urlscan.io logo urlscan.io
SecurityTrails logo

www.fortinet.com Open in urlscan Pro
52.8.142.247  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Submission: On May 06 via api from CH
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 26 IPs in 4 countries across 16 domains to perform 50 HTTP transactions. The main IP is 52.8.142.247, located in San Jose, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is www.fortinet.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on March 19th 2019. Valid for: 2 years.
This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 8 52.8.142.247 16509 (AMAZON-02)
4 2.19.43.118 20940 (AKAMAI-ASN1)
7 23.210.248.45 16625 (AKAMAI-AS)
1 2a00:1450:400... 15169 (GOOGLE)
1 3 52.215.56.157 16509 (AMAZON-02)
3 2a00:1450:400... 15169 (GOOGLE)
1 2.16.186.146 20940 (AKAMAI-ASN1)
2 52.52.145.59 16509 (AMAZON-02)
1 34.202.169.36 14618 (AMAZON-AES)
2 23.111.9.217 33438 (HIGHWINDS2)
2 23.210.248.216 16625 (AKAMAI-AS)
1 2a02:26f0:60:... 20940 (AKAMAI-ASN1)
1 63.32.166.115 16509 (AMAZON-02)
1 4 172.82.235.45 15224 (OMNITURE)
1 1 66.117.28.86 15224 (OMNITURE)
1 34.242.238.135 16509 (AMAZON-02)
1 3 3.120.53.177 16509 (AMAZON-02)
1 54.246.117.210 16509 (AMAZON-02)
1 50.17.52.222 14618 (AMAZON-AES)
1 2a03:2880:f01... 32934 (FACEBOOK)
1 2 172.82.228.19 15224 (OMNITURE)
1 54.217.253.41 16509 (AMAZON-02)
1 165.227.67.158 14061 (DIGITALOC...)
2 178.128.135.232 14061 (DIGITALOC...)
1 66.117.29.6 15224 (OMNITURE)
2 3 2620:119:50e2... 14413 (LINKEDIN)
1 1 2620:109:c002... 14413 (LINKEDIN)
50 26
8    52.8.142.247 (San Jose, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-8-142-247.us-west-1.compute.amazonaws.com
www.fortinet.com
4    2.19.43.118 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-43-118.deploy.static.akamaitechnologies.com
platform-api.sharethis.com
buttons-config.sharethis.com
platform-cdn.sharethis.com
7    23.210.248.45 (Cambridge, United States)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-210-248-45.deploy.static.akamaitechnologies.com
assets.adobedtm.com
1    2a00:1450:4001:824::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
3    52.215.56.157 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-215-56-157.eu-west-1.compute.amazonaws.com
dpm.demdex.net
3    2a00:1450:4001:81f::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    2.16.186.146 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-146.deploy.static.akamaitechnologies.com
c.sharethis.mgr.consensu.org
2    52.52.145.59 (San Jose, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-52-145-59.us-west-1.compute.amazonaws.com
www.fortinet.com
1    34.202.169.36 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-202-169-36.compute-1.amazonaws.com
count-server.sharethis.com
2    23.111.9.217 (Phoenix, United States)

ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)
a.optmnstr.com
2    23.210.248.216 (Cambridge, United States)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-210-248-216.deploy.static.akamaitechnologies.com
s.adroll.com
1    2a02:26f0:60:88f::3adf (European Union)

ASN20940 (AKAMAI-ASN1, US)
sjs.bizographics.com
1    63.32.166.115 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-63-32-166-115.eu-west-1.compute.amazonaws.com
fortinet.demdex.net
4    172.82.235.45 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: fortinet.com.ssl.sc.omtrdc.net
metrics.fortinet.com
1    66.117.28.86 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
cm.everesttech.net
1    34.242.238.135 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-242-238-135.eu-west-1.compute.amazonaws.com
dpm.demdex.net
3    3.120.53.177 (Fairfield, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-3-120-53-177.eu-central-1.compute.amazonaws.com
l.sharethis.com
1    54.246.117.210 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-246-117-210.eu-west-1.compute.amazonaws.com
d.adroll.com
1    50.17.52.222 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-50-17-52-222.compute-1.amazonaws.com
api.opmnstr.com
1    2a03:2880:f01c:20e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
graph.facebook.com
2    172.82.228.19 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: *.sc.omtrdc.net
fortinetinc.sc.omtrdc.net
1    54.217.253.41 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-217-253-41.eu-west-1.compute.amazonaws.com
d.adroll.com
1    165.227.67.158 (New York, United States)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
a.mstrlytcs.com
2    178.128.135.232 (Greece)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
z.opmnstr.com
1    66.117.29.6 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
fortinet.tt.omtrdc.net
3    2620:119:50e2:105::6cae:b35 (United States)

ASN14413 (LINKEDIN - LinkedIn Corporation, US)
px.ads.linkedin.com
1    2620:109:c002::6cae:a0a (United States)

ASN14413 (LINKEDIN - LinkedIn Corporation, US)
www.linkedin.com
Domain Requested by
10 www.fortinet.com 1 redirects www.fortinet.com
7 assets.adobedtm.com www.fortinet.com
assets.adobedtm.com
4 metrics.fortinet.com 1 redirects www.fortinet.com
4 dpm.demdex.net 1 redirects www.fortinet.com
3 px.ads.linkedin.com 2 redirects
3 l.sharethis.com 1 redirects www.fortinet.com
3 www.google-analytics.com www.googletagmanager.com
www.fortinet.com
2 z.opmnstr.com a.optmnstr.com
2 fortinetinc.sc.omtrdc.net 1 redirects www.fortinet.com
2 d.adroll.com s.adroll.com
www.fortinet.com
2 s.adroll.com www.googletagmanager.com
s.adroll.com
2 a.optmnstr.com www.googletagmanager.com
www.fortinet.com
2 platform-cdn.sharethis.com www.fortinet.com
1 www.linkedin.com 1 redirects
1 fortinet.tt.omtrdc.net assets.adobedtm.com
1 a.mstrlytcs.com a.optmnstr.com
1 graph.facebook.com platform-api.sharethis.com
1 api.opmnstr.com a.optmnstr.com
1 cm.everesttech.net 1 redirects
1 fortinet.demdex.net assets.adobedtm.com
1 sjs.bizographics.com www.googletagmanager.com
1 count-server.sharethis.com platform-api.sharethis.com
1 c.sharethis.mgr.consensu.org platform-api.sharethis.com
1 www.googletagmanager.com www.fortinet.com
1 buttons-config.sharethis.com platform-api.sharethis.com
1 platform-api.sharethis.com www.fortinet.com
50 26
Subject Issuer Validity Valid
www.fortinet.com
DigiCert SHA2 High Assurance Server CA		 2019-03-19 -
2021-06-09		 2 years crt.sh
*.sharethis.com
DigiCert SHA2 Secure Server CA		 2018-12-16 -
2020-03-16		 a year crt.sh
assets.adobedtm.com
DigiCert SHA2 High Assurance Server CA		 2019-03-04 -
2020-03-11		 a year crt.sh
*.google-analytics.com
Google Internet Authority G3		 2019-04-16 -
2019-07-09		 3 months crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA		 2018-01-09 -
2021-02-12		 3 years crt.sh
*.sharethis.mgr.consensu.org
DigiCert ECC Secure Server CA		 2018-07-31 -
2019-07-31		 a year crt.sh
*.optmnstr.com
Go Daddy Secure Certificate Authority - G2		 2018-07-10 -
2020-07-10		 2 years crt.sh
*.adroll.com
DigiCert SHA2 Secure Server CA		 2018-12-19 -
2020-03-19		 a year crt.sh
js.bizographics.com
DigiCert SHA2 Secure Server CA		 2018-04-13 -
2020-04-17		 2 years crt.sh
metrics.fortinet.com
DigiCert SHA2 High Assurance Server CA		 2019-01-29 -
2021-02-02		 2 years crt.sh
*.opmnstr.com
Go Daddy Secure Certificate Authority - G2		 2019-04-11 -
2021-04-11		 2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2019-03-08 -
2019-06-06		 3 months crt.sh
*.sc.omtrdc.net
DigiCert SHA2 High Assurance Server CA		 2019-04-23 -
2020-04-14		 a year crt.sh
*.mstrlytcs.com
Go Daddy Secure Certificate Authority - G2		 2017-08-25 -
2019-08-25		 2 years crt.sh
z.opmnstr.com
Let's Encrypt Authority X3		 2019-04-11 -
2019-07-10		 3 months crt.sh
*.tt.omtrdc.net
DigiCert SHA2 High Assurance Server CA		 2017-10-19 -
2020-11-25		 3 years crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA		 2017-06-06 -
2019-06-11		 2 years crt.sh

