malware.news Open in urlscan Pro
2606:4700:20::ac43:4a41 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Submission: On October 04 via api (October 4th 2024, 9:03:21 am UTC) from IN — Scanned from DE

Summary HTTP 44 Redirects Links 22 Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 6 domains to perform 44 HTTP transactions. The main IP is 2606:4700:20::ac43:4a41, located in United States and belongs to CLOUDFLARENET, US. The main domain is malware.news. The Cisco Umbrella rank of the primary domain is 923402.
TLS certificate: Issued by WE1 on September 8th 2024. Valid for: 3 months.

This is the only time malware.news was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
38	2606:4700:20:... 2606:4700:20::ac43:4a41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:803::2008	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6810:fbef	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c04::9c	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
44	7

38 2606:4700:20::ac43:4a41 (United States)

ASN13335 (CLOUDFLARENET, US)

malware.news	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:fbef (United States)

ASN13335 (CLOUDFLARENET, US)

blog.talosintelligence.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
38	malware.news malware.news — Cisco Umbrella Rank: 923402	2 MB
2	talosintelligence.com blog.talosintelligence.com — Cisco Umbrella Rank: 438496	264 KB
1	google.de www.google.de — Cisco Umbrella Rank: 11271	63 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 136	552 B
1	google.com region1.analytics.google.com — Cisco Umbrella Rank: 4401
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	91 KB
44	6

	Domain	Requested by
38	malware.news	malware.news
2	blog.talosintelligence.com	malware.news
1	www.google.de	malware.news
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	www.googletagmanager.com	malware.news
44	6

This site contains links to these domains. Also see Links.

Domain
asec.ahnlab.com
github.com
www.cynet.com
whitehat.eu
www.cisco.com
meraki.cisco.com
umbrella.cisco.com
signup.umbrella.com
signup.duo.com
www.snort.org
blog.talosintelligence.com
discourse.org

Subject Issuer	Validity	Valid
malware.news WE1	`2024-09-08` - `2024-12-07`	3 months	crt.sh
*.google-analytics.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
talosintelligence.com WE1	`2024-09-24` - `2024-12-23`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
*.google.de WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Frame ID: 904A09C46960D96844B40E1ED00298B3
Requests: 47 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Threat actor believed to be spreading new MedusaLocker variant since 2022 - Malware News - Malware Analysis, News and Indicators

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

44
Requests

100 %
HTTPS

100 %
IPv6

6
Domains

6
Subdomains

7
IPs

3
Countries

2637 kB
Transfer

15115 kB
Size

3
Cookies

22 Outgoing links

These are links going to different origins than the main page.

URL: https://asec.ahnlab.com/en/48940/
Title: ASEC

Search URL Search Domain Scan URL

URL: https://github.com/Kevin-Robertson/Invoke-TheHash
Title: Invoke-TheHash tool

Search URL Search Domain Scan URL

URL: https://www.cynet.com/blog/dynamic-analysis-hazard-ransomware/
Title: Cynet blog post

Search URL Search Domain Scan URL

URL: https://whitehat.eu/medusalocker-ransomware-part-2/
Title: Whitehat

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/security/amp-for-endpoints/index.html
Title: Cisco Secure Endpoint

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/security/amp-for-endpoints/free-trial.html?utm_medium=web-referral?utm_source=cisco&utm_campaign=amp-free-trial&utm_term=pgm-talos-trial&utm_content=amp-free-trial
Title: here.

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/security/web-security-appliance/index.html
Title: Cisco Secure Web Appliance

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/security/email-security/index.html
Title: Cisco Secure Email

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/security/cloud-mailbox-defense?utm_medium=web-referral&utm_source=cisco&utm_campaign=cmd-free-trial-request&utm_term=pgm-talos-trial
Title: here

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/security/firewalls/index.html
Title: Cisco Secure Firewall

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/collateral/security/firepower-ngfw-virtual/datasheet-c78-742858.html
Title: Threat Defense Virtual

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/security/adaptive-security-appliance-asa-software/index.html
Title: Adaptive Security Appliance

Search URL Search Domain Scan URL

URL: https://meraki.cisco.com/products/appliances
Title: Meraki MX

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/security/stealthwatch/index.html
Title: Cisco Secure Network/Cloud Analytics

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/security/threat-grid/index.html
Title: Cisco Secure Malware Analytics

Search URL Search Domain Scan URL

URL: https://umbrella.cisco.com/
Title: Umbrella

Search URL Search Domain Scan URL

URL: https://signup.umbrella.com/?utm_medium=web-referral?utm_source=cisco&utm_campaign=umbrella-free-trial&utm_term=pgm-talos-trial&utm_content=automated-free-trial
Title: here

Search URL Search Domain Scan URL

URL: https://www.cisco.com/c/en/us/products/security/firepower-management-center/index.html
Title: Firewall Management Center

Search URL Search Domain Scan URL

URL: https://signup.duo.com/?utm_source=talos&utm_medium=referral&utm_campaign=duo-free-trial
Title: Cisco Duo

Search URL Search Domain Scan URL

URL: https://www.snort.org/products
Title: Snort.org

Search URL Search Domain Scan URL

URL: https://blog.talosintelligence.com/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/
Title: Threat actor believed to be spreading new MedusaLocker variant since 2022 5

Search URL Search Domain Scan URL

URL: https://discourse.org/powered-by
Title: Powered by Discourse

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

44 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 87047 Show response
malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/ 142 KB
29 KB 341ms
148ms Document
text/html 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb79425c2d4402fbfa7019289419aa9292653c03d202be6d13dd2325688f5ce4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src 'nonce-55GtiQqhc4StzBW029VZhO18r' 'strict-dynamic'; frame-ancestors 'self'; manifest-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store
cf-cache-status: DYNAMIC
cf-ray: 8cd3ff697c305c56-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src 'nonce-55GtiQqhc4StzBW029VZhO18r' 'strict-dynamic'; frame-ancestors 'self'; manifest-src 'self'
content-security-policy-report-only: upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src 'nonce-55GtiQqhc4StzBW029VZhO18r' 'strict-dynamic'; frame-ancestors 'self'; manifest-src 'self'
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 04 Oct 2024 09:03:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2LCtSKo6XUc9OfnIXRgXExI5h5sF3%2F66yKbttxtedTIcLqf4mRKqAeMeHvguRobhxH03oyOP01xKwKUDGIo1mWHRcIV0HHmg8Ocqa6zRvQzHrEHWh3LUF2E90xcqOp0FxRSnBqChOdQobQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding Accept
x-content-type-options: nosniff
x-discourse-cached: true
x-discourse-route: topics/show
x-discourse-trackview: 1
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-request-id: 57b871f0-b5ef-4e89-9ffe-3b30accf3115
x-runtime: 0.003115
x-xss-protection: 0

