Submitted URL: https://t.co/IvwHgUmxJ5
Effective URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Submission: On September 23 via api from US

Summary

This website contacted 40 IPs in 6 countries across 33 domains to perform 238 HTTP transactions. The main IP is 2001:8d8:100f:f000::289, located in Germany and belongs to ONEANDONE-AS Brauerstrasse 48, DE. The main domain is securityaffairs.co.
TLS certificate: Issued by GeoTrust RSA CA 2018 on March 8th 2020. Valid for: a year.
This is the only time securityaffairs.co was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 104.244.42.5 13414 (TWITTER)
41 2001:8d8:100f... 8560 (ONEANDONE...)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
1 2600:9000:205... 16509 (AMAZON-02)
1 2600:9000:20e... 16509 (AMAZON-02)
20 2.18.68.31 16625 (AKAMAI-AS)
8 68.183.31.14 14061 (DIGITALOC...)
10 192.0.77.2 2635 (AUTOMATTIC)
2 2a03:2880:f01... 32934 (FACEBOOK)
3 2a00:1450:400... 15169 (GOOGLE)
2 192.0.76.3 2635 (AUTOMATTIC)
4 3.127.132.197 16509 (AMAZON-02)
1 2600:9000:20e... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:20e... 16509 (AMAZON-02)
6 39 2a00:1450:400... 15169 (GOOGLE)
1 2a04:fa87:fff... 2635 (AUTOMATTIC)
9 172.217.23.162 15169 (GOOGLE)
6 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
28 2a00:1450:400... 15169 (GOOGLE)
2 104.19.135.78 13335 (CLOUDFLAR...)
1 5 34.98.64.218 15169 (GOOGLE)
2 185.64.189.112 62713 (AS-PUBMATIC)
2 54.93.169.238 16509 (AMAZON-02)
2 198.148.27.133 19189 (PULSEPOINT)
2 178.162.133.150 60781 (LEASEWEB-...)
2 185.33.221.52 29990 (ASN-APPNEX)
2 3 2606:2800:233... 15133 (EDGECAST)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
15 2a00:1450:400... 15169 (GOOGLE)
3 6 2a00:1450:400... 15169 (GOOGLE)
2 6 198.148.27.139 19189 (PULSEPOINT)
2 23.210.249.83 16625 (AKAMAI-AS)
2 23.210.249.92 16625 (AKAMAI-AS)
6 6 35.156.19.236 16509 (AMAZON-02)
1 88.99.98.226 24940 (HETZNER-AS)
4 4 52.48.46.226 16509 (AMAZON-02)
10 178.162.133.149 60781 (LEASEWEB-...)
1 1 216.58.212.162 15169 (GOOGLE)
3 3 193.0.160.129 54312 (ROCKETFUEL)
2 2 185.29.133.58 30419 (MEDIAMATH...)
6 7 213.19.147.150 3356 (LEVEL3)
238 40
Apex Domain
Subdomains
Transfer
46 googlesyndication.com
321367e28afa0a657117604da9c84c8b.safeframe.googlesyndication.com
tpc.googlesyndication.com
ca6624df3d636591ab3085d983574842.safeframe.googlesyndication.com
a0d272f7821b449096461d37c24767a2.safeframe.googlesyndication.com
pagead2.googlesyndication.com
535 KB
41 securityaffairs.co
securityaffairs.co
1 MB
21 doubleclick.net
securepubads.g.doubleclick.net
googleads.g.doubleclick.net
cm.g.doubleclick.net
314 KB
20 media.net
contextual.media.net
lg3.media.net
hblg.media.net
239 KB
15 ampproject.org
cdn.ampproject.org
321 KB
14 pixfuture.com
served-by.pixfuture.com
cdn.pixfuture.com
860 KB
12 sonobi.com
apex.go.sonobi.com
sync.go.sonobi.com
9 KB
12 wp.com
i0.wp.com
i1.wp.com
i2.wp.com
stats.wp.com
pixel.wp.com
111 KB
11 google.com
adservice.google.com
www.google.com
2 KB
8 contextweb.com
bid.contextweb.com
bh.contextweb.com
2 KB
7 sharethis.com
ws.sharethis.com
platform-api.sharethis.com
l.sharethis.com
buttons-config.sharethis.com
40 KB
6 bidswitch.net
x.bidswitch.net
2 KB
5 1rx.io
sync.1rx.io
3 KB
5 openx.net
pixfuture2-d.openx.net
eu-u.openx.net
1 KB
5 google.de
adservice.google.de
2 KB
5 googletagservices.com
www.googletagservices.com
107 KB
4 adsrvr.org
match.adsrvr.org
2 KB
4 adnxs.com
ib.adnxs.com
acdn.adnxs.com
1 KB
4 pubmatic.com
hbopenbid.pubmatic.com
ads.pubmatic.com
178 B
4 google-analytics.com
www.google-analytics.com
google-analytics.com
37 KB
3 rfihub.com
p.rfihub.com
2 KB
3 advertising.com
adserver-us.adtech.advertising.com
778 B
2 unrulymedia.com
sync.targeting.unrulymedia.com
1 KB
2 mathtag.com
sync.mathtag.com
1 KB
2 360yield.com
ice.360yield.com
620 B
2 mgid.com
prebid.mgid.com
831 B
2 facebook.net
connect.facebook.net
64 KB
1 splicky.com
bidswitch-eu.splicky.com
1 gravatar.com
secure.gravatar.com
1 KB
1 consensu.org
c.sharethis.mgr.consensu.org
1 bootstrapcdn.com
maxcdn.bootstrapcdn.com
6 KB
1 t.co
t.co
455 B
0 googleapis.com Failed
fonts.googleapis.com Failed
238 33
Domain Requested by
41 securityaffairs.co t.co
securityaffairs.co
28 tpc.googlesyndication.com securepubads.g.doubleclick.net
securityaffairs.co
cdn.ampproject.org
tpc.googlesyndication.com
pagead2.googlesyndication.com
15 cdn.ampproject.org securepubads.g.doubleclick.net
15 pagead2.googlesyndication.com cdn.pixfuture.com
securepubads.g.doubleclick.net
pagead2.googlesyndication.com
securityaffairs.co
11 contextual.media.net securityaffairs.co
contextual.media.net
10 sync.go.sonobi.com securityaffairs.co
9 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
securityaffairs.co
8 served-by.pixfuture.com securityaffairs.co
served-by.pixfuture.com
pagead2.googlesyndication.com
7 lg3.media.net securityaffairs.co
6 cm.g.doubleclick.net 6 redirects
6 x.bidswitch.net 6 redirects
6 bh.contextweb.com 2 redirects cdn.pixfuture.com
securityaffairs.co
6 googleads.g.doubleclick.net 1 redirects pagead2.googlesyndication.com
securityaffairs.co
6 www.google.com 3 redirects securityaffairs.co
6 cdn.pixfuture.com served-by.pixfuture.com
cdn.pixfuture.com
5 sync.1rx.io 5 redirects
5 adservice.google.com securepubads.g.doubleclick.net
pagead2.googlesyndication.com
5 adservice.google.de securepubads.g.doubleclick.net
pagead2.googlesyndication.com
5 www.googletagservices.com t.co
pagead2.googlesyndication.com
4 match.adsrvr.org 4 redirects
4 l.sharethis.com securityaffairs.co
ws.sharethis.com
4 i1.wp.com securityaffairs.co
4 i0.wp.com securityaffairs.co
3 p.rfihub.com 3 redirects
3 eu-u.openx.net 1 redirects cdn.pixfuture.com
3 adserver-us.adtech.advertising.com 2 redirects securityaffairs.co
3 www.google-analytics.com securityaffairs.co
www.google-analytics.com
2 hblg.media.net
2 sync.targeting.unrulymedia.com 1 redirects securityaffairs.co
2 sync.mathtag.com 2 redirects
2 ads.pubmatic.com cdn.pixfuture.com
2 acdn.adnxs.com cdn.pixfuture.com
2 ib.adnxs.com cdn.pixfuture.com
2 apex.go.sonobi.com cdn.pixfuture.com
2 bid.contextweb.com cdn.pixfuture.com
2 ice.360yield.com cdn.pixfuture.com
2 hbopenbid.pubmatic.com cdn.pixfuture.com
2 pixfuture2-d.openx.net cdn.pixfuture.com
2 prebid.mgid.com cdn.pixfuture.com
2 connect.facebook.net securityaffairs.co
connect.facebook.net
2 i2.wp.com securityaffairs.co
1 bidswitch-eu.splicky.com securityaffairs.co
1 a0d272f7821b449096461d37c24767a2.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 ca6624df3d636591ab3085d983574842.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 321367e28afa0a657117604da9c84c8b.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 pixel.wp.com securityaffairs.co
1 secure.gravatar.com securityaffairs.co
1 c.sharethis.mgr.consensu.org ws.sharethis.com
1 google-analytics.com securityaffairs.co
1 buttons-config.sharethis.com platform-api.sharethis.com
1 stats.wp.com securityaffairs.co
1 platform-api.sharethis.com securityaffairs.co
1 ws.sharethis.com securityaffairs.co
1 maxcdn.bootstrapcdn.com securityaffairs.co
1 t.co
0 fonts.googleapis.com Failed securityaffairs.co
238 56
Subject Issuer Validity Valid
t.co
DigiCert SHA2 High Assurance Server CA
2020-03-05 -
2021-03-02
a year crt.sh
www.securityaffairs.co
GeoTrust RSA CA 2018
2020-03-08 -
2021-04-07
a year crt.sh
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA
2019-09-14 -
2020-10-13
a year crt.sh
sharethis.com
Amazon
2020-08-17 -
2021-09-16
a year crt.sh
*.media.net
DigiCert SHA2 Secure Server CA
2020-02-25 -
2021-05-26
a year crt.sh
served-by.pixfuture.com
Sectigo RSA Domain Validation Secure Server CA
2019-04-15 -
2021-04-24
2 years crt.sh
*.wp.com
Sectigo RSA Domain Validation Secure Server CA
2020-04-02 -
2022-07-05
2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2020-09-11 -
2020-12-10
3 months crt.sh
*.google-analytics.com
GTS CA 1O1
2020-08-26 -
2020-11-18
3 months crt.sh
*.google.com
GTS CA 1O1
2020-08-26 -
2020-11-18
3 months crt.sh
sharethis.mgr.consensu.org
Amazon
2020-05-05 -
2021-06-05
a year crt.sh
*.g.doubleclick.net
GTS CA 1O1
2020-08-26 -
2020-11-18
3 months crt.sh
*.gravatar.com
Sectigo RSA Domain Validation Secure Server CA
2020-08-14 -
2022-11-16
2 years crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-07-18 -
2021-07-18
a year crt.sh
*.google.de
GTS CA 1O1
2020-08-26 -
2020-11-18
3 months crt.sh
tpc.googlesyndication.com
GTS CA 1O1
2020-08-26 -
2020-11-18
3 months crt.sh
*.openx.net
GeoTrust RSA CA 2018
2020-06-18 -
2021-08-17
a year crt.sh
*.pubmatic.com
Sectigo RSA Organization Validation Secure Server CA
2019-02-22 -
2021-02-21
2 years crt.sh
*.360yield.com
Amazon
2020-08-26 -
2021-09-26
a year crt.sh
*.contextweb.com
DigiCert SHA2 Secure Server CA
2020-05-07 -
2022-05-12
2 years crt.sh
*.go.sonobi.com
Go Daddy Secure Certificate Authority - G2
2019-02-01 -
2021-02-04
2 years crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA
2019-01-23 -
2021-03-08
2 years crt.sh
*.adtech.advertising.com
DigiCert SHA2 Secure Server CA
2020-04-16 -
2022-04-21
2 years crt.sh
misc-sni.google.com
GTS CA 1O1
2020-08-26 -
2020-11-18
3 months crt.sh
cdn.adnxs.com
GeoTrust RSA CA 2018
2020-01-02 -
2021-04-02
a year crt.sh
*.splicky.com
Let's Encrypt Authority X3
2020-08-19 -
2020-11-17
3 months crt.sh
*.targeting.unrulymedia.com
DigiCert SHA2 Secure Server CA
2020-05-04 -
2022-05-09
2 years crt.sh