This page contains 6 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Frame ID: FA39D0A83BAB69E52CFF35A0495B8390
Requests: 48 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Frame ID: AF2D5CD96B8E1E0AD41FC139FD64D64D
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864a164746d58b700412b.html
Frame ID: 704F5CB2BFA471FDDFD63EF9E6E94D96
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864f264746d7629003a65.html
Frame ID: BFEB03F1E301D8E930CD144AF1108F4C
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa8640864746d58b700411f.html
Frame ID: 154146DBCB2EF48E0A4AE4B04BE98C48
Requests: 1 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: 6987AA6C6782264BBD850F53790C5FBD
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /(?:a|s)\.adroll\.com/i
  • env /^adroll_/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i
Overall confidence: 100%
Detected patterns
  • env /^google_tag_manager$/i
Overall confidence: 100%
Detected patterns
  • script /\/s[_-]code.*\.js/i
  • env /^s_(?:account|objectID|code|INST)$/i
Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

50
Requests

100 %
HTTPS

22 %
IPv6

16
Domains

26
Subdomains

26
IPs

4
Countries

833 kB
Transfer

1855 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7
  • https://dpm.demdex.net/id?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557166050433 HTTP 302
  • https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557166050433
Request Chain 24
  • https://www.fortinet.com/content/fortinet-blog/us/en/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png HTTP 301
  • https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png
Request Chain 32
  • https://metrics.fortinet.com/id?d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=72147629226538689650618378166717459377&ts=1557166051239 HTTP 302
  • https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=72147629226538689650618378166717459377&ts=1557166051239&AQE=1
Request Chain 33
  • https://cm.everesttech.net/cm/dd?d_uuid=72490699898184832450581749068702616121 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=XNB34wAAE4jCuBN_
Request Chain 34
  • https://l.sharethis.com/pview?event=pview&version=st_sop.js&lang=en&hostname=www.fortinet.com&location=%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&product=sticky-share-buttons&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&source=sharethis.js&fcmp=false&title=LockerGoga%3A%20Ransomware%20Targeting%20Critical%20Infrastructure&publisher=5977d47080bb1d0011ab6d8f&ts1557166050314=&sop=true HTTP 301
  • https://l.sharethis.com/sc?cm=ZGAKm1zQd%2BMAAAAST3hiAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
Request Chain 39
  • https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=72147629226538689650618378166717459377&ts=1557166051239&AQE=1 HTTP 302
  • https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=72147629226538689650618378166717459377&ts=1557166051239&AQE=1
Request Chain 51
  • https://px.ads.linkedin.com/collect/?time=1557166053156&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1 HTTP 302
  • https://px.ads.linkedin.com/collect/?time=1557166053156&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1557166053156%26pid%3D7120%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Flockergoga-ransomeware-targeting-critical-infrastructure.html%26fmt%3Djs%26s%3D1%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect/?time=1557166053156&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1&cookiesTest=true&liSync=true

50 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request lockergoga-ransomeware-targeting-critical-infrastructure.html
www.fortinet.com/blog/threat-research/ 		51 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
37a2d3ed4482161212f1fbf4706656bcc9b247035a772840ea588e712d6e0270
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
www.fortinet.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=600, public
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Mon, 06 May 2019 18:07:29 GMT
ETag
W/"cc1d-5883bf9456cd9-gzip"
Last-Modified
Mon, 06 May 2019 18:07:30 GMT
Server
Apache
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Vary
Accept-Encoding,User-Agent
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
Content-Length
12124
Connection
keep-alive
clientlib-base.min.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 		211 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
eb6058ea8eec777d07e89407b55de7990eb296b3f5a5ee4a6b04c71d3c129c42
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:30 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:29:16 GMT
Server
Apache
ETag
"34d65-5878def26f700-gzip"
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
text/css
Cache-Control
max-age=43200, public
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
Content-Length
16858
X-XSS-Protection
1; mode=block
sharethis.js
platform-api.sharethis.com/js/ 		91 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e5c2f85b9e49be5acd30c8ba3767b124d8945f35000eef89902a0485c04e6040

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:30 GMT
Content-Encoding
gzip
ETag
W/"16d4e-SgmVDK5mv+C+DRaEIjQ3WYUSiQ4"
Vary
Accept-Encoding
Access-Control-Allow-Methods
DELETE, GET, HEAD, OPTIONS, POST, PUT
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Connection
keep-alive
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Content-Length
27855
satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/ 		144 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.248.45 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-248-45.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f2bf5964adbfac80827ae87c5f7c0f05e51f416e3e2132fd93dc2e2d98f2e935