GET
H2 200 start-discourse-c524a8995f2f0cbcea43353efe8e8f269da821ea97c21ef0f04df5fcd916170a.js Show response
malware.news/assets/ 567 B
700 B 36ms
35ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/start-discourse-c524a8995f2f0cbcea43353efe8e8f269da821ea97c21ef0f04df5fcd916170a.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c524a8995f2f0cbcea43353efe8e8f269da821ea97c21ef0f04df5fcd916170a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 434779
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kWbiZRo%2BsnZbJtwe3Sg9ATuWUP%2FCmuQ8CfKlw%2F3zVm5IdYSPV6VKGvISpvJopQbgsNb0QkUnhiSJ%2Bx7PJyBPq%2Bh11KYoUCLkGX8%2B2m60ypoTyv9JzGfzTE%2FatJUiX2LAullrxGw1N96V6A%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6a7cd65c56-FRA
expires: Sat, 13 Sep 2025 23:56:52 GMT
date: Fri, 04 Oct 2024 09:03:15 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:35:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 browser-update-9070f07226d022f68c06506e046ae33f8fe725302ff53955cd3d483f2fc47ff6.js Show response
malware.news/assets/ 2 KB
1 KB 32ms
31ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/browser-update-9070f07226d022f68c06506e046ae33f8fe725302ff53955cd3d483f2fc47ff6.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9070f07226d022f68c06506e046ae33f8fe725302ff53955cd3d483f2fc47ff6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 343075
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=foetJQDcwIBXf46KlEtTB3hlqj9VsAfG2CtmQ8M57vJWrYZUwdxRObgArMgGwYmixQlEecvzUdtjunnIMw1yytjQxgVlKfVb7P6C%2FcNq1ONvPR0YNO87I%2FNS8UKsduZ85iak6BwF92p3%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6a7cd85c56-FRA
expires: Sun, 09 Mar 2025 04:07:38 GMT
date: Fri, 04 Oct 2024 09:03:15 GMT
content-type: application/javascript
last-modified: Sat, 09 Mar 2024 04:04:58 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 browser-detect-99f42f91bffa8ca1606d62b70bb92f981d83921e78ccdbd3d9538f07007f27ac.js Show response
malware.news/assets/ 497 B
662 B 141ms
138ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/browser-detect-99f42f91bffa8ca1606d62b70bb92f981d83921e78ccdbd3d9538f07007f27ac.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 99f42f91bffa8ca1606d62b70bb92f981d83921e78ccdbd3d9538f07007f27ac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gi09SaFkaDQht3FNp4PR41LRUTVqSFu5E5HkrMIXNnt8Mnik545LP1tQVnEr%2BZMeuQOdxbIJAs6TtGwZxoJGhcJTEHEOU4vAf6hoZrvZKaX7n3yMWLMNRYtt84JvMXSawP8MwPBpufBwlw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6d2e9d5c56-FRA
expires: Sat, 20 Sep 2025 03:22:12 GMT
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:35:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 vendor.ff29780b9fed784cce2d843dcb93a803-608f4f77d8437d715d8d39c739c0c8bbe0fe51c9305e55f1ec7d0bee19f5571f.js Show response
malware.news/assets/ 438 KB
123 KB 60ms
57ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/vendor.ff29780b9fed784cce2d843dcb93a803-608f4f77d8437d715d8d39c739c0c8bbe0fe51c9305e55f1ec7d0bee19f5571f.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 608f4f77d8437d715d8d39c739c0c8bbe0fe51c9305e55f1ec7d0bee19f5571f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 343076
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R6rCJ%2BtpBZhNtO7M0%2FlGUfN5hVpOHSpvyOBQKa7LA0GNFV2yBoVOrqxCaW7MKAFalQLr5YURpT0oXtm4iCepimRrneQpG%2FsNHDplaxkTKD0jL7WU%2BWd%2FomJgfAfyv7w2waZ2Um3XQ2qX%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6d2e9e5c56-FRA
expires: Mon, 19 May 2025 17:21:44 GMT
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:17:10 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 chunk.6d6a6a17194d67289ef4.d41d8cd9.js Show response
malware.news/assets/ 12 MB
2 MB 160ms
158ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/chunk.6d6a6a17194d67289ef4.d41d8cd9.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5566fc85873915364c34914ef9efda42cca8e77faad713da08a9d3d8e8677943

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eIwCU6k4gKLMfxO09P5YSPb6wswaF%2B2F77KB3GQGYOv5yz2miNmq8X63YXp2r8SyCp8yX82fKqrcQM51tzt9R98vXWirID6WuYUJQqjQBHqdPaqJQzj89rvNWkvKBem8PxidBev60BdyoA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6d2e9f5c56-FRA
expires: Mon, 19 May 2025 17:21:38 GMT
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:17:01 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 chunk.d43472f435e6bfab8439.d41d8cd9.js Show response
malware.news/assets/ 305 KB
21 KB 42ms
39ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/chunk.d43472f435e6bfab8439.d41d8cd9.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b5ddfb3a605aeed9ff478a225e8062861424d523836d7256e2b75489bf20cdf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 434780
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dwLiMJbo5TuqeThom1k6PTzdjYgAUBs75vm8dp3iX46Masw3RNe5vJn%2FjIMDykY7WigFV%2BGlFiYgIAc%2FahfTSFtGlllyUvojHa8yuBMsXgUhBYdmjdb3j5Dw%2BWhy6Q3%2BxGlt7UToE7Rnyg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6d2ea05c56-FRA
expires: Mon, 19 May 2025 17:21:38 GMT
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:17:01 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 checklist-55813a5bacc3c99fda0b099a80401f124870fa9b510ced078af32f8a82364461.js Show response
malware.news/assets/plugins/ 4 KB
2 KB 37ms
35ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/checklist-55813a5bacc3c99fda0b099a80401f124870fa9b510ced078af32f8a82364461.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55813a5bacc3c99fda0b099a80401f124870fa9b510ced078af32f8a82364461

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 343076
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T7jVHmmx0CDlsG4BpxWLOl95Ql2HenfnueMRYNpreGABUfQpSTeCA3lx5XXbhg2ncYbDB2gyKVcdvqaTcmOS%2Fst0cczyco84NHKjJ5KrUYjxgWKOIorn328ZdRZqjJIZor86yyrRZQLA7g%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6d2ea15c56-FRA
expires: Mon, 19 May 2025 17:21:38 GMT
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:18:01 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 discourse-details-48148ec534a4c5e9614302186b345123ba1358787c41bc31cbd17231f794fe42.js Show response
malware.news/assets/plugins/ 1 KB
1 KB 48ms
46ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-details-48148ec534a4c5e9614302186b345123ba1358787c41bc31cbd17231f794fe42.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48148ec534a4c5e9614302186b345123ba1358787c41bc31cbd17231f794fe42