This page contains 31 frames:

Primary Page: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Frame ID: 4B8D56D1EAD334912F5C7A41A3395AF7
Requests: 93 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal-v2.html
Frame ID: 4075CE0917E420903246D9B67FC66445
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HB41O6BH&prvid=77%2C80%2C82%2C97%2C109%2C148%2C175%2C178%2C184%2C188%2C192%2C193%2C201%2C203%2C214%2C222%2C226%2C3008&refUrl=https%3A%2F%2Ft.co&rtime=8&https=1&gdpr=1&gdprconsent=2&usp_status=0&usp_consent=1
Frame ID: 11F62BEE7A4F0E6C9968A81AA37C9AEB
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: C9A38C967807FABDEAD33E2503E11541
Requests: 10 HTTP requests in this frame

Frame: https://served-by.pixfuture.com/www/delivery/headerbid_refresh_alex.php?dat=24272x320x50x4142x_ADSLOT1&keywords=groupib,detects,series,ransomware,attacks,oldgremlinsecurity,affairs&refUrl=https://t.co/IvwHgUmxJ5&refresh=false&innerWidth=1600
Frame ID: CA70ED64B30A2023A8D4AD62CD30B06C
Requests: 1 HTTP requests in this frame

Frame: https://served-by.pixfuture.com/www/delivery/headerbid_refresh_alex.php?dat=24270x300x250x4142x_ADSLOT1&keywords=groupib,detects,series,ransomware,attacks,oldgremlinsecurity,affairs&refUrl=https://t.co/IvwHgUmxJ5&refresh=false&innerWidth=1600
Frame ID: 4A7C7545A78AFE0F55A48E5EC48A482D
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: 58E970F6EAAE51C5132340EACA64B8FF
Requests: 10 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: A8F2BBA48387AC5308B2CF990A7B7C48
Requests: 10 HTTP requests in this frame

Frame: https://cdn.pixfuture.com/djax_elastic.js
Frame ID: EB269849BE2202ECF7771AA8653CA664
Requests: 20 HTTP requests in this frame

Frame: https://cdn.pixfuture.com/djax_elastic.js
Frame ID: D881819677386D5AB720C750EB571660
Requests: 19 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 34C2F145536FCB5DCF29C388BDEFCDB0
Requests: 8 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012009010507000/amp4ads-v0.js
Frame ID: EBE36CDBCA00F8930BB3012325867A0C
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20200921/r20190131/zrt_lookup.html
Frame ID: 0DB160F16C2DE1711B135B1544C0C89C
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012009010507000/amp4ads-v0.js
Frame ID: E6B68E4FC04335BDD8D4ED0E11B63F7E
Requests: 15 HTTP requests in this frame

Frame: https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5531
Frame ID: 6B8732839AE53D894B2B1C569CA9E74C
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012009010507000/amp4ads-v0.js
Frame ID: 6EBA0CBF8A2CADE6552DA2EFD5A5321C
Requests: 12 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Frame ID: 6847F1EE38E4ECD295B9DA0967771FED
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Frame ID: CDE8BB64AE01CA57FA6BB82951F5EA6B
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Frame ID: 185939F01B9C951C3679555679356BB8
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 72A832FBE3BC8D7AF6E251ACB7C5223E
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=1680648786&adk=1022037533&adf=1357492134&w=300&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&ea=0&flash=0&wgl=1&dt=1600886310971&bpp=5&bdt=64&idt=92&shv=r20200921&cbv=r20190131&ptt=5&saldr=sa&correlator=6004642682137&frm=23&ife=1&pv=1&ga_vid=1797332611.1600886311&ga_sid=1600886311&ga_hid=1286253930&ga_fc=0&iag=63&icsg=170&nhd=3&dssz=6&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&isw=0&ish=0&ifk=1585841457&scr_x=0&scr_y=0&oid=3&pvsid=3335063561645774&pem=624&ref=https%3A%2F%2Ft.co%2FIvwHgUmxJ5&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C0&vis=1&rsz=%7C%7CEr%7C&abl=CS&pfx=0&fu=8196&bc=31&ifi=1&uci=1.aghmwxxniyuh&fsb=1&dtd=100
Frame ID: 9CFDD977CE4F2CD41C72319A8BE441CC
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Frame ID: E9AE1F48A00DE5BBF16598C04FB1E422
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Frame ID: DDD9DDA8FD711FE1F82D7576751AED26
Requests: 1 HTTP requests in this frame

Frame: https://bh.contextweb.com/visitormatch
Frame ID: 572833A00F7EC5D1F3220656A4743031
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 179B31EDEEEC17CD87DBF775090DAA83
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: E9A15A01648393BDFFBEF5831202C9C6
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Frame ID: 5B40785AF157C3E39A7FEBE662769E1D
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Frame ID: B0C49F027CB703C6676AF72EE401C393
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 78E1290FC3B426402412D0AD36E78F25
Requests: 1 HTTP requests in this frame

Frame: https://bh.contextweb.com/visitormatch
Frame ID: 6855A1FC24BAB82F341EC58A220A09AD
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 1E72E18ABD7A7FE79E0100917A007793
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://t.co/IvwHgUmxJ5 Page URL
  2. https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

