortinet.demdex.net
fortinet.tt.omtrdc.net
fortinetinc.sc.omtrdc.net
graph.facebook.com
l.sharethis.com
metrics.fortinet.com
platform-api.sharethis.com
platform-cdn.sharethis.com
px.ads.linkedin.com
s.adroll.com
sjs.bizographics.com
www.fortinet.com
www.google-analytics.com
www.googletagmanager.com
www.linkedin.com
z.opmnstr.com
138.197.13.10
172.82.228.19
172.82.235.45
178.128.135.232
2.16.186.146
2.19.43.118
2.21.36.181
2.21.37.83
23.111.9.217
23.67.137.77
2620:109:c002::6cae:a0a
2620:119:50e2:105::6cae:b35
2a00:1450:4001:81f::200e
2a00:1450:4001:824::2008
2a02:26f0:60:8b8::3adf
2a03:2880:f01c:20e:face:b00c:0:2
3.120.53.177
34.203.158.69
34.247.143.160
34.255.28.155
46.51.181.97
50.19.60.226
52.52.145.59
52.8.142.247
54.76.193.55
66.117.28.86
66.117.29.6
04c7fc62027de4c79f20a877f16b3fe9ecc2c45c647cb632b92f0d442784991c
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e
24038492cb3d19fef34ce0a9bc55033f3030c04eeea97a93c22b2ec8914c1316
26e382d9c4380bd0293c2d41be30b754a01fb09db5d2e5c6b60bbd0368efb2ed
37a2d3ed4482161212f1fbf4706656bcc9b247035a772840ea588e712d6e0270
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
4983cd18419e417077dcc013922828394049ce6c65db6a782d2d73f225d46089
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38
604ae5068c06ac47597ed7e1c587a0ce7d8ff6e8174a979b285169f1b3277016
68588db4f09f1982d74887644c54e581cc6ed7e267f836a480c29ef1a3c0a7a0
696bac8666ce5bf4e390c7f71dc783a17fb56a3b429c6ff35dd5ad52ae254988
6bcf74ea09f3338064e1cf83dc8fc5109613390f5c7d40b0aa2f7f8ee0cc3559
6d73aa32774fb131ebbc1faf3f931aaf66e998f808757cbafbcc737f8d769580
6f43e1e85c42d5e449308701054501d9867a7254c9a8734406afbc89b3dfe5b4
7f0daa7591ef2b42b26dd9d39102440c242e7fd798e7898a620e5489d67ec73e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85c6103aabd94bf4584fbdd8b15cb68c08fa52f43dc229ac034a1bf6c855c0bc
937c3efffd1989c955004ba481f718b9392fc86f82010290bee98d9930058e3d
987cc8d4917c821c783e6d42b5bc88708b736ad5784af2623aea8778d8151961
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a845f8ef9d6435077c09c3a9ec401f17f9d6b58f0f49f6014d2ff7c04d4be73c
a93d1dfea16ac5c30f63a64073fe4f27b936c092ea5bdfd971685b2c36a642e9
af780899477625834ea7cd70915f91c4cc903413e1fd8769a9117d22adcb7865
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b
bf37dba5836581c0cc0451edd5c197e46a5a0e070b3f696e5b4bf7e32da1817a
c001e01a6b6a23f4619521bb9a5cdea66124971ab04cf0211649015b0c4af1b1
c9e784c91038976835b53028e10a3f90e1508036aaba1859a820ffec8c2e9486
caa02d6bc107a0f648a41c4572b8e7fd71278b2e740e4bc809594dd3dc446c8d
ccedb1a72caaadd439c20e9779abcd7a2a0829103dd5a93aeb5ce1f5e3bfd911
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
db48939bec021c7c13015d86307bafa2a2f8b832700fa92806d67bb32112462e
dbeeb3fa5f0188835b6b6208bc89d641f030e79e27ad5712d427eabd79e6095a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5c2f85b9e49be5acd30c8ba3767b124d8945f35000eef89902a0485c04e6040
eb6058ea8eec777d07e89407b55de7990eb296b3f5a5ee4a6b04c71d3c129c42
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2bf5964adbfac80827ae87c5f7c0f05e51f416e3e2132fd93dc2e2d98f2e935