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 434780
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fvvs0ffAgOzuUAOG%2Bf5NdNiY82s1DQf64Ouj0G4nz6DvqaQlOswK1KRGHEOBcwyYFtAMEErpLEDB%2BH5hXlSeAZ2Zh%2FuEFHAY2v38RNaDe7RhwkldD%2FSin2rOUnXFU6dRmIOCBBP6CzoLdw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6d2ea35c56-FRA
expires: Mon, 12 May 2025 06:44:11 GMT
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript
last-modified: Sat, 09 Mar 2024 04:05:22 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 discourse-lazy-videos-bdf1486acc96b228a2163490640a2bdc90f5e0a1bb1949335fd1fde2ad48795c.js Show response
malware.news/assets/plugins/ 7 KB
3 KB 43ms
41ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-lazy-videos-bdf1486acc96b228a2163490640a2bdc90f5e0a1bb1949335fd1fde2ad48795c.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bdf1486acc96b228a2163490640a2bdc90f5e0a1bb1949335fd1fde2ad48795c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 343076
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c%2BAAMccd4b8Msf9OcEqQYrhlclD5VuEtm3fWnXgbu87V0Phj3YMGrlhbjloWVUdKuvMgQKBoFlU19Yh7nV1k0C%2F%2F74ru6Vi%2FFRhHAa93vPKMNf2n7NfyTC%2FHmd7s5jgDX4GhGatE4mg4AQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6d2ea45c56-FRA
expires: Fri, 13 Jun 2025 01:09:53 GMT
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:36:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 discourse-local-dates-823b91992054aeb8ca1e4921c7a3ae7f9fae09ef838946f3b261ab5a6ad776ee.js Show response
malware.news/assets/plugins/ 33 KB
9 KB 42ms
40ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-local-dates-823b91992054aeb8ca1e4921c7a3ae7f9fae09ef838946f3b261ab5a6ad776ee.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 823b91992054aeb8ca1e4921c7a3ae7f9fae09ef838946f3b261ab5a6ad776ee

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 56556
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=73DCIqzsrZcG%2B2903oGLDc6Z%2FIq1Io%2FLLQ2YXmCDGZkO7rZn7jPAqjtqPU8iA0O4YZ%2FbceOSxZlNRl2No2u9%2Bza02yVp%2BXEV3fBkaasffUItqS2xWn0SivtfB%2BfK2vK0JNa7JOzF62Gcwg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6d2ea55c56-FRA
expires: Mon, 19 May 2025 17:21:38 GMT
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:18:02 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 discourse-presence-a43bd7b3aa8d60242368b06762baf883047520450269be0bbd5491f6c14661c0.js Show response
malware.news/assets/plugins/ 11 KB
3 KB 52ms
50ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/discourse-presence-a43bd7b3aa8d60242368b06762baf883047520450269be0bbd5491f6c14661c0.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a43bd7b3aa8d60242368b06762baf883047520450269be0bbd5491f6c14661c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 434780
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w5m70IDSGXoEByvo9A%2BA4rdXy1YPc4esyMQAb5Co%2FHlDMV0TEW6xCyb9w0mOzWydqcDv63%2F6prRuvuYma1OrqvEwZp%2FeJI%2B1JuNP2TdAChtnBbBBfELH2ihYjpc8%2BZX1wLCFIgkZzerfcg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6d2ea65c56-FRA
expires: Mon, 19 May 2025 17:21:38 GMT
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:18:02 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 docker_manager_admin-b355b48ea8dc5f9252a78cf0a6b7210b0493676ee421a69a425d092b98c2cc51.js Show response
malware.news/assets/plugins/ 37 KB
8 KB 37ms
35ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/docker_manager_admin-b355b48ea8dc5f9252a78cf0a6b7210b0493676ee421a69a425d092b98c2cc51.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b355b48ea8dc5f9252a78cf0a6b7210b0493676ee421a69a425d092b98c2cc51

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 163594
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mBCT0HwH%2Bzrbzq%2BSRAg9NakcryrxVZiNc9EPOPtG6a%2FxIZxCuHhrfFjuAaOtNUnKPuWzekK2NPrsrPGXLhvYRxW3H4vcWwTCOMoPZkoQnAOuiNRZkf4EPjQVhKVWhCPW8JICw4W5RsnN%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6d2ea75c56-FRA
expires: Mon, 19 May 2025 17:21:38 GMT
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:18:02 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 footnote-79e2a367b53b791240c3504826b87b2787c9d197d77cd422969d592aae9cf23b.js Show response
malware.news/assets/plugins/ 3 KB
1 KB 69ms
68ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/footnote-79e2a367b53b791240c3504826b87b2787c9d197d77cd422969d592aae9cf23b.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 79e2a367b53b791240c3504826b87b2787c9d197d77cd422969d592aae9cf23b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 343076
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LMqNWd56wKM6EKnPXw31X9sQg0XxaAoM0sEYDmW%2FaL%2BXo9x0fAoissYzV2p4X9sPHsT6qfDir8grH2M0Je80Ua0qiIiZlEByGq0pV79JaW7qhlELVWELKKsI5aHV64U%2BtrHBbtd6oYEw%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6d4eb85c56-FRA
expires: Mon, 19 May 2025 17:21:38 GMT
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:18:02 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 footnote_extra-295b457b90cb18fedfdb544868c494c71842a27c0781d3042fa4fd26589204fa.js Show response
malware.news/assets/plugins/ 6 KB
3 KB 69ms
67ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/footnote_extra-295b457b90cb18fedfdb544868c494c71842a27c0781d3042fa4fd26589204fa.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d42ebdcddd972fdff22dca8398998a80ce50b0ec08915e8e8b9682a941b8651

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 343076
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xCRDUgN4e2e%2BvkPNbfaqII%2Bq57g1FzZpu6t%2BUMllZoB5NUzNLe6C1sHl1wNEiYDaqWpljYrjXZKO9dZr3vp20HERzQwyUDZsI4%2B8OKmoQNquavhhMb0QI33pDetX%2BaXRDVhr998x3L6VEw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6d4eba5c56-FRA
expires: Mon, 12 May 2025 01:37:00 GMT
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript
last-modified: Sat, 09 Mar 2024 04:05:57 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 poll-ee978b42838e26d757251675c40fb0f62dff2f4081dc00fc4bb5492265f63b16.js Show response
malware.news/assets/plugins/ 62 KB
17 KB 67ms
66ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/poll-ee978b42838e26d757251675c40fb0f62dff2f4081dc00fc4bb5492265f63b16.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ee978b42838e26d757251675c40fb0f62dff2f4081dc00fc4bb5492265f63b16