238
Requests

98 %
HTTPS

43 %
IPv6

33
Domains

56
Subdomains

40
IPs

6
Countries

3713 kB
Transfer

6637 kB
Size

32
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://t.co/IvwHgUmxJ5 Page URL
  2. https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 115
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/9834/3344884/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=19a311f1fd613ff;misc=1600886309990; HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/9834/3344884/0/0/ADTECH;cfp=1;rndc=1600886309;v=2;cmd=bid;cors=yes;alias=19a311f1fd613ff;misc=1600886309990 HTTP 302
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/9834/3344884/0/0/ADTECH;apid=1Afa07391e-fdcb-11ea-8414-126272b4dea0;cfp=1;rndc=1600886309;v=2;cmd=bid;cors=yes;alias=19a311f1fd613ff;misc=1600886309990
Request Chain 164
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 167
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=1139220782&adk=2470624294&adf=1357492129&w=320&lmt=1600886310&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&flash=0&wgl=1&dt=1600886310462&bpp=21&bdt=100&idt=213&shv=r20200921&cbv=r20190131&ptt=5&saldr=sa&correlator=6004642682137&frm=21&ife=1&pv=2&ga_vid=1733541230.1600886311&ga_sid=1600886311&ga_hid=280348028&ga_fc=0&iag=63&icsg=170&nhd=3&dssz=6&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=3861&biw=1600&bih=1200&isw=320&ish=50&ifk=3598855087&scr_x=0&scr_y=0&eid=21066428%2C21067348&oid=3&pvsid=1111301735696087&pem=624&ref=https%3A%2F%2Ft.co%2FIvwHgUmxJ5&rx=0&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=8196&bc=31&ifi=1&uci=1.suzrxolcvt94&btvi=1&fsb=1&xpc=zlButlzMkh&p=https%3A//securityaffairs.co&dtd=232 HTTP 302
  • https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5531
Request Chain 188
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 189
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 214
  • https://x.bidswitch.net/sync?ssp=sonobi HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=sonobi HTTP 302
  • https://bidswitch-eu.splicky.com/cm?bidswitch_ssp_id=sonobi&bsw_custom_parameter=5b56abc1-1b9c-4c0f-b9e6-aafb84d19301
Request Chain 215
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=0b24fdfc82&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=0b24fdfc82&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=td&nuid=70991e68-ae8e-4ace-a893-d4a0387c084b&pubid=0b24fdfc82
Request Chain 216
  • https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_cm&google_hm=MTdmMTc3N2EtNTViMC00ZDc0LTgzOTctYzc1YTViY2FjZmQ4 HTTP 302
  • https://sync.go.sonobi.com/usg.gif?google_gid=CAESEAXYegOu22LPYjze1glTQdI&google_cver=1
Request Chain 217
  • https://p.rfihub.com/cm?pub=35683&in=1 HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=zt&nuid=2159827872193790504
Request Chain 218
  • https://sync.mathtag.com/sync/img?cs_wd_sy=1&dp=43&redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dmediamath%26nuid%3D[MM_UUID] HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=3bd65f6b-9627-4100-b71b-36895b4db4d5
Request Chain 219
  • https://sync.1rx.io/usersync2/sonobi&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2246676445 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/70991e68-ae8e-4ace-a893-d4a0387c084b HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/70991e68-ae8e-4ace-a893-d4a0387c084b?zcc=1&dspret=0&cb=1600886311677 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-f24b1df4-e8dc-41d6-abaf-9d88193ea827-003
Request Chain 220
  • https://bh.contextweb.com/bh/rtset?do=add&pid=560606&ev=17f1777a-55b0-4d74-8397-c75a5bcacfd8&daaqp=1&rurl=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dpp%26nuid%3D%25%25VGUID%25%25 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=X1hKdjJtZzRQTjNrM2NRVGpLdk5rdw&gdpr=&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm=&google_sc=&google_hm=X1hKdjJtZzRQTjNrM2NRVGpLdk5rdw&gdpr=&gdpr_consent=&google_tc= HTTP 302
  • https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=&gdpr_consent=&ev=CAESEMVFqaaW7Z6ElhRj_psRp9w&google_cver=1
Request Chain 226
  • https://p.rfihub.com/cm?pub=35683&in=1 HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=zt&nuid=1871878971747009633
Request Chain 227
  • https://x.bidswitch.net/sync?ssp=sonobi HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=sonobi&bsw_param=09c5b672-9a17-401c-ae54-ab48fa723d79&google_hm=MDljNWI2NzItOWExNy00MDFjLWFlNTQtYWI0OGZhNzIzZDc5 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEM4PhbzwA2iXCDqZ736HM0g&google_cver=1&ssp=sonobi&bsw_param=09c5b672-9a17-401c-ae54-ab48fa723d79 HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=09c5b672-9a17-401c-ae54-ab48fa723d79
Request Chain 228
  • https://sync.1rx.io/usersync2/sonobi&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-f24b1df4-e8dc-41d6-abaf-9d88193ea827-003&rndcb=2868726503 HTTP 302
  • https://p.rfihub.com/cm?in=1&pub=20513&ssp=adconductor HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=1871878971747009633&expires=30&ssp=adconductor HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/09c5b672-9a17-401c-ae54-ab48fa723d79?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-f24b1df4-e8dc-41d6-abaf-9d88193ea827-003?redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Drhythmxchange%26nuid%3DRX-f24b1df4-e8dc-41d6-abaf-9d88193ea827-003 HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=rhythmxchange&nuid=RX-f24b1df4-e8dc-41d6-abaf-9d88193ea827-003
Request Chain 229
  • https://sync.mathtag.com/sync/img?cs_wd_sy=1&dp=43&redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dmediamath%26nuid%3D[MM_UUID] HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=c5ea5f6b-9627-4400-9f0a-ce73dd1f77dd
Request Chain 230
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=0b24fdfc82&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=td&nuid=3f7a93bf-aab2-4968-b6b3-42ababafc88b&pubid=0b24fdfc82
Request Chain 231
  • https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0 HTTP 302
  • https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Request Chain 235
  • https://bh.contextweb.com/bh/rtset?do=add&pid=560606&ev=617fe50d-78ef-499a-ba13-099a16ba9233&daaqp=1&rurl=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dpp%26nuid%3D%25%25VGUID%25%25 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=dnpzSGl6RHN1TW05Z1c1RmRkZkdVZw&gdpr=&gdpr_consent= HTTP 302
  • https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=&gdpr_consent=&ev=CAESEMVFqaaW7Z6ElhRj_psRp9w&google_cver=1
Request Chain 236
  • https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_cm&google_hm=NjE3ZmU1MGQtNzhlZi00OTlhLWJhMTMtMDk5YTE2YmE5MjMz HTTP 302
  • https://sync.go.sonobi.com/usg.gif?google_gid=CAESEIkHeORHWA82ANjOOUOl3Nw&google_cver=1

238 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
IvwHgUmxJ5
t.co/
416 B
455 B
Document
General
Full URL
https://t.co/IvwHgUmxJ5
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.5 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
8544f21a9a07940f2bdf465d82b1d476e38e68da5d90a487c6e2b905d6b29e83
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Request headers

:method
GET
:authority
t.co
:scheme
https
:path
/IvwHgUmxJ5
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
cache-control
private,max-age=300
content-encoding
gzip
content-length
232
content-type
text/html; charset=utf-8
date
Wed, 23 Sep 2020 18:38:22 GMT
expires
Wed, 23 Sep 2020 18:43:21 GMT
server
tsa_f
set-cookie
muc=734f3d4d-d5a7-4021-b5ab-81a7aeeb0887; Max-Age=63072000; Expires=Fri, 23 Sep 2022 18:38:21 GMT; Domain=t.co; Secure; SameSite=None
strict-transport-security
max-age=0
vary
Origin
x-connection-hash
69c13dd2a95cb3b8907cd586d56e60c4
x-response-time
112
x-xss-protection
0
Primary Request oldgremlin-ransomware-attacks.html
securityaffairs.co/wordpress/108644/malware/
84 KB
24 KB
Document
General
Full URL
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Requested by
Host: t.co
URL: https://t.co/IvwHgUmxJ5
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache / PHP/7.2.33
Resource Hash
66156947218c139e42fec91f2a7898786d08df3b7e05e89ec8925415e831432e

Request headers

:method
GET
:authority
securityaffairs.co
:scheme
https
:path
/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://t.co/IvwHgUmxJ5
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://t.co/IvwHgUmxJ5

Response headers

status
200
content-type
text/html; charset=UTF-8
date
Wed, 23 Sep 2020 18:38:22 GMT
server
Apache
x-powered-by
PHP/7.2.33
vary
Accept-Encoding,Cookie
cache-control
max-age=3, must-revalidate
content-encoding
gzip
style.css
securityaffairs.co/wordpress/wp-includes/css/dist/block-library/
64 KB
64 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/css/dist/block-library/style.css?ver=ab666092e6aa075ec4beae7c3cab6002
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
093fa1b3be5a5ed806dc8873e932ce049231b1b9bab39fb85e63ab8229d57c0b