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 18:07:30 GMT
content-encoding
gzip
last-modified
Thu, 25 Apr 2019 23:34:48 GMT
server
Apache
etag
"479d7011b674847178716d558563c2d3:1556235288"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
41934
expires
Mon, 06 May 2019 19:07:30 GMT
fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 		32 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:30 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:26:53 GMT
Server
Apache
ETag
"7ebb-5878de6a0f540-gzip"
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
Content-Length
1998
X-XSS-Protection
1; mode=block
clientlib-base.min.js
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 		165 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
85c6103aabd94bf4584fbdd8b15cb68c08fa52f43dc229ac034a1bf6c855c0bc
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:30 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:27:24 GMT
Server
Apache
ETag
"2931b-5878de879fb00-gzip"
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
application/javascript
Cache-Control
max-age=43200, public
transfer-encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
X-XSS-Protection
1; mode=block
5977d47080bb1d0011ab6d8f.js
buttons-config.sharethis.com/js/ 		444 B
865 B 		Script
General
Check archive.org
Download Go to
Full URL
https://buttons-config.sharethis.com/js/5977d47080bb1d0011ab6d8f.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-118.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
7f0daa7591ef2b42b26dd9d39102440c242e7fd798e7898a620e5489d67ec73e

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:30 GMT
Last-Modified
Tue, 16 Jan 2018 20:14:52 GMT
Server
AmazonS3
x-amz-request-id
D7C70C9A86FB0038
ETag
"6167cc13570c31ffc1713616a6fb087d"
Content-Type
text/javascript
Cache-Control
public, max-age=60
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
444
x-amz-id-2
fYWETKOa1CVTC39naUTwR+KRpkLi5qc4EDAyvL4rUmMO8aGyHMyym3A8NTyNrRX+CjQFuUeeDhA=
gtm.js
www.googletagmanager.com/ 		60 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager (scaffolding) /
Resource Hash
604ae5068c06ac47597ed7e1c587a0ce7d8ff6e8174a979b285169f1b3277016
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 18:07:30 GMT
content-encoding
br
last-modified
Wed, 01 May 2019 22:14:49 GMT
server
Google Tag Manager (scaffolding)
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
23009
x-xss-protection
0
expires
Mon, 06 May 2019 18:07:30 GMT
rd
dpm.demdex.net/id/
Redirect Chain
  • https://dpm.demdex.net/id?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557166050433
  • https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557166050433
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557166050433
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.56.157 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-215-56-157.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Location
https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557166050433
X-TID
S/wxiVV5Rx8=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.fortinet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Access-Control-Allow-Origin
https://www.fortinet.com
X-TID
S/wxiVV5Rx8=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557166050433
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
mbox-contents-081c7224345c702ebcf6ef22d3b7449ec11ce42d.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/ 		75 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/mbox-contents-081c7224345c702ebcf6ef22d3b7449ec11ce42d.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.248.45 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-248-45.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
bf37dba5836581c0cc0451edd5c197e46a5a0e070b3f696e5b4bf7e32da1817a

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Mon, 06 May 2019 18:07:30 GMT
content-encoding
gzip
last-modified
Thu, 25 Apr 2019 23:34:48 GMT
server
Apache
etag
"eb6d969848d866a39a78150c4a347735:1556235288"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
27590
expires
Mon, 06 May 2019 19:07:30 GMT
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Jan 2019 20:01:45 GMT
server
Golfe2
age
2101
date
Mon, 06 May 2019 17:32:29 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
17543
expires
Mon, 06 May 2019 19:32:29 GMT
truncated
/ 		71 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
image/png
portal.html
c.sharethis.mgr.consensu.org/v1.0/cmp/ Frame AF2D 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.146 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-146.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Host
c.sharethis.mgr.consensu.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods
DELETE, GET, HEAD, OPTIONS, POST, PUT
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
ETag
W/"26b-4977387000"
Last-Modified
Tue, 01 Jan 1980 00:00:00 GMT
Vary
Accept-Encoding
Content-Length
334
Cache-Control
public, max-age=3600
Date
Mon, 06 May 2019 18:07:30 GMT
Connection
keep-alive
lockergoga.png
www.fortinet.com/content/dam/fortinet-blog/article-images/lockergoga-blog/ 		110 KB
110 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/lockergoga-blog/lockergoga.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
caa02d6bc107a0f648a41c4572b8e7fd71278b2e740e4bc809594dd3dc446c8d
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:30 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:26:56 GMT
Server
Apache
ETag
"1b7e9-5878de6cebc00"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
112617
X-XSS-Protection
1; mode=block
anatova-blog-two.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/anatova-ransomware/ 		78 KB
78 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/anatova-ransomware/anatova-blog-two.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
c9e784c91038976835b53028e10a3f90e1508036aaba1859a820ffec8c2e9486
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:30 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 03:36:33 GMT
Server
Apache
ETag
"1374e-5878edfc6b240"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
79694
X-XSS-Protection
1; mode=block
TLR-img.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/tlr-q4-blog/ 		66 KB
66 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/tlr-q4-blog/TLR-img.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.8.142.247 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-8-142-247.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
af780899477625834ea7cd70915f91c4cc903413e1fd8769a9117d22adcb7865
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:30 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 04:17:52 GMT
Server
Apache
ETag
"107eb-5878f73893c00"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
67563
X-XSS-Protection
1; mode=block
gandcrab-honor-among-thieves-thumb.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/gandcrab--honor-among-thieves/ 		64 KB
65 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/content/dam/fortinet-blog/article-images/gandcrab--honor-among-thieves/gandcrab-honor-among-thieves-thumb.png.thumb.319.319.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.52.145.59 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-52-145-59.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
26e382d9c4380bd0293c2d41be30b754a01fb09db5d2e5c6b60bbd0368efb2ed
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:30 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 02:30:20 GMT
Server
Apache
ETag
"10052-5878df2f78700"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
65618
X-XSS-Protection
1; mode=block
satellite-5aa864a164746d58b700412b.html
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ Frame 704F 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864a164746d58b700412b.html
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.248.45 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-248-45.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
assets.adobedtm.com
:scheme
https
:path
/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864a164746d58b700412b.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
accept-encoding
gzip, deflate, br
cookie
_fbp=fb.1.1557166049628.144431390
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html

Response headers

status
200
server
Apache
etag
"52fa849a16651953dc915efbae88d0cc:1556235289"
last-modified
Thu, 25 Apr 2019 23:34:49 GMT
accept-ranges
bytes
content-type
text/html
vary
Accept-Encoding
content-encoding
gzip
content-length
803
cache-control
max-age=3600
expires
Mon, 06 May 2019 19:07:30 GMT
date
Mon, 06 May 2019 18:07:30 GMT
timing-allow-origin
*
satellite-5aa864f264746d7629003a65.html
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ Frame BFEB 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864f264746d7629003a65.html
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.248.45 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-248-45.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
assets.adobedtm.com
:scheme
https
:path
/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa864f264746d7629003a65.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
accept-encoding
gzip, deflate, br
cookie
_fbp=fb.1.1557166049628.144431390
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html