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 434780
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VCJa7f2wsuxoUI%2BYmHC8s2%2FnM%2BPNTf3Ae3s5R8mFa6yLH8WYuLCfdmiOCJUfD4oaKRvMn7n4mHq4SL7DKLeGVIzjLlLiZpmF1iC3FNbRP3sVAdfvrPQwSRP3fiYSsGLSpU9Pt1YSP6WO9w%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6d4ebb5c56-FRA
expires: Mon, 19 May 2025 17:21:39 GMT
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:18:03 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 spoiler-alert-77512c36f465902e7dbf3b8252c7cd6387edc9bf4ca804b79466212c1d1c843d.js Show response
malware.news/assets/plugins/ 3 KB
2 KB 70ms
69ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/plugins/spoiler-alert-77512c36f465902e7dbf3b8252c7cd6387edc9bf4ca804b79466212c1d1c843d.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 77512c36f465902e7dbf3b8252c7cd6387edc9bf4ca804b79466212c1d1c843d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 56556
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JwPSwAI9dErqqXXNmnt80TXJKv%2F%2BU4j9%2FxJ1i2k1tM8%2FCUVcXifc6%2BrXRRS4m83Yw5mlKI8CgkSUuXz%2BhpSnISUb04ZKZlb8vVO1k4sc%2F5JfMoFff5QuGDpzjz8HqnursaDHBTnOnQ%2BnpQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6d4ebc5c56-FRA
expires: Tue, 29 Apr 2025 17:27:28 GMT
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript
last-modified: Sat, 09 Mar 2024 04:05:23 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 en-666fe268c5c09740e19778d3756be4ffa4bfa22642e83a31cc7ee39923049ac7.js Show response
malware.news/assets/locales/ 348 KB
95 KB 68ms
67ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/locales/en-666fe268c5c09740e19778d3756be4ffa4bfa22642e83a31cc7ee39923049ac7.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5ee33f26479a267cb93b664a5c2ff07e4f835e022e2fdbc5c8c23564b0dc292

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 343076
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5DMfX1wwKpwKDqXa%2BmCJFlv5xxStxOeiJKTGVb4mMNYgsg1O79PEt9VXL27jKThQn%2Fh7%2FZ53gquWGyOZu1rOHU02aZVfl9SiT4RovluRQ34hwlCxtcC9W0gWF%2FD7rMp5Vuz2K8inLIdU5g%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6d4ebd5c56-FRA
expires: Mon, 19 May 2025 17:40:56 GMT
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript
last-modified: Sun, 19 May 2024 17:36:59 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 259 KB
91 KB 150ms
49ms Script
application/javascript 2a00:1450:4001:803::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-SVDG4GL741

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9476bfd69d5ffe8ddfb54680001fead2cec0ffde7b274b555e5deeea1f487405

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 04 Oct 2024 09:03:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 92956
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 google-universal-analytics-v4-e154af4adb3c483a3aba7f9a7229b8881cdc5cf369290923d965a2ad30163ae8.js Show response
malware.news/assets/ 533 B
661 B 69ms
68ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/assets/google-universal-analytics-v4-e154af4adb3c483a3aba7f9a7229b8881cdc5cf369290923d965a2ad30163ae8.js
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e154af4adb3c483a3aba7f9a7229b8881cdc5cf369290923d965a2ad30163ae8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 344443
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b8LateoXZnqdZ8q7KdUFVQ8P%2F93Icf5dHszNyxQjHTbDUu9UfEONBfrxf8KEAfZdY57w6YDfnnq82Xu53eH5kiyMMKaqJdksPDojgv2L1TQ9RQ7LoWddsE%2FdUE7WGmryW6KVdnIDN0qe2A%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff6d4ebe5c56-FRA
expires: Tue, 29 Apr 2025 14:41:33 GMT
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript
last-modified: Sat, 09 Mar 2024 04:04:58 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 color_definitions_base__2_4a8c937dd96730817e3ecfdfc23b856bce1e757d.css
malware.news/stylesheets/ 4 KB
2 KB 36ms
33ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/color_definitions_base__2_4a8c937dd96730817e3ecfdfc23b856bce1e757d.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4e134f40c8c4baad557dbe3eb6869d8cf4a66462084170b4881a2aff6eca274

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

x-request-id: ec55d492-ec82-4a17-9160-650e9eb115b8
content-encoding: gzip
cf-cache-status: HIT
age: 343075
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k3lHKMpPFyMOgHpdzNaD0RLkqBhgGCmftjKnCa%2BRuW0mIVFKWe0WHGhCDlFzStn%2FAf5cBkS2tFL3h%2B4reXHPEfTHbD%2BJnfgwvDhvF57fQNWizgj%2BIzKKl70es5gNW25vDJgZPULE6%2Fb%2B%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Fri, 04 Oct 2024 09:03:15 GMT
content-disposition: inline; filename="color_definitions_base__2_4a8c937dd96730817e3ecfdfc23b856bce1e757d.css"; filename*=UTF-8''color_definitions_base__2_4a8c937dd96730817e3ecfdfc23b856bce1e757d.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:16 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8cd3ff6a7cde5c56-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 desktop_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 661 KB
103 KB 38ms
35ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/desktop_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2fe258a6b3a482ce904aaa4d71aa8b276ac2d66289e56515adaa373ce73e6173

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

x-request-id: d5e0fb08-e9f8-4b92-9a16-00ade4ca5c82
content-encoding: gzip
cf-cache-status: HIT
age: 343075
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lz2qG8v%2B1uIp7bZK%2FV9hI5Oy7RfDhJz9eXrbf2ST8M62DRYcEiyalmrbnISsYxZXC%2B8DYsdWputDWiS7vBGpheEZWg1VHw6Ai890xL%2FwvLUhiPLrt2dsW0DdyyEvhVHaP4c5I%2F5iUy7cdg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Fri, 04 Oct 2024 09:03:15 GMT
content-disposition: inline; filename="desktop_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''desktop_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:10 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8cd3ff6a7ce05c56-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 checklist_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 5 KB
2 KB 141ms
138ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/checklist_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0fbc7f61c0620a4ec824cc106951eff46d60cfd8eb8d8d490218463d2fd98cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

x-request-id: 1a993d85-260b-47f0-9546-228b39271db1
content-encoding: gzip
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0P4tlZxNgB3hUJmGumbPBJf4FntrSQpPKlJcE%2Fy8Qa5chzOFCuWhhr7V%2BQPJmLCrBKltQzWCgwWZFhrUq0it1cYQ%2FkY1uj5nAQ5yUuj4uwD4EKig2rg5NlhXcs%2FUsT7wjTszoVrgjCYTuA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Fri, 04 Oct 2024 09:03:15 GMT
content-disposition: inline; filename="checklist_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''checklist_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:14 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8cd3ff6a7ce35c56-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-details_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 3 KB
1 KB 59ms
56ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-details_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0998f98bd48342f12e7081dc237e6982e151d5f03cda0cf111da67e615b8ce9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

x-request-id: 1534ccd9-ef9e-455b-8259-e75df474fb94
content-encoding: gzip
cf-cache-status: HIT
age: 343075
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yKWktOT3fSN1KbC%2BeRAaTYkfyEUcBnGygN%2FBO4wq%2BhVlpKLKukmmub%2FBgi%2BcKMHw0xH0ymSLpAZIkvTdp%2FQMSjVggTO%2B%2BxMVIs3PRf60run%2FJcUGcQDl1ewaq0FeCeQ2T1bOXkKGaxPKXA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Fri, 04 Oct 2024 09:03:15 GMT
content-disposition: inline; filename="discourse-details_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''discourse-details_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:14 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8cd3ff6a7ce55c56-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-lazy-videos_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 7 KB
4 KB 57ms
55ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-lazy-videos_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