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Tue, 01 Sep 2020 21:33:33 GMT
server
Apache
etag
"fe23-5ae47455cdf29"
content-type
text/css
status
200
accept-ranges
bytes
content-length
65059
cookie-law-info-public.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/
3 KB
3 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=1.9.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
b8fa20af264fcdd99621fc4e3a770927452b0fe382599e0d890a3bfa31152f80

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Thu, 10 Sep 2020 22:51:46 GMT
server
Apache
etag
"c25-5aefd69b3c055"
content-type
text/css
status
200
accept-ranges
bytes
content-length
3109
cookie-law-info-gdpr.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/
27 KB
27 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=1.9.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
d44b68c7b3e659196a6a72662f4e2e903044d6e64a6a5c0002602711cd68a8fa

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Thu, 10 Sep 2020 22:51:46 GMT
server
Apache
etag
"6cdf-5aefd69b3c055"
content-type
text/css
status
200
accept-ranges
bytes
content-length
27871
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/
23 KB
6 KB
Stylesheet
General
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css?ver=ab666092e6aa075ec4beae7c3cab6002
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 12 Dec 2018 18:35:19 GMT
status
200
etag
"1544639719"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
5442
custom.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/
19 KB
20 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/custom.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Wed, 16 Dec 2015 13:54:59 GMT
server
Apache
etag
"4d92-52704407f72c0"
content-type
text/css
status
200
accept-ranges
bytes
content-length
19858
tipsy.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
539 B
683 B
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/tipsy.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Wed, 16 Dec 2015 06:58:04 GMT
server
Apache
etag
"21b-526fe6d7cd700"
content-type
text/css
status
200
accept-ranges
bytes
content-length
539
flexslider.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/
6 KB
6 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/flexslider.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Wed, 16 Dec 2015 13:55:09 GMT
server
Apache
etag
"1851-5270441180940"
content-type
text/css
status
200
accept-ranges
bytes
content-length
6225
mediaelementplayer-legacy.min.css
securityaffairs.co/wordpress/wp-includes/js/mediaelement/
11 KB
11 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.13-9993131
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
b834a80037718e3da7f92199034dc59611ed774af41f1e84fa1e0d97c4261192

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Wed, 13 Nov 2019 23:52:08 GMT
server
Apache
etag
"2ca1-597430d7ee92b"
content-type
text/css
status
200
accept-ranges
bytes
content-length
11425
animation.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
2 KB
2 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/animation.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Wed, 16 Dec 2015 06:58:02 GMT
server
Apache
etag
"6b4-526fe6d5e5280"
content-type
text/css
status
200
accept-ranges
bytes
content-length
1716
font-awesome.min.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
17 KB
18 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Wed, 16 Dec 2015 06:58:02 GMT
server
Apache
etag
"4574-526fe6d5e5280"
content-type
text/css
status
200
accept-ranges
bytes
content-length
17780
swipebox.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
4 KB
5 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/swipebox.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Wed, 16 Dec 2015 06:58:18 GMT
server
Apache
etag
"118d-526fe6e527680"
content-type
text/css
status
200
accept-ranges
bytes
content-length
4493
jquery.circliful.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
334 B
478 B
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jquery.circliful.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Wed, 16 Dec 2015 06:58:02 GMT
server
Apache
etag
"14e-526fe6d5e5280"
content-type
text/css
status
200
accept-ranges
bytes
content-length
334
screen.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
110 KB
110 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/screen.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Wed, 16 Dec 2015 06:58:04 GMT
server
Apache
etag
"1b844-526fe6d7cd700"
content-type
text/css
status
200
accept-ranges
bytes
content-length
112708
custom-css.php
securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/
12 KB
12 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/custom-css.php?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache / PHP/7.2.33
Resource Hash
18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Wed, 23 Sep 2020 18:38:22 GMT
server
Apache
x-powered-by
PHP/7.2.33
content-type
text/css; charset: UTF-8;charset=UTF-8
grid.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
49 KB
50 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/grid.css?ver=ab666092e6aa075ec4beae7c3cab6002
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Wed, 16 Dec 2015 06:58:03 GMT
server
Apache
etag
"c5f2-526fe6d6d94c0"
content-type
text/css
status
200
accept-ranges
bytes
content-length
50674
frontend.js
securityaffairs.co/wordpress/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/
23 KB
23 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/frontend.js?ver=1600885241
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
9b5b9b8b1984a7b55656ca3d243deb436e049467353f6e61e73ac8bd0ab2a636

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Tue, 11 Aug 2020 22:25:27 GMT
server
Apache
etag
"5b01-5aca18c51f533"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
23297
jquery.js
securityaffairs.co/wordpress/wp-includes/js/jquery/
95 KB
95 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Tue, 21 May 2019 21:49:10 GMT
server
Apache
etag
"17a69-5896cd1a361be"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
96873
cookie-law-info-public.js
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/
33 KB
33 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=1.9.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
fec6411c0449c2f2b631cdb40900e968c49501f4e92e7b12e75e1e1bc6ed2813

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Thu, 10 Sep 2020 22:51:46 GMT
server
Apache
etag
"8344-5aefd69b3cff5"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
33604
st_insights.js
ws.sharethis.com/button/
25 KB
8 KB
Script
General
Full URL
https://ws.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b200:3:c04e:c780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
b397f92e5f197af9b4d9ceac02bdb1e06c304fb8fc8b22ce7689eb0e837a4e78

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 03:38:49 GMT
content-encoding
gzip
age
53973
x-cache
Hit from cloudfront
status
200
content-length
7377
server
nginx/1.16.1
etag
"5f4b0a17-6446"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 507b5edb20d0e1a0b73c8687f53defa9.cloudfront.net (CloudFront)
cache-control
max-age=259200
x-amz-cf-pop
FRA6-C1
x-robots-tag
noindex, nofollow
x-amz-cf-id
BQtP4psZp092JuZSb8b_12HZBjYJ1PsFHsXOoVy0xGGtNKS4jzgpFw==
expires
Sat, 26 Sep 2020 03:38:49 GMT
sharethis.js
platform-api.sharethis.com/js/
98 KB
31 KB
Script
General
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20e8:0:1c:8a07:5e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
ec4344adc742b2fbf294aeb340c91f1119885d17d96912e7163d2eec59a1ab69

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:36:15 GMT
content-encoding
gzip
age
140
etag
W/"1867f-xSYf4UVSCF6CF7Uc3P7bbVwijO0"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript; charset=utf-8
status
200
edge-control
cache-maxage=60m,downstream-ttl=60m
cache-control
max-age=600, public
x-amz-cf-pop
TXL52-C1
x-amz-cf-id
b9jWjlV07xl59m4dWlaWAS_hOOjkPdlzjnivS8pTmSSbt2eWdAX15A==
via
1.1 960b0b60c4f1507c51c75d8f9ab0dc91.cloudfront.net (CloudFront)
shield-antibot.js
securityaffairs.co/wordpress/wp-content/plugins/wp-simple-firewall/resources/js/
3 KB
3 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/wp-simple-firewall/resources/js/shield-antibot.js?ver=9.2.1&mtime=1599258549
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
d24350e3a8c6e3963544189c3d0cfcd8c11e5dbac0de76aace83993b7d16dcf6

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:22 GMT
last-modified
Fri, 04 Sep 2020 22:29:09 GMT
server
Apache
etag
"c00-5ae8465bab616"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
3072
logo_SecurityAffairs.png
securityaffairs.co/wordpress/wp-content/uploads/2015/12/
44 KB
44 KB
Image
General
Full URL
https://securityaffairs.co/wordpress/wp-content/uploads/2015/12/logo_SecurityAffairs.png
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Wed, 16 Dec 2015 17:30:42 GMT
server
Apache
etag
"b0e9-5270743f5f480"
content-type
image/png
status
200
accept-ranges
bytes
content-length
45289
dmedianet.js
contextual.media.net/
486 KB
153 KB
Script
General
Full URL
https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e2eedfde61c7fe016ea75d948808661cb0efd7c380ec14e8eb4d6de1bf10d605
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-mnt-h
8-10
content-encoding
gzip
server
Apache
p3p
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
etag
"499b42484623b65487e967ba3775b47d"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
status
200
cache-control
max-age=3600
date
Wed, 23 Sep 2020 18:38:23 GMT
strict-transport-security
max-age=604800
x-mnt-w
8-10
expires
Wed, 23 Sep 2020 19:38:23 GMT
headerbid.js
served-by.pixfuture.com/www/delivery/
9 KB
10 KB
Script
General
Full URL
https://served-by.pixfuture.com/www/delivery/headerbid.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
6083ab99860d08b524463c0a71edb943916013b9dfb088c99afcdd92131cf8fe