Response headers

status
200
server
Apache
etag
"8227658d1e33b9eaa91028e35c3beb4f:1556235289"
last-modified
Thu, 25 Apr 2019 23:34:49 GMT
accept-ranges
bytes
content-type
text/html
vary
Accept-Encoding
content-encoding
gzip
content-length
782
cache-control
max-age=3600
expires
Mon, 06 May 2019 19:07:30 GMT
date
Mon, 06 May 2019 18:07:30 GMT
timing-allow-origin
*
satellite-5aa8640864746d58b700411f.html
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ Frame 1541 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa8640864746d58b700411f.html
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.248.45 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-248-45.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
assets.adobedtm.com
:scheme
https
:path
/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-5aa8640864746d58b700411f.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
accept-encoding
gzip, deflate, br
cookie
_fbp=fb.1.1557166049628.144431390
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html

Response headers

status
200
server
Apache
etag
"94b6dd03c710fe7140881c36dbb5ab47:1556235289"
last-modified
Thu, 25 Apr 2019 23:34:49 GMT
accept-ranges
bytes
content-type
text/html
vary
Accept-Encoding
content-encoding
gzip
content-length
899
cache-control
max-age=3600
expires
Mon, 06 May 2019 19:07:30 GMT
date
Mon, 06 May 2019 18:07:30 GMT
timing-allow-origin
*
s-code-contents-678d604999b9203058dbe982c7a7ddbf795bb1f4.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/ 		34 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/s-code-contents-678d604999b9203058dbe982c7a7ddbf795bb1f4.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.248.45 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-248-45.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
68588db4f09f1982d74887644c54e581cc6ed7e267f836a480c29ef1a3c0a7a0

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 18:07:30 GMT
content-encoding
gzip
last-modified
Thu, 25 Apr 2019 23:34:48 GMT
server
Apache
etag
"9a1e762486f8afef7a6f384a1e9c253d:1556235288"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
13170
expires
Mon, 06 May 2019 19:07:30 GMT
satellite-59ceae2064746d21fe0037dd.js
assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/ 		1 KB
693 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/scripts/satellite-59ceae2064746d21fe0037dd.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.248.45 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-248-45.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
24038492cb3d19fef34ce0a9bc55033f3030c04eeea97a93c22b2ec8914c1316

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 18:07:30 GMT
content-encoding
gzip
last-modified
Thu, 25 Apr 2019 23:34:49 GMT
server
Apache
etag
"d8619d86a5e27900726ec96a76ead3cc:1556235289"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
459
expires
Mon, 06 May 2019 19:07:30 GMT
get_counts
count-server.sharethis.com/v2.0/ 		327 B
402 B 		Script
General
Check archive.org
Download Go to
Full URL
https://count-server.sharethis.com/v2.0/get_counts?cb=window.__sharethis__.cb3&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&refDomain=www.fortinet.com&sop=true
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.202.169.36 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-202-169-36.compute-1.amazonaws.com
Software
/
Resource Hash
a93d1dfea16ac5c30f63a64073fe4f27b936c092ea5bdfd971685b2c36a642e9

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:31 GMT
Content-Encoding
gzip
Connection
keep-alive
Content-Length
245
Content-Type
application/json
arrow_left.svg
platform-cdn.sharethis.com/img/ 		565 B
949 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/arrow_left.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-118.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:30 GMT
Last-Modified
Fri, 04 Jan 2019 18:31:05 GMT
Server
AmazonS3
x-amz-request-id
860C7676964A89BA
ETag
"b55d8d2b9321e381a3c38a4bddb74037"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
565
x-amz-id-2
bWt/rpQHMsaVK+6zHgk7ji0FeUWLugR5wpok0TBQAb9iaseGRZ3GIhxcnN373+KibvdwFljjYqQ=
arrow_right.svg
platform-cdn.sharethis.com/img/ 		565 B
949 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/arrow_right.svg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-118.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:30 GMT
Last-Modified
Fri, 04 Jan 2019 18:31:05 GMT
Server
AmazonS3
x-amz-request-id
BECE9179367F8EC9
ETag
"9928d025bd5792b718ee0a185f62e67c"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
565
x-amz-id-2
h6lE2cepykY/qBF4SDzfV/ywkiWBvlLZQDlhK1dJRZKTE3psDaN74Cvr4MIculViiryAUjznxuY=
image_873699664.img.png
www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/
Redirect Chain
  • https://www.fortinet.com/content/fortinet-blog/us/en/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png
  • https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png
92 KB
93 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.52.145.59 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-52-145-59.us-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
db48939bec021c7c13015d86307bafa2a2f8b832700fa92806d67bb32112462e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:31 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 28 Apr 2019 07:37:33 GMT
Server
Apache
ETag
"1705b-587923da8c940"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
94299
X-XSS-Protection
1; mode=block

Redirect headers

Location
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure/_jcr_content/root/responsivegrid/image_873699664.img.png
Date
Mon, 06 May 2019 18:07:31 GMT
Server
Apache
Connection
keep-alive
Content-Length
367
Content-Type
text/html; charset=iso-8859-1
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
image/gif
rd
dpm.demdex.net/id/ 		367 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=3.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1557166050433
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.56.157 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-215-56-157.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
cf73a7617324defcb43fcc6b0a7c2b13718a1f76fd38a7ac3d8159b07ab64127

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v028-0f10ddaf2.edge-irl1.demdex.com 5.52.1.20190424113352 4ms
Pragma
no-cache
Content-Encoding
gzip
X-TID
vum9QDUPTEs=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.fortinet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
303
Expires
Thu, 01 Jan 1970 00:00:00 GMT
api.min.js
a.optmnstr.com/app/js/ 		176 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.optmnstr.com/app/js/api.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.217 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
696bac8666ce5bf4e390c7f71dc783a17fb56a3b429c6ff35dd5ad52ae254988

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 18:07:31 GMT
content-encoding
gzip
last-modified
Wed, 01 May 2019 20:28:04 GMT
server
NetDNA-cache/2.2
x-amz-request-id
0EB5603AAEA8151F
etag
W/"893ec539b14306fc6cd144c53e9daa66"
x-cache
HIT
content-type
application/javascript
status
200
cache-control
max-age=2592000
x-amz-id-2
Ux9RiJdNMR2AUJqZZSbvaCtZV3cyg4JI/s5J2WQp5hO18lqTnuTUQt35CUa7jJRMX6BPMKjZS+M=
expires
Wed, 05 Jun 2019 18:07:31 GMT
collect
www.google-analytics.com/r/ 		35 B
111 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j73&a=1874912242&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&ul=en-us&de=UTF-8&dt=LockerGoga%3A%20Ransomware%20Targeting%20Critical%20Infrastructure&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAAAB~&jid=65089355&gjid=303533052&cid=1426837744.1557166051&tid=UA-767980-6&_gid=1129263441.1557166051&_r=1&gtm=2wg430NBSLLPJ&z=1046603414
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 06 May 2019 18:07:31 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
roundtrip.js
s.adroll.com/j/ 		32 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.248.216 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-248-216.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
6d73aa32774fb131ebbc1faf3f931aaf66e998f808757cbafbcc737f8d769580