152760f614cc53fb6dd1c362d06c281a719e37ce1dec3636ffb90f33e2bb6131

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

x-request-id: f1c5df15-0a88-4aab-bd13-b20596d0831c
content-encoding: gzip
cf-cache-status: HIT
age: 163593
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k2kgewiKyyIrA%2BQ%2FUj47%2F9WajhJ25Dj%2BzdvnrlXk79cSTpsoPAxXNwVq0Va41VOCj%2FOvxWaNjF1KaPSVSmU83eU%2Fk03Sir1NZTRBYNHYXusuqWuVkiesmhDejKVeskUOt9X7u6G8dGN5nw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Fri, 04 Oct 2024 09:03:15 GMT
content-disposition: inline; filename="discourse-lazy-videos_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''discourse-lazy-videos_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:14 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8cd3ff6a7ce65c56-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-local-dates_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 875 B
912 B 58ms
55ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-local-dates_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2b15f24ee32ae108d07a11757c4e120fb2c0384f3a842952432da1736158ce7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

x-request-id: fdb288da-5f3e-4e2b-ac1b-dee5aee94f6d
content-encoding: gzip
cf-cache-status: HIT
age: 56555
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FcQ4mimq1ilQfuQX2Ytbn92rhE%2BOAwIab8NvoeVQbDvS6AKjl3COy8Z6VP2Y7RCG54cXb9kNh7rLsdlu7ytFXqDbZQAXfK3UJ2VGFjYeFztSzXBfoNUdJc9C4VjjxCWhyWMf9YxIO602FA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Fri, 04 Oct 2024 09:03:15 GMT
content-disposition: inline; filename="discourse-local-dates_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''discourse-local-dates_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:15 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8cd3ff6a7ce85c56-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-narrative-bot_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 171 B
624 B 58ms
56ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-narrative-bot_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c3dcd0afcea9a61171dd74c218ce2ba9bb686ae0e68c967ae4e75c8fdeb8687

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

x-request-id: 1569a4d0-d527-4f26-88b2-4831c34dbba7
content-encoding: gzip
cf-cache-status: HIT
age: 434779
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d3rINJBHdWd7XSFdKeEst6FF%2FRhMSl%2BRLKgb67aubAs0BhipaCS0V5ofoLRZyAAGsfqJtlGy3jLCuqESzaAifDxkUprv8i1URWXgGSPaCPF7Rdtqm29%2BKD6Z3oTzem%2BxAw5PwuUZOXLfIA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Fri, 04 Oct 2024 09:03:15 GMT
content-disposition: inline; filename="discourse-narrative-bot_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''discourse-narrative-bot_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:15 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8cd3ff6a7ce95c56-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 discourse-presence_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 1 KB
1 KB 143ms
141ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/discourse-presence_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a39db0af2b877ea2c5cccbc1420ef9533196f61a33e740d8ec2bb31126470856

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

x-request-id: 180573a8-0fd7-428c-88aa-a4821fca2709
content-encoding: gzip
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J8OjC4%2B62TYM1urRjEbgluIhSRk9VUuLa3QcIGUT%2FaxK3lmrBkTFhuMSIF05nA%2Fna91C0kz0mBwLr9R4DU2vShWysKTFp%2FOom46rdAIimjUXV6yBx%2B27dUjpoQ9fGTatYgaj19580YBRYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Fri, 04 Oct 2024 09:03:15 GMT
content-disposition: inline; filename="discourse-presence_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''discourse-presence_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:15 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8cd3ff6a7cea5c56-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 docker_manager_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 2 KB
2 KB 59ms
57ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/docker_manager_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb79726d8b50ade37e5ca0c5c82fc92eea9757c2e14e5f7feca1b80f7732048e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

x-request-id: 8e046a15-4c38-45b5-b003-5981d94f7bef
content-encoding: gzip
cf-cache-status: HIT
age: 343074
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v8ugfTP39y0vx5H43zd%2BFK8VSZ1ZL22Mp7o%2F30%2BW4gAvv%2BSHqGlHuYp4iC%2BwmWxB3IjUG4hsJLsx4%2F%2FqkVFg1ThiOuVjEhubwGKPp1ohu7XNPTbE%2B0PK3%2Fr4tx0CA49IHjEd8u5wIodwsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Fri, 04 Oct 2024 09:03:15 GMT
content-disposition: inline; filename="docker_manager_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''docker_manager_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:15 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8cd3ff6a9cfc5c56-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 footnote_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 2 KB
1 KB 60ms
58ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/footnote_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b795edfb1b2de13aba43932708e4148b0aa37971047c94fcded06dbe5a4f61ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

x-request-id: 0a14e6ff-3c2f-40eb-ac99-ff981b6824ea
content-encoding: gzip
cf-cache-status: HIT
age: 343075
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vIVDwExQqInvamAwAOpJRlDm1Lz4uFpspJTzU9feNFRGfM4HC8cQN2CqBd6LwOOW5Xli0jNGyd%2BaQw3SGC9e7i9FkzafihISCuBrb1IJq9xkpdFHjA%2BuWOnBy69P1ACul22I144mtrnMzQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Fri, 04 Oct 2024 09:03:15 GMT
content-disposition: inline; filename="footnote_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''footnote_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:15 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8cd3ff6a9cfe5c56-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 poll_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 10 KB
3 KB 59ms
57ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/poll_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ae4f4ee6f5299f646a880259e857f469f41fc0ae30cc568c94e81901dad49cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

x-request-id: 1d474f2c-3dc1-441e-8712-b226c908560a
content-encoding: gzip
cf-cache-status: HIT
age: 343074
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0EdHU%2BICMLP5IyzThcsB%2B8qa3AXAcqcqSyOknd5rBjTyc8P3ShNgQX%2FTmFocUCBn2jA%2FBYcXq0vvhbbALgDwlSc4smBoYIJICHBf7AQUVd86OwOtRWrJAVHfn7dNTYB5Hqx1xjziz3kS1w%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Fri, 04 Oct 2024 09:03:15 GMT
content-disposition: inline; filename="poll_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''poll_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:15 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8cd3ff6a9cff5c56-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 spoiler-alert_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 1 KB
1 KB 61ms
60ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/spoiler-alert_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1f1ad194fec669a7a9d1643b2e5aa0fc0d4c3566c0652e741f9b7667e687185d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

x-request-id: 1025a72b-c694-435b-ae6b-a3817b13fb2e
content-encoding: gzip
cf-cache-status: HIT
age: 434779
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vLbH3XYYuo3T6xoAZJnC6D9IXX5F97%2FQTwVJKbFM909bVjAmUSGeHwZnCAYrvnkDAwvnwGKtj3%2BvF40afSENTOQHadTuU%2F9caUTAc9McSWxbpGaa1hHDnSYPUnORQs3l6pc9i3rN%2Fw6l8A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Fri, 04 Oct 2024 09:03:15 GMT
content-disposition: inline; filename="spoiler-alert_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''spoiler-alert_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:15 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8cd3ff6a9d015c56-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 poll_desktop_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
malware.news/stylesheets/ 611 B
840 B 58ms
57ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/poll_desktop_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25f16c6ec5664d0694edfe491fb383a433ece0ea25917cf656e87d3867d5dd5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