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 23 Sep 2020 18:38:24 GMT
Last-Modified
Tue, 15 Sep 2020 19:50:17 GMT
Server
nginx/1.10.3 (Ubuntu)
ETag
"5f611af9-257e"
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800, public, no-transform
Access-Control-Allow-Credentials
true
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Content-Length
9598
Expires
Fri, 25 Sep 2020 18:38:24 GMT
facebook.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
830 B
1 KB
Image
General
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i2.wp.com
Software
nginx /
Resource Hash
4c6b4ef22f4c5dd8fd6e17ab6706d8c55d236824c20b3d8dcd310f7de744def6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT fra 5
date
Wed, 23 Sep 2020 18:38:24 GMT
x-content-type-options
nosniff
last-modified
Fri, 29 May 2020 00:29:27 GMT
server
nginx
etag
"dbe93691e63f1284"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png>; rel="canonical"
content-length
830
expires
Sun, 29 May 2022 12:29:27 GMT
twitter.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
1 KB
1 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i2.wp.com
Software
nginx /
Resource Hash
7a8cf6b7fce01f318e416ae1904132265526ca2b6ef3003f7fe831186a7380a0
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT fra 4
date
Wed, 23 Sep 2020 18:38:24 GMT
x-content-type-options
nosniff
last-modified
Thu, 22 Nov 2018 08:33:48 GMT
server
nginx
etag
"f41e738ae7ad1725"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png>; rel="canonical"
content-length
1082
expires
Sat, 21 Nov 2020 20:33:48 GMT
linkedin.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
1 KB
1 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i2.wp.com
Software
nginx /
Resource Hash
b97d80b9eedfeb29936f0d7f89afbdd425ef8d930d09fa1f98030ceb8b26cabd
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT fra 8
date
Wed, 23 Sep 2020 18:38:24 GMT
x-content-type-options
nosniff
last-modified
Sun, 31 May 2020 04:19:55 GMT
server
nginx
etag
"b579a08833146717"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png>; rel="canonical"
content-length
1184
expires
Tue, 31 May 2022 16:19:55 GMT
reddit.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
2 KB
2 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/reddit.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i2.wp.com
Software
nginx /
Resource Hash
56159a7fa211c042c8da7005984653715f938917383f74292247f7b271469fb6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT fra 5
date
Wed, 23 Sep 2020 18:38:24 GMT
x-content-type-options
nosniff
last-modified
Sun, 31 May 2020 04:19:55 GMT
server
nginx
etag
"7c44911b1de4805a"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/reddit.png>; rel="canonical"
content-length
1566
expires
Tue, 31 May 2022 16:19:55 GMT
pinterest.png
i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
1 KB
2 KB
Image
General
Full URL
https://i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/pinterest.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i2.wp.com
Software
nginx /
Resource Hash
3afe47d0fe0b16bc5bddecdc9bcaca94ed420b8fd0ddee2ae77364403c794bb8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT fra 7
date
Wed, 23 Sep 2020 18:38:24 GMT
x-content-type-options
nosniff
x-bytes-saved
1227
last-modified
Mon, 04 Feb 2019 06:29:18 GMT
server
nginx
etag
"9a8b1a5335d6cfb5"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/pinterest.png>; rel="canonical"
content-length
1502
expires
Wed, 03 Feb 2021 18:29:18 GMT
shopify.jpg
securityaffairs.co/wordpress/wp-content/uploads/2019/04/
99 KB
100 KB
Image
General
Full URL
https://securityaffairs.co/wordpress/wp-content/uploads/2019/04/shopify.jpg
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
f54a0604a7f979b4e5bd1f5ae2b5c780ee94a91d43b7dc719ac78cbbf41a2060

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:24 GMT
last-modified
Sun, 21 Apr 2019 22:04:17 GMT
server
Apache
etag
"18de3-58711887d47dc"
content-type
image/jpeg
status
200
accept-ranges
bytes
content-length
101859
Sandvine-device.jpg
securityaffairs.co/wordpress/wp-content/uploads/2018/03/
46 KB
46 KB
Image
General
Full URL
https://securityaffairs.co/wordpress/wp-content/uploads/2018/03/Sandvine-device.jpg
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
4e122620f7885cc60dbd04f68bbbb4b38096028684711bf2a1d370b31469be31

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:24 GMT
last-modified
Sat, 10 Mar 2018 21:19:05 GMT
server
Apache
etag
"b7f8-5671575652029"
content-type
image/jpeg
status
200
accept-ranges
bytes
content-length
47096
sdk.js
connect.facebook.net/en_US/
3 KB
2 KB
Script
General
Full URL
https://connect.facebook.net/en_US/sdk.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
1ab970ff1c0ee9608c6ff1bf5b69cb7849878970c08dd775ad7cb846ff55d93e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
ky7sPBXUXZTXsYnOzUI4Ig==
status
200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1776
etag
"1e4238be8d5473faa35b1e78c65f3cc3"
x-fb-debug
u8QhIfDb5VX0HQBH35G1mCcQROtn8pHF0A8IMx+aMYwZVvN7Rlg+zw6BSFnR+FxAy4OKWvuICQYSzYHEphYTAw==
x-fb-trip-id
664085054
x-fb-content-md5
fb033c5d31412ca4c8bc8dd21f0b1a83
x-frame-options
DENY
date
Wed, 23 Sep 2020 18:38:24 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin
*
expires
Wed, 23 Sep 2020 18:56:01 GMT
analytics.js
www.google-analytics.com/
45 KB
18 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 09 Sep 2020 01:50:37 GMT
server
Golfe2
age
283
date
Wed, 23 Sep 2020 18:33:41 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18650
expires
Wed, 23 Sep 2020 20:33:41 GMT
twemoji.js
securityaffairs.co/wordpress/wp-includes/js/
27 KB
28 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/twemoji.js?ver=ab666092e6aa075ec4beae7c3cab6002
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
ee657fa9cbe48aeeda44b31ed4ae2ca1d021a82e301e36a456eafb7c8dda7fb7

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:24 GMT
last-modified
Tue, 11 Aug 2020 22:24:47 GMT
server
Apache
etag
"6d6a-5aca189f1cc8c"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
28010
wp-emoji.js
securityaffairs.co/wordpress/wp-includes/js/
9 KB
9 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/wp-emoji.js?ver=ab666092e6aa075ec4beae7c3cab6002
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
e503c59c36fc19803b2e9572b10e7c06236bda692aebd97f29e2a5a96f9aa5b6

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:24 GMT
last-modified
Tue, 31 Mar 2020 22:49:14 GMT
server
Apache
etag
"231d-5a22e608152f1"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
8989
css
fonts.googleapis.com/
0
0

css
fonts.googleapis.com/
0
0

css
fonts.googleapis.com/
0
0

css
fonts.googleapis.com/
0
0

APT28-NATO-courses_zipx.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/09/
5 KB
5 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/09/APT28-NATO-courses_zipx.png?resize=300%2C300&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i2.wp.com
Software
nginx /
Resource Hash
abee762892c40f51a87e6cb1b4412c35324d74881059ff3772fb102aab687ee7
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT fra 3
date
Wed, 23 Sep 2020 18:38:24 GMT
x-content-type-options
nosniff
last-modified
Wed, 23 Sep 2020 09:55:21 GMT
server
nginx
etag
"3ed4160cb9ee2972"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2020/09/APT28-NATO-courses_zipx.png>; rel="canonical"
content-length
5280
expires
Fri, 23 Sep 2022 21:55:21 GMT
ssba.css
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/
122 KB
122 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/ssba.css?ver=ab666092e6aa075ec4beae7c3cab6002
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
f4d4eda42f85c6ccbbb5de2aff596085b3b1d380c8585464f2e53df2cad66f8e

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Wed, 16 Sep 2020 22:37:21 GMT
server
Apache
etag
"1e76e-5af75e92c24d8"
content-type
text/css
status
200
accept-ranges
bytes
content-length
124782
photon.js
securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/
2 KB
2 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/photon.js?ver=20191001
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
e2dc35b0dbaa16b45d96eb3691927df48e091f4983ed2cc079568b789f9559da

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Wed, 16 Sep 2020 22:37:14 GMT
server
Apache
etag
"6e0-5af75e8bea561"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
1760
jquery.adrotate.clicktracker.js
securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/
365 B
519 B
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/jquery.adrotate.clicktracker.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
65cfa6801a0886fab249b224e8a6982b4740fe7879fce99ff13ddaac9aaca01a

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Tue, 08 Sep 2020 22:15:46 GMT
server
Apache
etag
"16d-5aed4ad3d5ee2"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
365
ssba.js
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/
2 KB
2 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/ssba.js?ver=ab666092e6aa075ec4beae7c3cab6002
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
76a18f5f0637e0d73ce1afece898ce8b0fa75bb6b1c1990ae4a7ac6b083045ce