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
ea1u3hYQrubY64bATByV7XbdUEwnubrR
Content-Encoding
gzip
x-amz-request-id
C7A4752260620705
x-amz-server-side-encryption
AES256
Access-Control-Max-Age
600
Date
Mon, 06 May 2019 18:07:31 GMT
Connection
keep-alive
Content-Length
10245
x-amz-id-2
K18RlJUfOcLGqPBweOGxlnRwDlXGf3sJ9xmH9VYEl/y0PkuDogldNb5vLb+8XwpkMDwvGhsO3bE=
Last-Modified
Wed, 20 Feb 2019 19:22:50 GMT
Server
AmazonS3
ETag
"a75c16aa500b21e32e06699919372ec4"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
insight.min.js
sjs.bizographics.com/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sjs.bizographics.com/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBSLLPJ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:60:88f::3adf , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:31 GMT
Content-Encoding
gzip
Last-Modified
Mon, 03 Dec 2018 23:03:30 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=35191
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4571
Cookie set dest5.html
fortinet.demdex.net/ Frame 6987 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://fortinet.demdex.net/dest5.html?d_nsid=0
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/satelliteLib-32b0117a6a1b1e07ce775d6f834af5718192ddf1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.32.166.115 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-63-32-166-115.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Host
fortinet.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Accept-Encoding
gzip, deflate, br
Cookie
demdex=72490699898184832450581749068702616121
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Thu, 25 Apr 2019 10:08:16 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=72490699898184832450581749068702616121;Path=/;Domain=.demdex.net;Expires=Sat, 02-Nov-2019 18:07:31 GMT;Max-Age=15552000
Vary
Accept-Encoding, User-Agent
X-TID
A4CmgSrGRLw=
Content-Length
2764
Connection
keep-alive
id
fortinetinc.sc.omtrdc.net/
Redirect Chain
  • https://metrics.fortinet.com/id?d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=72147629226538689650618378166717459377&ts=1557166051239
  • https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critic...
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=72147629226538689650618378166717459377&ts=1557166051239&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.82.235.45 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
fortinet.com.ssl.sc.omtrdc.net
Software
Omniture DC/2.0.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:31 GMT
X-Content-Type-Options
nosniff
Access-Control-Allow-Origin
https://www.fortinet.com
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 18:07:31 GMT
Server
Omniture DC/2.0.0
xserver
www108
Content-Type
text/plain
Location
https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=72147629226538689650618378166717459377&ts=1557166051239&AQE=1
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Keep-Alive
timeout=15
Expires
Sun, 05 May 2019 18:07:31 GMT

Redirect headers

Date
Mon, 06 May 2019 18:07:31 GMT
X-Content-Type-Options
nosniff
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 18:07:31 GMT
Server
Omniture DC/2.0.0
xserver
www108
Location
https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=72147629226538689650618378166717459377&ts=1557166051239&AQE=1
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.fortinet.com
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Keep-Alive
timeout=15
Expires
Sun, 05 May 2019 18:07:31 GMT
ibs:dpid=411&dpuuid=XNB34wAAE4jCuBN_
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=72490699898184832450581749068702616121
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=XNB34wAAE4jCuBN_
42 B
769 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XNB34wAAE4jCuBN_
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.242.238.135 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-242-238-135.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v028-0e0c05e8e.edge-irl1.demdex.com 5.52.1.20190424113352 4ms
Pragma
no-cache
X-TID
YMbcnZt7S7U=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date
Mon, 06 May 2019 18:07:31 GMT
Server
AMO-cookiemap/1.1
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XNB34wAAE4jCuBN_
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=15,max=100
Content-Length
0
sc
l.sharethis.com/
Redirect Chain
  • https://l.sharethis.com/pview?event=pview&version=st_sop.js&lang=en&hostname=www.fortinet.com&location=%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&prod...
  • https://l.sharethis.com/sc?cm=ZGAKm1zQd%2BMAAAAST3hiAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop...
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://l.sharethis.com/sc?cm=ZGAKm1zQd%2BMAAAAST3hiAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.120.53.177 Fairfield, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-120-53-177.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:31 GMT
Location
/sc?cm=ZGAKm1zQd%2BMAAAAST3hiAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
Access-Control-Max-Age
1728000
P3p
policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Access-Control-Allow-Origin
https://www.fortinet.com
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
*
Content-Length
226
Stid
ZGAKm1zQd+MAAAAST3hiAw==

Redirect headers

Date
Mon, 06 May 2019 18:07:31 GMT
Access-Control-Allow-Origin
https://www.fortinet.com
Access-Control-Max-Age
1728000
P3p
policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Location
/sc?cm=ZGAKm1zQd%2BMAAAAST3hiAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
*
Content-Length
226
Stid
ZGAKm1zQd+MAAAAST3hiAw==
sc
l.sharethis.com/ 		52 B
475 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://l.sharethis.com/sc?cm=ZGAKm1zQd%2BMAAAAST3hiAw%3D%3D&uid=true&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&sop=true
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.120.53.177 Fairfield, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-120-53-177.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
f7f7adc0680af0b48f4168a9fd3daff9395877ab7c02e4210474890a104d5853

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

Date
Mon, 06 May 2019 18:07:31 GMT
Access-Control-Max-Age
1728000
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://www.fortinet.com
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Stid
ZGAKm1zQd+MAAAAST3hiAw==
Access-Control-Allow-Headers
*
Content-Length
52
7OBVBCAQE5FHDPFEAD5T4D
d.adroll.com/consent/check/ 		40 B
200 B 		Script
General
Check archive.org
Download Go to
Full URL
https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D?_s=26b6924ddf794127201455a15e0fe182
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.246.117.210 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-246-117-210.eu-west-1.compute.amazonaws.com
Software
nginx/1.14.1 /
Resource Hash
6f43e1e85c42d5e449308701054501d9867a7254c9a8734406afbc89b3dfe5b4