x-request-id: 6fe1b42b-501f-4ea8-a40f-423db8c4ee7f
content-encoding: gzip
cf-cache-status: HIT
age: 56555
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2gYorLaIa4Q%2B2HmA4xCkYNeh2YIdy8%2FQaPLP85c4Mth%2FGwgPV2Mxwzligb6CEH7bV7akbgXUNliRAc1fYjZc59GXAhnLn7TFgJTFGGe30%2FcFEx1GKI2iIEgYSJNHvki8ON6tnR33aCc8Kg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Fri, 04 Oct 2024 09:03:15 GMT
content-disposition: inline; filename="poll_desktop_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css"; filename*=UTF-8''poll_desktop_2867f57e66c2a9b74ab08f80de95e5a0436372fb.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:15 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8cd3ff6a9d025c56-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 desktop_theme_2_a38326017212e35af640b7285f440cd9f26f6eaa.css
malware.news/stylesheets/ 108 B
587 B 59ms
58ms Stylesheet
text/css 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/stylesheets/desktop_theme_2_a38326017212e35af640b7285f440cd9f26f6eaa.css?__ws=malware.news

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b01475a1ed788124386bf51068464a0ea886a403c1b1e51e8a2cde722894a2c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

x-request-id: 2623e9a5-df6b-4bf4-ba65-70c12a647b5f
content-encoding: gzip
cf-cache-status: HIT
age: 343075
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Vj4cNu4E%2BEEQeZbbMAVBZQYw%2Ft6m03hrI%2FykooSDdFLF2KCp0bikG8f7srr30F4m8Y7Yum7ONms48lJY02GaP4V6rjg%2FPp%2BXMwQHUSNSDQajsQoKcXnaVEj4yND3od4NMpEggq%2Bo0%2FyMA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Fri, 04 Oct 2024 09:03:15 GMT
content-disposition: inline; filename="desktop_theme_2_a38326017212e35af640b7285f440cd9f26f6eaa.css"; filename*=UTF-8''desktop_theme_2_a38326017212e35af640b7285f440cd9f26f6eaa.css
content-type: text/css
vary: Accept-Encoding
last-modified: Sun, 19 May 2024 17:37:16 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8cd3ff6a9d035c56-FRA
x-discourse-route: stylesheets/show
x-xss-protection: 0
server: cloudflare

GET
DATA 200
OK truncated
/ 42 B
42 B Image
image/svg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a0389bf2491388d6184b975a3a130c29fc1a9af8f29a4c9a3d0536a3da88e0f3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 svg-2-c1066beb12cc75cc4c3bc42f218f381c862e7905.js Show response
malware.news/svg-sprite/malware.news/ 143 KB
48 KB 33ms
32ms Script
application/javascript 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/svg-sprite/malware.news/svg-2-c1066beb12cc75cc4c3bc42f218f381c862e7905.js

Requested by

Host: malware.news
URL: https://malware.news/assets/chunk.6d6a6a17194d67289ef4.d41d8cd9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ce1934be1fa8520dcc9442317e483c1fc52cc241cc48c096c0d188cd327ae04

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

x-request-id: a1b55771-44c0-4a8f-aedb-1d6a2d2d6638
content-encoding: gzip
cf-cache-status: HIT
age: 434779
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VVJTTL0WE37EyC7yE1Ywx2dGGrP%2FUEiYM0sqJwSMjSCortUcUgoXxx2sIqQ8U9DVUdF3VWaPrbMdnvSIFSMmz6OGzQ2mpIgd1HxMUGbB%2BJJn35JKKX4s8s1LYzOnzGulbEkBaOCOeEk4IA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding, Accept
last-modified: Mon, 19 May 2014 17:24:04 GMT
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-opener-policy: same-origin-allow-popups
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8cd3ff717a2f5c56-FRA
x-discourse-route: svg_sprite/show
x-xss-protection: 0
server: cloudflare

GET
H2 200 ba8ee0a927a69022c651441ac23d01bcdbc09785.png
malware.news/uploads/default/original/3X/b/a/ 9 KB
9 KB 31ms
31ms Image
image/png 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://malware.news/uploads/default/original/3X/b/a/ba8ee0a927a69022c651441ac23d01bcdbc09785.png
Requested by: Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 041dc75fa9294876d29e6d78e76c9f7f3202f1763480da93d6ce2414d0a095c3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: HIT
age: 297244
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f4rMk3nhHgtksdBoaNu6EGWfq48rkvYKdkXsS%2Bd9%2BAt%2BVx7UI2OwDYmKC0MkSTgUHk9GAJiMqo4SBRGySOfaOxQIy3rJ9x0EuDzJM6NCiaHxGZdNCy6%2FZ4UW%2F0ai6GWGZNkEBZdAos8QGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff729b235c56-FRA
expires: Wed, 03 Sep 2025 05:48:43 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8758
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: image/png
last-modified: Sat, 22 Dec 2018 04:38:37 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 24_2.png
malware.news/user_avatar/malware.news/malbot/48/ 3 KB
3 KB 35ms
34ms Image
image/jpeg 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://malware.news/user_avatar/malware.news/malbot/48/24_2.png

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

acb53c4533765bc5dc1225c4850964ddb2ed637a7a1cf420c446a08104085da8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cf-bgj: h2pri
cf-cache-status: HIT
age: 56555
x-permitted-cross-domain-policies: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TRqg%2FZRR53D8bQjh05NJ8GEVpeEU6Qps1ODwB34ZksUH1CFIaSv97T3dTiC4p3aMt9oWZVYlrzv6wiXUs0Fsl3u187FiiMsIYjUnIKCwHdYrN%2Fxd2c46le5OubuaY5qs45%2BMOGXJSV9dfQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
date: Fri, 04 Oct 2024 09:03:16 GMT
content-type: image/jpeg
last-modified: Sat, 09 Mar 2024 04:15:49 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cache-control: public, max-age=31556952, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8cd3ff730b655c56-FRA
accept-ranges: bytes
content-length: 2626
x-discourse-route: user_avatars/show
x-xss-protection: 0
server: cloudflare

GET
H3 200 medusa-header.jpg
blog.talosintelligence.com/content/images/2024/10/ 99 KB
100 KB 120ms
46ms Image
image/jpeg 2606:4700::6810:fbef
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.talosintelligence.com/content/images/2024/10/medusa-header.jpg