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Wed, 16 Sep 2020 22:37:21 GMT
server
Apache
etag
"792-5af75e92c8298"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
1938
hint.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
987 B
1 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/hint.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"3db-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
987
jquery.tipsy.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
4 KB
4 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.tipsy.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"1113-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
4371
jquery.easing.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
8 KB
8 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.easing.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"1fa1-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
8097
browser.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
3 KB
3 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/browser.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Wed, 16 Dec 2015 06:58:16 GMT
server
Apache
etag
"a36-526fe6e33f200"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
2614
jquery.flexslider-min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/
21 KB
21 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/jquery.flexslider-min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Wed, 16 Dec 2015 13:55:10 GMT
server
Apache
etag
"53ae-5270441274b80"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
21422
waypoints.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
8 KB
8 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/waypoints.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Wed, 16 Dec 2015 06:58:18 GMT
server
Apache
etag
"1f6c-526fe6e527680"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
8044
mediaelement-and-player.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/
69 KB
70 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/mediaelement-and-player.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Wed, 16 Dec 2015 13:55:14 GMT
server
Apache
etag
"11571-5270441645480"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
71025
jquery.swipebox.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
11 KB
11 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.swipebox.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"2a67-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
10855
jquery.circliful.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
3 KB
3 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.circliful.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"c18-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
3096
jquery.smarticker.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
13 KB
13 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.smarticker.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
etag
"3225-526fe6e433440"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
12837
custom.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
12 KB
13 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/custom.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Wed, 16 Dec 2015 06:58:16 GMT
server
Apache
etag
"31d4-526fe6e33f200"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
12756
wp-embed.js
securityaffairs.co/wordpress/wp-includes/js/
3 KB
3 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/wp-embed.js?ver=ab666092e6aa075ec4beae7c3cab6002
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
d931ba2089021a1357761939c18bcc09aa856d39be2a707ea450333f5b3443c4

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:23 GMT
last-modified
Thu, 21 Feb 2019 22:56:38 GMT
server
Apache
etag
"c8e-5826f6315ef61"
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
3214
e-202039.js
stats.wp.com/
9 KB
3 KB
Script
General
Full URL
https://stats.wp.com/e-202039.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:24 GMT
content-encoding
gzip
server
nginx
etag
W/"5c6340e3-350a"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
expires
Sun, 19 Sep 2021 22:23:43 GMT
sdk.js
connect.facebook.net/en_US/
201 KB
61 KB
Script
General
Full URL
https://connect.facebook.net/en_US/sdk.js?hash=95ea5c7ac81462eee669d7aeb38abbba&ua=modern_es6
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
bf0195350deb65b5c27ae5f781df87bd0be699111f87cd3615871920ccd1ad2d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Origin
https://securityaffairs.co
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
+bZqoXulIY3awh7FCa5RgA==
status
200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
62344
etag
"7cf1e9934cfe4e07762bd34ff7d3ae7f"
x-fb-debug
M5ioGiFJBW2FwCKqKeqpBPJLwQwp8cqkNLVKTB+1TArbPuzMfM8FrT+BCCUIl2sJG2F3ElDbU4U7r9jiKbjdnQ==
x-fb-trip-id
664085054
x-fb-content-md5
e73bcaf001174a75d758367c2be75c0f
x-frame-options
DENY
date
Wed, 23 Sep 2020 18:38:24 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin
*
expires
Thu, 23 Sep 2021 17:38:00 GMT
collect
www.google-analytics.com/j/
2 B
68 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j86&a=396647332&t=pageview&_s=1&dl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&dr=https%3A%2F%2Ft.co%2FIvwHgUmxJ5&ul=en-us&de=UTF-8&dt=Group-IB%20detects%20a%20series%20of%20ransomware%20attacks%20by%20OldGremlinSecurity%20Affairs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABCAAAAC~&jid=188792786&gjid=105268277&cid=973622596.1600886304&tid=UA-59069958-1&_gid=2147105141.1600886304&_r=1&_slc=1&z=627932536
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:24 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
text/plain
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
log
l.sharethis.com/
0
315 B
Image
General
Full URL
https://l.sharethis.com/log?event=ibl&url=https://t.co/IvwHgUmxJ5&description=Researchers%20from%20threat%20hunting%20and%20intelligence%20firm%20Group-IB%20have%20detected%20a%20successful%20attack%20by%20a%20ransomware%20gang%20tracked%20as%20OldGremlin.%20Group-IB%2C%20a%20global%20threat%20hunting%20and%20intelligence%20company%20headquartered%20in%20Singapore%2C%20has%20detected%20a%20successful%20attack%20by%20a%20ransomware%20gang%2C%20codenamed%20OldGremlin.%20The%20Russian-speaking%20threat%20actors%20are%20relatively%20new%20to%20the%20Big%20Game%20Hunting.%20Since%20%5B%E2%80%A6%5D&img_pview=true
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.127.132.197 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 23 Sep 2020 18:38:28 GMT
Access-Control-Max-Age
1728000
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
5b71b64b04b9a500117b1015.js
buttons-config.sharethis.com/js/
30 B
379 B
Script
General
Full URL
https://buttons-config.sharethis.com/js/5b71b64b04b9a500117b1015.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20e8:8400:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:26 GMT
via
1.1 d331d277ec81e476ff09fa9d30df05d0.cloudfront.net (CloudFront)
last-modified
Mon, 13 Aug 2018 16:48:12 GMT
server
AmazonS3
age
3
etag
"e6e1643313740711175f51662a65b42f"
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
cache-control
max-age=60,public
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-length
30
x-amz-cf-id
As0mbONPDCTUQvuFeTEi8U4d6oa0o_qL02j9M1QqCAeIvq9pSbLeTw==
log
l.sharethis.com/
0
315 B
Image
General
Full URL
https://l.sharethis.com/log?event=ibl&url=https%3A%2F%2Ft.co%2FIvwHgUmxJ5&fcmp=false&fcmpv2=false&has_segmentio=false&product=ga&publisher=5b71b64b04b9a500117b1015&source=sharethis.js&title=Group-IB%20detects%20a%20series%20of%20ransomware%20attacks%20by%20OldGremlin&ts=1600886308736&sop=true&cms=unknown&description=Researchers%20from%20threat%20hunting%20and%20intelligence%20firm%20Group-IB%20have%20detected%20a%20successful%20attack%20by%20a%20ransomware%20gang%20tracked%20as%20OldGremlin.%20Group-IB%2C%20a%20global%20threat%20hunting%20and%20intelligence%20company%20headquartered%20in%20Singapore%2C%20has%20detected%20a%20successful%20attack%20by%20a%20ransomware%20gang%2C%20codenamed%20OldGremlin.%20The%20Russian-speaking%20threat%20actors%20are%20relatively%20new%20to%20the%20Big%20Game%20Hunting.%20Since%20%5B%E2%80%A6%5D
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.127.132.197 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 23 Sep 2020 18:38:28 GMT
Access-Control-Max-Age
1728000
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
analytics.js
google-analytics.com/
45 KB
19 KB
Script
General
Full URL
https://google-analytics.com/analytics.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 09 Sep 2020 01:50:37 GMT
server
Golfe2
age
6356
date
Wed, 23 Sep 2020 16:52:32 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18650
expires
Wed, 23 Sep 2020 18:52:32 GMT
collect
www.google-analytics.com/j/
2 B
87 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j86&a=396647332&t=pageview&_s=2&dl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&dr=https%3A%2F%2Ft.co%2FIvwHgUmxJ5&ul=en-us&de=UTF-8&dt=Group-IB%20detects%20a%20series%20of%20ransomware%20attacks%20by%20OldGremlinSecurity%20Affairs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAUABCAAAAC~&jid=750121277&gjid=534133213&cid=973622596.1600886304&tid=UA-59069958-1&_gid=2147105141.1600886304&_r=1&_slc=1&z=792730996
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:28 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
text/plain
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
fontawesome-webfont.woff
securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/
43 KB
44 KB
Font
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/fontawesome-webfont.woff?v=4.0.3
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software
Apache /
Resource Hash
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849

Request headers

Origin
https://securityaffairs.co
Referer
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:28 GMT
last-modified
Wed, 16 Dec 2015 06:58:09 GMT
server
Apache
etag
"ad90-526fe6dc92240"
content-type
application/font-woff
status
200
accept-ranges
bytes
content-length
44432
OldGremlin-1.jpg
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/09/
12 KB
12 KB
Image
General
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/09/OldGremlin-1.jpg?w=453&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i2.wp.com
Software
nginx /
Resource Hash
083b39fcd8c99c9a41c40424ef0f84798a3e3026c1d8f780837a9e89b32fc945
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT fra 8
date
Wed, 23 Sep 2020 18:38:28 GMT
x-content-type-options
nosniff
last-modified
Wed, 23 Sep 2020 10:07:50 GMT
server
nginx
etag
"dd0e37c8eb05327b"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2020/09/OldGremlin-1.jpg>; rel="canonical"
content-length
12414
expires
Fri, 23 Sep 2022 22:07:50 GMT
OldGremlin-2.jpg
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/09/
66 KB
67 KB
Image
General
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/09/OldGremlin-2.jpg?resize=1024%2C575&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i2.wp.com
Software
nginx /
Resource Hash
bd63e6be549a87f3a6f05f55ade50685d68fe80569fb1098f5845666410372dd
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT fra 8
date
Wed, 23 Sep 2020 18:38:28 GMT
x-content-type-options
nosniff
last-modified
Wed, 23 Sep 2020 10:07:50 GMT
server
nginx
etag
"d1e7e2c1d2f40867"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2020/09/OldGremlin-2.jpg>; rel="canonical"
content-length
68038
expires
Fri, 23 Sep 2022 22:07:50 GMT
portal-v2.html
c.sharethis.mgr.consensu.org/v1.0/cmp/ Frame 4075
0
0
Document
General
Full URL
https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal-v2.html
Requested by
Host: ws.sharethis.com
URL: https://ws.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20e8:d400:c:a9b7:ddc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash