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:31 GMT
Server
nginx/1.14.1
Connection
keep-alive
Content-Length
40
Content-Type
application/javascript
39852
api.opmnstr.com/v2/embed/ 		163 KB
16 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.opmnstr.com/v2/embed/39852
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.17.52.222 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-50-17-52-222.compute-1.amazonaws.com
Software
Pagely Gateway/1.5.1 /
Resource Hash
04c7fc62027de4c79f20a877f16b3fe9ecc2c45c647cb632b92f0d442784991c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

x-user-agent
standard
content-encoding
gzip
x-cache-config
0 0
server
Pagely Gateway/1.5.1
status
200
date
Mon, 06 May 2019 18:07:31 GMT
x-cache-status
HIT
vary
Accept-Encoding, User-Agent
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-OptinMonster-Account
access-control-allow-headers
X-CSRF-Token
x-optinmonster-account
45602
/
graph.facebook.com/ 		585 B
535 B 		Script
General
Check archive.org
Download Go to
Full URL
https://graph.facebook.com/?id=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&callback=window.__sharethis__.cb4
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:20e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
a845f8ef9d6435077c09c3a9ec401f17f9d6b58f0f49f6014d2ff7c04d4be73c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-app-usage
{"call_count":0,"total_cputime":0,"total_time":0}
status
200
date
Mon, 06 May 2019 18:07:31 GMT
x-fb-rev
1000675769
content-length
327
pragma
no-cache
x-fb-debug
DcxvuyqZvzrzYUeJooYJJbnVrZww6/taQB37jHZiJzfuknYoMUFQrX/Sg/82efeo7qhcTZ1wfURoo6Sof8ALkg==
x-fb-trace-id
G5D+lakWYs7
etag
"6d3dddee4e0071d077d11dfab9d235838b02e9fe"
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
x-fb-request-id
AFnkPEc-O1U02gihv_CV2Yr
cache-control
private, no-cache, no-store, must-revalidate
facebook-api-version
v2.9
expires
Sat, 01 Jan 2000 00:00:00 GMT
id
metrics.fortinet.com/
Redirect Chain
  • https://fortinetinc.sc.omtrdc.net/id?AQB=1&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critic...
  • https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-c...
0
-1 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=72147629226538689650618378166717459377&ts=1557166051239&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.82.228.19 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
*.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:31 GMT
X-Content-Type-Options
nosniff
Access-Control-Allow-Origin
null
P3P
CP="This is not a P3P policy"
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 18:07:31 GMT
Server
Omniture DC
xserver
www191
Content-Type
text/plain
Location
https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=72147629226538689650618378166717459377&ts=1557166051239&AQE=1
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Expires
Sun, 05 May 2019 18:07:31 GMT

Redirect headers

Date
Mon, 06 May 2019 18:07:31 GMT
X-Content-Type-Options
nosniff
P3P
CP="This is not a P3P policy"
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 18:07:31 GMT
Server
Omniture DC
xserver
www191
Location
https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=72147629226538689650618378166717459377&ts=1557166051239&AQE=1
Content-Type
text/plain
Access-Control-Allow-Origin
null
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Access-Control-Allow-Credentials
true
Expires
Sun, 05 May 2019 18:07:31 GMT
consent.js
s.adroll.com/j/ 		67 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/consent.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.248.216 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-248-216.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
4983cd18419e417077dcc013922828394049ce6c65db6a782d2d73f225d46089

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
yvF3y5OARyGYjZyuW4BqgiCbPvLhhPrH
Content-Encoding
gzip
x-amz-request-id
7EBD99F69567301D
x-amz-server-side-encryption
AES256
Access-Control-Max-Age
600
Date
Mon, 06 May 2019 18:07:31 GMT
Connection
keep-alive
Content-Length
15051
x-amz-id-2
ZAMLcakp6pamVvhjTbjoBOeKm/lFBqsh3HyHLH8XDul6YO1D/T5bOMFfxhZ5XZIR3NTSb8PhK6U=
Last-Modified
Thu, 06 Dec 2018 16:37:43 GMT
Server
AmazonS3
ETag
"53cd26585ff224c6851303016ec98536"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=300, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
b5fcd7bd32e11550704192-blog-banner-1024x160-TLR-Q4-2018.jpg
a.optmnstr.com/users/df0603609574/images/ 		78 KB
78 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.optmnstr.com/users/df0603609574/images/b5fcd7bd32e11550704192-blog-banner-1024x160-TLR-Q4-2018.jpg
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.217 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
c001e01a6b6a23f4619521bb9a5cdea66124971ab04cf0211649015b0c4af1b1

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 18:07:31 GMT
x-amz-request-id
A72C287067CE6966
x-cache
HIT
status
200
x-amz-meta-date
1550704192
content-length
79452
x-amz-id-2
slvpkKABbzI4epoFWAmFMjSGt4+l253KuFjJHitlCw+Z+7RSFY1Qo4uBRbvNAWKCT8sjvd6IhTw=
x-amz-meta-level
pro
last-modified
Wed, 20 Feb 2019 23:09:53 GMT
server
NetDNA-cache/2.2
x-amz-meta-accountid
45602
etag
"fc7ddf45e300c64bfc4cb7ddc8c325c8"
content-type
image/jpeg
x-amz-meta-userid
39852
x-amz-meta-title
b5fcd7bd32e11550704192-blog-banner-1024x160-TLR-Q4-2018.jpg
cache-control
max-age=2592000
accept-ranges
bytes
expires
Wed, 05 Jun 2019 18:07:31 GMT
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dbeeb3fa5f0188835b6b6208bc89d641f030e79e27ad5712d427eabd79e6095a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
image/png
id
metrics.fortinet.com/ 		49 B
391 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://metrics.fortinet.com/id?AQB=1&vmr=true&&vmh=metrics.fortinet.com&vmf=fortinetinc.sc.omtrdc.net&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&d_visid_ver=3.4.0&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=72147629226538689650618378166717459377&ts=1557166051239&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.82.235.45 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
fortinet.com.ssl.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
30e75a31aeb8852a5d0455a2b30c74200c55348d33f46758a360c80215a8471c

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
null
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Mon, 06 May 2019 18:07:31 GMT
Server
Omniture DC
xserver
www242
Vary
Origin
X-C
ms-6.6.0
P3P
CP="This is not a P3P policy"
Access-Control-Allow-Origin
null
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/x-javascript
Keep-Alive
timeout=15
Content-Length
49
hod
d.adroll.com/consent/ 		42 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d.adroll.com/consent/hod?_e=view_banner&_s=26b6924ddf794127201455a15e0fe182&_b=626d9f6089ce68&_a=7OBVBCAQE5FHDPFEAD5T4D
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.217.253.41 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-217-253-41.eu-west-1.compute.amazonaws.com
Software
nginx/1.14.1 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:33 GMT
Cache-Control
no-transform,public,max-age=300,s-maxage=900
Server
nginx/1.14.1
Connection
keep-alive
Content-Length
42
Vary
Cookie
Content-Type
image/gif
a
a.mstrlytcs.com/v1/ 		0
132 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://a.mstrlytcs.com/v1/a?ty=impression&aid=39852&cid=41325&sid=81773&v=5
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
165.227.67.158 New York, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

status
200
date
Mon, 06 May 2019 18:07:32 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://www.fortinet.com
content-type
text/plain; charset=UTF-8
q
z.opmnstr.com/v2/ 		0
204 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://z.opmnstr.com/v2/q?aid=39852&cid=qxx1b0gslklfu2kjckea&sid=5ab4105aee546&gaid=1306710&gas=5ab42b3012fe2&v=5
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.128.135.232 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
kong/0.14.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