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:fbef , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb98b89074394943e10203a176acac2affc406c5057c94b3d72b90e2668337e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

ghost-age: 0
x-request-id: 45e4acfd-79be-4423-8fae-5ab21332833e
cf-bgj: imgq:100,h2pri
etag: W/"18bf5-19251819e97"
age: 82906
ghost-fastly: true
ghost-cache: MISS
cf-cache-status: HIT
x-content-type-options: nosniff
expires: Sat, 04 Oct 2025 09:03:17 GMT
status: 200 OK
cf-polished: status=not_needed
x-cache: MISS, MISS, MISS
date: Fri, 04 Oct 2024 09:03:17 GMT
content-type: image/jpeg
last-modified: Thu, 03 Oct 2024 08:31:42 GMT
x-cache-hits: 0, 0, 0
x-served-by: cache-ams2100139-AMS, cache-ams21027-AMS, cache-iad-kiad7000024-IAD
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
cache-control: public, max-age=31536000
x-timer: S1727944303.400953,VS0,VE142
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8cd3ff737dcf36de-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 101365
server: cloudflare

GET
H3 200 AD_4nXdEPaSCke7t03Zfq1cquRARJbADIHMEaRB1tC-jvWWR1bGtLnK9yfGVn_w7U-Ov3ojqO0_DWutwItfZekGJ6BgRpqqAn7iRQCsuRMFhDgHI9KOFMMw0S9d85jLBtZZQfl3N8uUuKZ6mSGkXkToccZXeanFx.png
blog.talosintelligence.com/content/images/2024/10/ 164 KB
165 KB 185ms
109ms Image
image/webp 2606:4700::6810:fbef
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.talosintelligence.com/content/images/2024/10/AD_4nXdEPaSCke7t03Zfq1cquRARJbADIHMEaRB1tC-jvWWR1bGtLnK9yfGVn_w7U-Ov3ojqO0_DWutwItfZekGJ6BgRpqqAn7iRQCsuRMFhDgHI9KOFMMw0S9d85jLBtZZQfl3N8uUuKZ6mSGkXkToccZXeanFx.png

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:fbef , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae6114d5cc24a9ce77644e4b8164d32af201551e051fbf8f32f3aa0ebd169b5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

ghost-age: 0
x-request-id: d10c0297-540c-4c10-84c7-99b4da9a6c0a
cf-bgj: imgq:100,h2pri
etag: W/"49c48-1925176edf8"
age: 5
ghost-fastly: true
ghost-cache: MISS
cf-cache-status: HIT
x-content-type-options: nosniff
expires: Sat, 04 Oct 2025 09:03:17 GMT
status: 200 OK
cf-polished: origFmt=png, origSize=302152
x-cache: MISS, MISS, HIT
date: Fri, 04 Oct 2024 09:03:17 GMT
content-type: image/webp
content-disposition: inline; filename="AD_4nXdEPaSCke7t03Zfq1cquRARJbADIHMEaRB1tC-jvWWR1bGtLnK9yfGVn_w7U-Ov3ojqO0_DWutwItfZekGJ6BgRpqqAn7iRQCsuRMFhDgHI9KOFMMw0S9d85jLBtZZQfl3N8uUuKZ6mSGkXkToccZXeanFx.webp"
vary: Accept
last-modified: Thu, 03 Oct 2024 08:20:01 GMT
x-served-by: cache-ams2100138-AMS, cache-ams2100138-AMS, cache-iad-kiad7000090-IAD
x-cache-hits: 0, 0, 0
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=31536000
x-timer: S1727968646.080020,VS0,VE1
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
cf-ray: 8cd3ff737dd236de-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 167694
server: cloudflare

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 129ms
30ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-SVDG4GL741&gtm=45je4a20v9121104881za200&_p=1728032596618&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101403290~101533421~101671035~101747727&cid=1572051873.1728032597&ecid=1923161703&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&dl=%2Ft%2Fthreat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022%2F87047&dt=Threat%20actor%20believed%20to%20be%20spreading%20new%20MedusaLocker%20variant%20since%202022%20-%20Malware%20News%20-%20Malware%20Analysis%2C%20News%20and%20Indicators&sid=1728032597&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&ep.autoLinkConfig=%5Bobject%20Object%5D&tfd=2026
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SVDG4GL741
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://malware.news
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 04 Oct 2024 09:03:17 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
552 B 126ms
30ms Ping
text/plain 2a00:1450:400c:c04::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-SVDG4GL741&cid=1572051873.1728032597&gtm=45je4a20v9121104881za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101403290~101533421~101671035~101747727
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SVDG4GL741
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c04::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://malware.news
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 04 Oct 2024 09:03:17 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 145ms
51ms Image
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-SVDG4GL741&cid=1572051873.1728032597&gtm=45je4a20v9121104881za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101403290~101533421~101671035~101747727&tag_exp=101403290~101533421~101671035~101747727&z=1203977425

Requested by

Host: malware.news
URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 04 Oct 2024 09:03:17 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1ad09817976c24d9eab6f4fc788740fc5db93bda522227a4f18f324bb38adf11

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 a0086c91da850eb004fb4af82117ab347b9e272a_2_32x32.png
malware.news/uploads/default/optimized/3X/a/0/ 2 KB
2 KB 33ms
33ms Other
image/png 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://malware.news/uploads/default/optimized/3X/a/0/a0086c91da850eb004fb4af82117ab347b9e272a_2_32x32.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7afa12ce5701916349284e884f7fddcf56832f30d041982b6f9a484b64084f5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047

Response headers

cache-control: max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: HIT
age: 342205
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SlmzAZHEyCVsQ9To0WWf6CZTBUhqMmH07vmSKoFsEvYv3IvWeEGokdMsKseJnTlw3wE57tSJgoQogLoQGjeo%2FWGbtujX%2BK3YE2OPiis6a0Gu%2BLhlWa1wzTBDDtc37bhs%2BT7ff5Np0%2FmhfQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cd3ff75ddaf5c56-FRA
expires: Sun, 09 Mar 2025 04:07:40 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1851
date: Fri, 04 Oct 2024 09:03:17 GMT
content-type: image/png
last-modified: Sat, 01 Jun 2019 22:43:41 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 200 poll
malware.news/message-bus/8090bac0a44e46d6afa7a4130626e3e6/ 267 B
0 137ms
135ms XHR
text/plain 2606:4700:20::ac43:4a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://malware.news/message-bus/8090bac0a44e46d6afa7a4130626e3e6/poll

Requested by

Host: malware.news
URL: https://malware.news/assets/chunk.6d6a6a17194d67289ef4.d41d8cd9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Discourse-Deferred-Track-View: true
X-CSRF-Token: undefined
Referer: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047
X-SILENCE-LOGGER: true
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: text/plain, */*; q=0.01
Discourse-Present: true
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-max-age: 7200
content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o0unKa2rGdEKmMejVVh2PFCKUnD%2F6eZbB4exLhIm1SS%2B1QWPbYRGimK4AkriHmRTammhZQYp1PDB9dmSz%2BUlRVoqWNEd31K59Cg%2BwYU3s%2Fi6gTuVb6qkyBaTsUwvewbB2mE3PfORAUK0OA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET, POST
x-content-type-options: nosniff
expires: 0
date: Fri, 04 Oct 2024 09:03:17 GMT
content-type: text/plain; charset=utf-8
access-control-allow-headers: X-SILENCE-LOGGER, X-Shared-Session-Key, Dont-Chunk, Discourse-Present, Discourse-Deferred-Track-View
cache-control: must-revalidate, private, max-age=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 8cd3ff77aee95c56-FRA
access-control-allow-origin: https://malware.news
server: cloudflare