Request headers

:method
GET
:authority
c.sharethis.mgr.consensu.org
:scheme
https
:path
/v1.0/cmp/portal-v2.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

status
200
content-type
text/html; charset=utf-8
accept-ranges
bytes
content-encoding
gzip
last-modified
Wed, 26 Aug 2020 05:25:30 GMT
date
Wed, 23 Sep 2020 18:13:03 GMT
cache-control
max-age=3600, public
etag
W/"83a-174293a7110"
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 d91c21a06968968452d701ff77f35a70.cloudfront.net (CloudFront)
x-amz-cf-pop
TXL52-C1
x-amz-cf-id
cV6oi5dmAQ3hAhrfrkMulYT-2IvyUYTKNB6TB0l75ZoG8Wh_Pl_kgg==
age
1525
checksync.php
contextual.media.net/ Frame 11F6
0
0
Document
General
Full URL
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HB41O6BH&prvid=77%2C80%2C82%2C97%2C109%2C148%2C175%2C178%2C184%2C188%2C192%2C193%2C201%2C203%2C214%2C222%2C226%2C3008&refUrl=https%3A%2F%2Ft.co&rtime=8&https=1&gdpr=1&gdprconsent=2&usp_status=0&usp_consent=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

:method
GET
:authority
contextual.media.net
:scheme
https
:path
/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HB41O6BH&prvid=77%2C80%2C82%2C97%2C109%2C148%2C175%2C178%2C184%2C188%2C192%2C193%2C201%2C203%2C214%2C222%2C226%2C3008&refUrl=https%3A%2F%2Ft.co&rtime=8&https=1&gdpr=1&gdprconsent=2&usp_status=0&usp_consent=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

status
200
server
Apache
content-type
text/html; charset=UTF-8
set-cookie
gdpr_status=1; Expires=Sat, 27 Mar 2021 18:38:29 GMT; domain=.media.net; Path=/; sameSite=none; secure=true visitor-id=2438879092110664000V10; Expires=Thu, 23 Sep 2021 18:38:29 GMT; domain=.media.net; Path=/; sameSite=none; secure=true
x-mnet-hl2
E
p3p
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
strict-transport-security
max-age=604800
vary
Accept-Encoding
content-encoding
gzip
cache-control
max-age=24808
expires
Thu, 24 Sep 2020 01:31:57 GMT
date
Wed, 23 Sep 2020 18:38:29 GMT
content-length
6815
rtbsmpubs.php
contextual.media.net/
8 KB
2 KB
Script
General
Full URL
https://contextual.media.net/rtbsmpubs.php?&gdpr=1&gdprconsent=1&usp_enf=1&usp_status=0&cid=8HB41O6BH&region=nv&ptrid=8PREB0781&requestString=170605770*4%7C300x250%7C8CU5BD6EW%7C762221962%7C%40170605770*97%7C300x250%7C8CU5BD6EW%7C762221962_8CU5BD6EW%7C%40170605770*175%7C300x250%7C8CU5BD6EW%7C762221962_8CU5BD6EW%7C%40170605770*178%7C300x250%7C8CU5BD6EW%7C762221962_8CU5BD6EW%7C%40170605770*201%7C300x250%7C8CU5BD6EW%7C762221962_8CU5BD6EW%7C%40170605770*203%7C300x250%7C8CU5BD6EW%7C762221962_8CU5BD6EW%7C%40170605770*214%7C300x250%7C8CU5BD6EW%7C762221962_8CU5BD6EW%7C%40170605770*222%7C300x250%7C8CU5BD6EW%7C762221962_8CU5BD6EW%7C&crid=170605770&sd=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&bl=1&rt=5&dn=https://securityaffairs.co&https=1&act=headerBid&prvReqId=402919243320211301600886308999&erTr=0&hlt=1&ugd=4&adt=desktop&kwrf=https%3A%2F%2Ft.co&tr=0.6613867612231066&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1600%2C%22vh%22%3A1200%2C%22ph%22%3A4624%7D&itype=HB-CM&cc=FR&rc=IDF&ct=PARIS&bt=1&isRefresh=0&callback=window.hbCMBidxc.rtbsheaderBid3S0
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
d23a871d90b722841184b08aefd2b6c3fa0fc467a1c67014c0ba920324149158
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
date
Wed, 23 Sep 2020 18:38:29 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
max-age=0, no-cache, no-store
timing-allow-origin
*
content-length
1890
x-mnet-hl2
E
expires
Wed, 23 Sep 2020 18:38:29 GMT
rtbsmpubs.php
contextual.media.net/
1 KB
913 B
Script
General
Full URL
https://contextual.media.net/rtbsmpubs.php?&gdpr=1&gdprconsent=1&usp_enf=1&usp_status=0&cid=8HB41O6BH&region=nv&ptrid=8PREB0781&requestString=170605770*3008%7C1x1__1%7C8CU5BD6EW%7C762221962%7C&crid=170605770&sd=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&bl=1&rt=5&dn=https://securityaffairs.co&https=1&act=headerBid&prvReqId=101963971897879251600886309064&erTr=0&hlt=1&ugd=4&adt=desktop&kwrf=https%3A%2F%2Ft.co&tr=0.12017884850633909&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1600%2C%22vh%22%3A1200%2C%22ph%22%3A4624%7D&itype=HB-CM&cc=FR&rc=IDF&ct=PARIS&at=3&bt=1&callback=window.hbCMBidxc.rtbsnativeheaderBid3S0
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
bf479a376378cc786bf5cacdceffee643b734a3fb63127ce8be9662792fe48b1
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
date
Wed, 23 Sep 2020 18:38:29 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
max-age=0, no-cache, no-store
timing-allow-origin
*
content-length
703
x-mnet-hl2
E
expires
Wed, 23 Sep 2020 18:38:29 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame C9A3
52 KB
18 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: t.co
URL: https://t.co/IvwHgUmxJ5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1f0864479892c756ec515a5eb5c58db8cb9d91e34c6c3e2a89aeb834eac6815a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"642 / 961 of 1000 / last-modified: 1600859470"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
17752
x-xss-protection
0
expires
Wed, 23 Sep 2020 18:38:29 GMT
bping.php
lg3.media.net/
35 B
189 B
Image
General
Full URL
https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=762221962&vi=1600886303397163734&ugd=4&lf=6&kwrf=https%3A%2F%2Ft.co&cc=FR&sc=IDF&wsip=2886781041&r=1600886308960&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_uspa=0&hvsid=00001600886308949013824209929000&gdpr=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=21600
server
Apache
date
Wed, 23 Sep 2020 18:38:29 GMT
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Wed, 23 Sep 2020 18:38:29 GMT
f00db26378ef7df7c440a8ee60ead62b
secure.gravatar.com/avatar/
1 KB
1 KB
Image
General
Full URL
https://secure.gravatar.com/avatar/f00db26378ef7df7c440a8ee60ead62b?s=60&d=mm&r=g
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
5cbf31f01d7d1ce4853bcd6cc64dbfd103d412ec14d8bcc4ebca3b35dc3f3b74

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT fra 1
date
Wed, 23 Sep 2020 18:38:29 GMT
last-modified
Wed, 11 Jan 1984 08:00:00 GMT
server
nginx
status
200
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=300
content-disposition
inline; filename="f00db26378ef7df7c440a8ee60ead62b.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/f00db26378ef7df7c440a8ee60ead62b?s=60&d=mm&r=g>; rel="canonical"
content-length
1186
expires
Wed, 23 Sep 2020 18:43:29 GMT
headerbid_refresh_alex.php
served-by.pixfuture.com/www/delivery/ Frame CA70
6 KB
6 KB
Script
General
Full URL
https://served-by.pixfuture.com/www/delivery/headerbid_refresh_alex.php?dat=24272x320x50x4142x_ADSLOT1&keywords=groupib,detects,series,ransomware,attacks,oldgremlinsecurity,affairs&refUrl=https://t.co/IvwHgUmxJ5&refresh=false&innerWidth=1600
Requested by
Host: served-by.pixfuture.com
URL: https://served-by.pixfuture.com/www/delivery/headerbid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
2db5ea0ceb5aa35a0cb6d802015977435fef83133321296ee9535d3e50cde902