Access-Control-Allow-Origin
https://www.fortinet.com
Date
Mon, 06 May 2019 18:07:32 GMT
Access-Control-Allow-Credentials
true
Server
kong/0.14.1
Connection
keep-alive
i
z.opmnstr.com/v3/ 		0
204 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://z.opmnstr.com/v3/i?aid=39852&cid=qxx1b0gslklfu2kjckea&sid=5ab4105aee546&rt=false&dv=desktop&cty=inline&url=blog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&v=5
Requested by
Host: a.optmnstr.com
URL: https://a.optmnstr.com/app/js/api.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.128.135.232 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
kong/0.14.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

Access-Control-Allow-Origin
https://www.fortinet.com
Date
Mon, 06 May 2019 18:07:32 GMT
Access-Control-Allow-Credentials
true
Server
kong/0.14.1
Connection
keep-alive
collect
www.google-analytics.com/r/ 		35 B
111 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j73&a=1874912242&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&ul=en-us&de=UTF-8&dt=LockerGoga%3A%20Ransomware%20Targeting%20Critical%20Infrastructure&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Blog%20-%20Threat%20Research&ea=impression&el=qxx1b0gslklfu2kjckea&_u=6HBAAEAB~&jid=238911509&gjid=302068561&cid=1056039162.1557166052&tid=UA-767980-1&_gid=981300367.1557166052&_r=1&z=1505283951
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 06 May 2019 18:07:32 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
s27409579185006
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.10.0-D7QN/ 		43 B
545 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.10.0-D7QN/s27409579185006?AQB=1&ndh=1&pf=1&t=6%2F4%2F2019%2018%3A7%3A32%201%200&sdid=4506F0E0A0A6E961-61D25763B388D7C4&D=D%3D&mid=72147629226538689650618378166717459377&aamlh=6&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Alockergoga-ransomeware-targeting-critical-infrastructure&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&events=event3&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&v3=%2B1&c7=Entire%20Site&c8=New&v25=72147629226538689650618378166717459377&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Alockergoga-ransomeware-targeting-critical-infrastructure&v35=Enabled&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1
Requested by
Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
172.82.235.45 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
fortinet.com.ssl.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 18:07:32 GMT
X-C
ms-6.6.0
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 07 May 2019 18:07:32 GMT
Server
Omniture DC
xserver
www7145
ETag
"3343988633977815040-4917510307737288637"
Vary
*
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Keep-Alive
timeout=15
Expires
Sun, 05 May 2019 18:07:32 GMT
json
fortinet.tt.omtrdc.net/m2/fortinet/mbox/ 		96 B
187 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fortinet.tt.omtrdc.net/m2/fortinet/mbox/json?mbox=target-global-mbox&mboxSession=709edb0ad62842baa92fbdd73193dfac&mboxPC=&mboxPage=559b2bd8d1a74fd1b9c528d4564006d3&mboxRid=a628a7260f9042e09f20bc50597d1858&mboxVersion=1.6.4&mboxCount=1&mboxTime=1557166050559&mboxHost=www.fortinet.com&mboxURL=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&mboxReferrer=&browserHeight=1200&browserWidth=1600&browserTimeOffset=0&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&mboxMCSDID=4506F0E0A0A6E961-61D25763B388D7C4&vst.trk=nsmetrics.fortinet.com&vst.trks=metrics.fortinet.com&mboxMCGVID=72147629226538689650618378166717459377&mboxAAMB=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&mboxMCGLH=6
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/4e56a4f921ab0baab5f89914672a3d541ff95762/mbox-contents-081c7224345c702ebcf6ef22d3b7449ec11ce42d.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
66.117.29.6 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
/
Resource Hash
f85c6f4c7b29ceefd68ee623afc132206bf2e18994732608d8e28b3a9c2486c4

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
Origin
https://www.fortinet.com

Response headers

pragma
no-cache
date
Mon, 06 May 2019 18:07:31 GMT
status
200
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.fortinet.com
cache-control
no-cache
access-control-allow-credentials
true
timing-allow-origin
*
content-length
96
x-request-id
a628a7260f9042e09f20bc50597d1858
/
px.ads.linkedin.com/collect/
Redirect Chain
  • https://px.ads.linkedin.com/collect/?time=1557166053156&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1
  • https://px.ads.linkedin.com/collect/?time=1557166053156&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1557166053156%26pid%3D7120%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-rese...
  • https://px.ads.linkedin.com/collect/?time=1557166053156&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s...
0
79 B 		Script
General
Check archive.org
Download Go to
Full URL
https://px.ads.linkedin.com/collect/?time=1557166053156&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1&cookiesTest=true&liSync=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:119:50e2:105::6cae:b35 , United States, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.fortinet.com/blog/threat-research/lockergoga-ransomeware-targeting-critical-infrastructure.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 06 May 2019 18:07:33 GMT
content-encoding
gzip
server
Play
vary
Accept-Encoding
x-li-fabric
prod-lva1
status
200
x-li-proto
http/2
x-li-pop
prod-ela1
content-type
application/javascript
content-length
20
x-li-uuid
FtsYlEYqnBVgmZ5qYisAAA==

Redirect headers

date
Mon, 06 May 2019 18:07:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
302
x-li-pop
prod-edc2
content-length
20
x-li-uuid
tA3SikYqnBVAksG23yoAAA==
pragma
no-cache
server
Play
x-frame-options
sameorigin
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
vary
Accept-Encoding
strict-transport-security
max-age=2592000
x-li-fabric
prod-lva1
location
https://px.ads.linkedin.com/collect/?time=1557166053156&pid=7120&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Flockergoga-ransomeware-targeting-critical-infrastructure.html&fmt=js&s=1&cookiesTest=true&liSync=true
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