Verdicts & Comments Add Verdict or Comment

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.talosintelligence.com/	1970-01-21 00:00:34	Name: __cf_bm Value: eTXV4lNSpgQS58qiJ9As5JaHJl5g01mECA4f64fcNw8-1728032597-1.0.1.1-NXagtUzfZZd_PirEK2NfIlK4XYCli4r2lKhFiUbbor55.CZPK2TWB1qfclPZTTD0YPrrOEhuUK2xNeTHBQL4bg
.malware.news/	1970-01-21 09:36:32	Name: _ga_SVDG4GL741 Value: GS1.1.1728032597.1.0.1728032597.60.0.1923161703
.malware.news/	1970-01-21 09:36:32	Name: _ga Value: GA1.1.1572051873.1728032597

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047 Message: The Content Security Policy directive 'upgrade-insecure-requests' is ignored when delivered in a report-only policy.
recommendation	verbose	URL: https://malware.news/t/threat-actor-believed-to-be-spreading-new-medusalocker-variant-since-2022/87047 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src 'nonce-55GtiQqhc4StzBW029VZhO18r' 'strict-dynamic'; frame-ancestors 'self'; manifest-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blog.talosintelligence.com
malware.news
region1.analytics.google.com
stats.g.doubleclick.net
www.google.de
www.googletagmanager.com
2001:4860:4802:34::36
2606:4700:20::ac43:4a41
2606:4700::6810:fbef
2a00:1450:4001:803::2008
2a00:1450:4001:82a::2003
2a00:1450:400c:c04::9c
041dc75fa9294876d29e6d78e76c9f7f3202f1763480da93d6ce2414d0a095c3
0998f98bd48342f12e7081dc237e6982e151d5f03cda0cf111da67e615b8ce9a
0b5ddfb3a605aeed9ff478a225e8062861424d523836d7256e2b75489bf20cdf
152760f614cc53fb6dd1c362d06c281a719e37ce1dec3636ffb90f33e2bb6131
1ad09817976c24d9eab6f4fc788740fc5db93bda522227a4f18f324bb38adf11
1c3dcd0afcea9a61171dd74c218ce2ba9bb686ae0e68c967ae4e75c8fdeb8687
1f1ad194fec669a7a9d1643b2e5aa0fc0d4c3566c0652e741f9b7667e687185d
25f16c6ec5664d0694edfe491fb383a433ece0ea25917cf656e87d3867d5dd5d
2fe258a6b3a482ce904aaa4d71aa8b276ac2d66289e56515adaa373ce73e6173
48148ec534a4c5e9614302186b345123ba1358787c41bc31cbd17231f794fe42
4ae4f4ee6f5299f646a880259e857f469f41fc0ae30cc568c94e81901dad49cd
5566fc85873915364c34914ef9efda42cca8e77faad713da08a9d3d8e8677943
55813a5bacc3c99fda0b099a80401f124870fa9b510ced078af32f8a82364461
5d42ebdcddd972fdff22dca8398998a80ce50b0ec08915e8e8b9682a941b8651
608f4f77d8437d715d8d39c739c0c8bbe0fe51c9305e55f1ec7d0bee19f5571f
77512c36f465902e7dbf3b8252c7cd6387edc9bf4ca804b79466212c1d1c843d
79e2a367b53b791240c3504826b87b2787c9d197d77cd422969d592aae9cf23b
823b91992054aeb8ca1e4921c7a3ae7f9fae09ef838946f3b261ab5a6ad776ee
8ce1934be1fa8520dcc9442317e483c1fc52cc241cc48c096c0d188cd327ae04
9070f07226d022f68c06506e046ae33f8fe725302ff53955cd3d483f2fc47ff6
9476bfd69d5ffe8ddfb54680001fead2cec0ffde7b274b555e5deeea1f487405
99f42f91bffa8ca1606d62b70bb92f981d83921e78ccdbd3d9538f07007f27ac
a0389bf2491388d6184b975a3a130c29fc1a9af8f29a4c9a3d0536a3da88e0f3
a2b15f24ee32ae108d07a11757c4e120fb2c0384f3a842952432da1736158ce7
a39db0af2b877ea2c5cccbc1420ef9533196f61a33e740d8ec2bb31126470856
a43bd7b3aa8d60242368b06762baf883047520450269be0bbd5491f6c14661c0
acb53c4533765bc5dc1225c4850964ddb2ed637a7a1cf420c446a08104085da8
ae6114d5cc24a9ce77644e4b8164d32af201551e051fbf8f32f3aa0ebd169b5d
b01475a1ed788124386bf51068464a0ea886a403c1b1e51e8a2cde722894a2c1
b355b48ea8dc5f9252a78cf0a6b7210b0493676ee421a69a425d092b98c2cc51
b795edfb1b2de13aba43932708e4148b0aa37971047c94fcded06dbe5a4f61ac
bdf1486acc96b228a2163490640a2bdc90f5e0a1bb1949335fd1fde2ad48795c
c4e134f40c8c4baad557dbe3eb6869d8cf4a66462084170b4881a2aff6eca274
c524a8995f2f0cbcea43353efe8e8f269da821ea97c21ef0f04df5fcd916170a
c5ee33f26479a267cb93b664a5c2ff07e4f835e022e2fdbc5c8c23564b0dc292
c7afa12ce5701916349284e884f7fddcf56832f30d041982b6f9a484b64084f5
cb79726d8b50ade37e5ca0c5c82fc92eea9757c2e14e5f7feca1b80f7732048e
cb98b89074394943e10203a176acac2affc406c5057c94b3d72b90e2668337e8
e154af4adb3c483a3aba7f9a7229b8881cdc5cf369290923d965a2ad30163ae8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee978b42838e26d757251675c40fb0f62dff2f4081dc00fc4bb5492265f63b16
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0fbc7f61c0620a4ec824cc106951eff46d60cfd8eb8d8d490218463d2fd98cb
fb79425c2d4402fbfa7019289419aa9292653c03d202be6d13dd2325688f5ce4

malware.news Open in urlscan Pro 2606:4700:20::ac43:4a41 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

44 Requests

100 %HTTPS

100 %IPv6

6 Domains

6 Subdomains

7 IPs

3 Countries

2637 kBTransfer

15115 kBSize

3 Cookies

22 Outgoing links

Redirected requests

44 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

malware.news Open in urlscan Pro
2606:4700:20::ac43:4a41 Public Scan

Screenshot
Live screenshot

Full Image

44
Requests

100 %
HTTPS

100 %
IPv6

6
Domains

6
Subdomains

7
IPs

3
Countries

2637 kB
Transfer

15115 kB
Size

3
Cookies

44 HTTP transactions
3 data transactions