138 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| __stdos__ boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus function| __sharethis__docReady object| __sharethis__ object| dataLayer function| e function| Visitor object| _satellite object| s_c_il number| s_c_in function| targetPageParams function| postscribe object| google_tag_manager string| GoogleAnalyticsObject function| ga object| adobe object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate object| fortinet_blog object| EasyAutocomplete object| search_config object| keywords object| siteId object| lang object| options boolean| searchFired boolean| blogFilter string| documentsQuery string| blogCategories string| authorsList string| yearsList object| lastQuery number| totalReturn number| lastRow object| lastWordsForCounting function| htmlEncode function| hideAutoComplete function| sitesearch_init function| sitesearch_search_callback function| sitesearch_countall_callback function| sitesearch_do_search function| sitesearch_do_force_search function| sitesearch_spellcheck_callback function| sitesearch_do_spellcheck function| sitesearch_do_suggest_search function| sitesearch_query_searchresult_callback function| sitesearch_do_query_searchresult function| sitesearch_click_page_callback function| sitesearch_click_page function| search_action function| sitesearch_search_fortiguard function| count_facets_type function| shuffle_facets function| csCookies object| cookieScriptWindow object| cookieScripts string| cookieScriptSrc function| cookieQuery string| cookieScriptPosition string| cookieScriptSource string| cookieScriptDomain string| cookieScriptReadMore string| cookieId number| cookieScriptDebug boolean| cookieScriptShowBadge string| cookieScriptCurrentUrl string| pagePath string| cookieScriptTitle string| cookieScriptDesc string| cookieScriptAccept string| cookieScriptMore string| cookieScriptCopyrights string| cookieBackground function| setImmediate function| clearImmediate function| $ function| jQuery undefined| Cookies string| cookieScriptReject function| cookieScriptLoadJavaScript function| InjectCookieScript string| cookieScriptStatsDomain function| cookieScriptCreateCookie function| cookieScriptReadCookie function| cookieScriptAddBox object| cookieScriptCurrentValue object| google_tag_data object| gaplugins object| gaGlobal object| gaData string| adroll_adv_id string| adroll_pix_id boolean| __adroll_loaded string| _bizo_data_partner_id undefined| _bizo_data_partner_title undefined| _bizo_data_partner_domain undefined| _bizo_data_partner_company undefined| _bizo_data_partner_location undefined| _bizo_data_partner_employee_range undefined| _bizo_data_partner_sics undefined| _bizo_data_partner_email function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq object| t string| adroll_sid object| __adroll boolean| adroll_optout object| adroll_ext_network object| adroll_callbacks function| adroll_tpc_callback function| OptinMonsterApp boolean| om_loaded object| om45602_39852 object| __adroll_consent boolean| __adroll_consent_is_gdpr object| _omapp object| omajiy6yksgfbr0illbjel object| ombs6hw8oho0l8z5lmhzmv object| omqxx1b0gslklfu2kjckea object| omtaoi2gud8wo2ip9kbnpv object| $jscomp string| BANNER_VERSION object| __adroll_consent_banner function| fbAsyncInit object| s_i_fortinetincproduction function| _bizo_local_logger function| _bizo_fire_partners boolean| _bizo_main_already_called

1 Cookies

Domain/Path Name / Value
.adobedtm.com/ Name: _fbp
Value: fb.1.1557166052720.507153899

9 Console Messages

Source Level URL
Text
console-api warning URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api warning URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[object Object]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
console.groupEnd
console-api warning URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
[object Object]
console-api log URL: https://a.optmnstr.com/app/js/api.min.js(Line 2)
Message:
console.groupEnd

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.mstrlytcs.com
a.optmnstr.com
api.opmnstr.com
assets.adobedtm.com
buttons-config.sharethis.com
c.sharethis.mgr.consensu.org
cm.everesttech.net
count-server.sharethis.com
d.adroll.com
dpm.demdex.net
fortinet.demdex.net
fortinet.tt.omtrdc.net
fortinetinc.sc.omtrdc.net
graph.facebook.com
l.sharethis.com
metrics.fortinet.com
platform-api.sharethis.com
platform-cdn.sharethis.com
px.ads.linkedin.com
s.adroll.com
sjs.bizographics.com
www.fortinet.com
www.google-analytics.com
www.googletagmanager.com
www.linkedin.com
z.opmnstr.com
165.227.67.158
172.82.228.19
172.82.235.45
178.128.135.232
2.16.186.146
2.19.43.118
23.111.9.217
23.210.248.216
23.210.248.45
2620:109:c002::6cae:a0a
2620:119:50e2:105::6cae:b35
2a00:1450:4001:81f::200e
2a00:1450:4001:824::2008
2a02:26f0:60:88f::3adf
2a03:2880:f01c:20e:face:b00c:0:2
3.120.53.177
34.202.169.36
34.242.238.135
50.17.52.222
52.215.56.157
52.52.145.59
52.8.142.247
54.217.253.41
54.246.117.210
63.32.166.115
66.117.28.86
66.117.29.6
04c7fc62027de4c79f20a877f16b3fe9ecc2c45c647cb632b92f0d442784991c
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e
24038492cb3d19fef34ce0a9bc55033f3030c04eeea97a93c22b2ec8914c1316
26e382d9c4380bd0293c2d41be30b754a01fb09db5d2e5c6b60bbd0368efb2ed
30e75a31aeb8852a5d0455a2b30c74200c55348d33f46758a360c80215a8471c
37a2d3ed4482161212f1fbf4706656bcc9b247035a772840ea588e712d6e0270
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
4983cd18419e417077dcc013922828394049ce6c65db6a782d2d73f225d46089
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38
604ae5068c06ac47597ed7e1c587a0ce7d8ff6e8174a979b285169f1b3277016
68588db4f09f1982d74887644c54e581cc6ed7e267f836a480c29ef1a3c0a7a0
696bac8666ce5bf4e390c7f71dc783a17fb56a3b429c6ff35dd5ad52ae254988
6d73aa32774fb131ebbc1faf3f931aaf66e998f808757cbafbcc737f8d769580
6f43e1e85c42d5e449308701054501d9867a7254c9a8734406afbc89b3dfe5b4
7f0daa7591ef2b42b26dd9d39102440c242e7fd798e7898a620e5489d67ec73e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85c6103aabd94bf4584fbdd8b15cb68c08fa52f43dc229ac034a1bf6c855c0bc
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a845f8ef9d6435077c09c3a9ec401f17f9d6b58f0f49f6014d2ff7c04d4be73c
a93d1dfea16ac5c30f63a64073fe4f27b936c092ea5bdfd971685b2c36a642e9
af780899477625834ea7cd70915f91c4cc903413e1fd8769a9117d22adcb7865
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b
bf37dba5836581c0cc0451edd5c197e46a5a0e070b3f696e5b4bf7e32da1817a
c001e01a6b6a23f4619521bb9a5cdea66124971ab04cf0211649015b0c4af1b1
c9e784c91038976835b53028e10a3f90e1508036aaba1859a820ffec8c2e9486
caa02d6bc107a0f648a41c4572b8e7fd71278b2e740e4bc809594dd3dc446c8d
cf73a7617324defcb43fcc6b0a7c2b13718a1f76fd38a7ac3d8159b07ab64127
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
db48939bec021c7c13015d86307bafa2a2f8b832700fa92806d67bb32112462e
dbeeb3fa5f0188835b6b6208bc89d641f030e79e27ad5712d427eabd79e6095a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5c2f85b9e49be5acd30c8ba3767b124d8945f35000eef89902a0485c04e6040
eb6058ea8eec777d07e89407b55de7990eb296b3f5a5ee4a6b04c71d3c129c42
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2bf5964adbfac80827ae87c5f7c0f05e51f416e3e2132fd93dc2e2d98f2e935
f7f7adc0680af0b48f4168a9fd3daff9395877ab7c02e4210474890a104d5853
f85c6f4c7b29ceefd68ee623afc132206bf2e18994732608d8e28b3a9c2486c4