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:29 GMT
Server
nginx/1.10.3 (Ubuntu)
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800, public, no-transform
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires
Fri, 25 Sep 2020 18:38:29 GMT
headerbid_refresh_alex.php
served-by.pixfuture.com/www/delivery/ Frame 4A7C
6 KB
7 KB
Script
General
Full URL
https://served-by.pixfuture.com/www/delivery/headerbid_refresh_alex.php?dat=24270x300x250x4142x_ADSLOT1&keywords=groupib,detects,series,ransomware,attacks,oldgremlinsecurity,affairs&refUrl=https://t.co/IvwHgUmxJ5&refresh=false&innerWidth=1600
Requested by
Host: served-by.pixfuture.com
URL: https://served-by.pixfuture.com/www/delivery/headerbid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
55b19646abcf6c77f6db1e7d9aeac4fb26933af7438807c70332b134787dec34

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:29 GMT
Server
nginx/1.10.3 (Ubuntu)
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800, public, no-transform
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires
Fri, 25 Sep 2020 18:38:29 GMT
rtbsmpubs.php
contextual.media.net/
8 KB
2 KB
Script
General
Full URL
https://contextual.media.net/rtbsmpubs.php?&gdpr=1&gdprconsent=1&usp_enf=1&usp_status=0&cid=8HB41O6BH&region=nv&ptrid=8PREB0781&requestString=512365842*4%7C300x250%7C8CU5BD6EW%7C184323154%7C%40512365842*97%7C300x250%7C8CU5BD6EW%7C184323154_8CU5BD6EW%7C%40512365842*175%7C300x250%7C8CU5BD6EW%7C184323154_8CU5BD6EW%7C%40512365842*178%7C300x250%7C8CU5BD6EW%7C184323154_8CU5BD6EW%7C%40512365842*201%7C300x250%7C8CU5BD6EW%7C184323154_8CU5BD6EW%7C%40512365842*203%7C300x250%7C8CU5BD6EW%7C184323154_8CU5BD6EW%7C%40512365842*214%7C300x250%7C8CU5BD6EW%7C184323154_8CU5BD6EW%7C%40512365842*222%7C300x250%7C8CU5BD6EW%7C184323154_8CU5BD6EW%7C&crid=512365842&sd=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&bl=1&rt=5&dn=https://securityaffairs.co&https=1&act=headerBid&prvReqId=242637293731561681600886309106&erTr=0&hlt=1&ugd=4&adt=desktop&kwrf=https%3A%2F%2Ft.co&tr=0.10307412460599719&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1600%2C%22vh%22%3A1200%2C%22ph%22%3A4945%7D&itype=HB-CM&cc=FR&rc=IDF&ct=PARIS&bt=1&isRefresh=0&callback=window.hbCMBidxc.rtbsheaderBid4S0
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f1aaed98e9f38642918e63cd6179016ecb8adc6bb4895ef6c4938e9cc92ac6ab
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
date
Wed, 23 Sep 2020 18:38:29 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
max-age=0, no-cache, no-store
timing-allow-origin
*
content-length
1892
x-mnet-hl2
E
expires
Wed, 23 Sep 2020 18:38:29 GMT
rtbsmpubs.php
contextual.media.net/
1 KB
913 B
Script
General
Full URL
https://contextual.media.net/rtbsmpubs.php?&gdpr=1&gdprconsent=1&usp_enf=1&usp_status=0&cid=8HB41O6BH&region=nv&ptrid=8PREB0781&requestString=512365842*3008%7C1x1__1%7C8CU5BD6EW%7C184323154%7C&crid=512365842&sd=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&bl=1&rt=5&dn=https://securityaffairs.co&https=1&act=headerBid&prvReqId=169421348371990011600886309108&erTr=0&hlt=1&ugd=4&adt=desktop&kwrf=https%3A%2F%2Ft.co&tr=0.457886776919185&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1600%2C%22vh%22%3A1200%2C%22ph%22%3A4945%7D&itype=HB-CM&cc=FR&rc=IDF&ct=PARIS&at=3&bt=1&callback=window.hbCMBidxc.rtbsnativeheaderBid4S0
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
5a9b21c4eae4b293b4f5e2544eadf2db4a80f16a5c0e78da98dc5cc821696ed0
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
date
Wed, 23 Sep 2020 18:38:29 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
max-age=0, no-cache, no-store
timing-allow-origin
*
content-length
703
x-mnet-hl2
E
expires
Wed, 23 Sep 2020 18:38:29 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 58E9
52 KB
17 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: t.co
URL: https://t.co/IvwHgUmxJ5
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
96f39bc4007dfc2bb5466a7ac3e43df7b0bb3a8545e1b81d6153d09ee5a70e3b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"642 / 250 of 1000 / last-modified: 1600859559"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
17571
x-xss-protection
0
expires
Wed, 23 Sep 2020 18:38:29 GMT
bping.php
lg3.media.net/
35 B
189 B
Image
General
Full URL
https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&vi=1600886303245755615&ugd=4&lf=6&kwrf=https%3A%2F%2Ft.co&cc=FR&sc=IDF&wsip=2886781041&r=1600886309104&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_uspa=0&hvsid=00001600886309100013824209927324&gdpr=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=21600
server
Apache
date
Wed, 23 Sep 2020 18:38:29 GMT
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Wed, 23 Sep 2020 18:38:29 GMT
rtbsmpubs.php
contextual.media.net/
8 KB
2 KB
Script
General
Full URL
https://contextual.media.net/rtbsmpubs.php?&gdpr=1&gdprconsent=1&usp_enf=1&usp_status=0&cid=8HB41O6BH&region=nv&ptrid=8PREB0781&requestString=555212031*4%7C300x600%7C8CU5BD6EW%7C639665355%7C%40555212031*97%7C300x600%7C8CU5BD6EW%7C639665355_8CU5BD6EW%7C%40555212031*175%7C300x600%7C8CU5BD6EW%7C639665355_8CU5BD6EW%7C%40555212031*178%7C300x600%7C8CU5BD6EW%7C639665355_8CU5BD6EW%7C%40555212031*201%7C300x600%7C8CU5BD6EW%7C639665355_8CU5BD6EW%7C%40555212031*203%7C300x600%7C8CU5BD6EW%7C639665355_8CU5BD6EW%7C%40555212031*214%7C300x600%7C8CU5BD6EW%7C639665355_8CU5BD6EW%7C%40555212031*222%7C300x600%7C8CU5BD6EW%7C639665355_8CU5BD6EW%7C&crid=555212031&sd=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&bl=1&rt=5&dn=https://securityaffairs.co&https=1&act=headerBid&prvReqId=303607940414580491600886309126&erTr=0&hlt=1&ugd=4&adt=desktop&kwrf=https%3A%2F%2Ft.co&tr=0.2939706346402171&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1600%2C%22vh%22%3A1200%2C%22ph%22%3A4945%7D&itype=HB-CM&cc=FR&rc=IDF&ct=PARIS&bt=1&isRefresh=0&callback=window.hbCMBidxc.rtbsheaderBid5S0
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
bfdeb40cc7794459d81706f7083638a12f8659063a5c1d56be78f931646439e1
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
date
Wed, 23 Sep 2020 18:38:29 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
max-age=0, no-cache, no-store
timing-allow-origin
*
content-length
1904
x-mnet-hl2
E
expires
Wed, 23 Sep 2020 18:38:29 GMT
rtbsmpubs.php
contextual.media.net/
1 KB
911 B
Script
General
Full URL
https://contextual.media.net/rtbsmpubs.php?&gdpr=1&gdprconsent=1&usp_enf=1&usp_status=0&cid=8HB41O6BH&region=nv&ptrid=8PREB0781&requestString=555212031*3008%7C1x1__1%7C8CU5BD6EW%7C639665355%7C&crid=555212031&sd=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&bl=1&rt=5&dn=https://securityaffairs.co&https=1&act=headerBid&prvReqId=242766964984506701600886309149&erTr=0&hlt=1&ugd=4&adt=desktop&kwrf=https%3A%2F%2Ft.co&tr=0.4196598728410257&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1600%2C%22vh%22%3A1200%2C%22ph%22%3A4945%7D&itype=HB-CM&cc=FR&rc=IDF&ct=PARIS&at=3&bt=1&callback=window.hbCMBidxc.rtbsnativeheaderBid5S0
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
a7e3c01bfef79f655cda0aac6f21735860494c82e9eabbdb9dd7d9ad6a977320
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
date
Wed, 23 Sep 2020 18:38:29 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
max-age=0, no-cache, no-store
timing-allow-origin
*
content-length
702
x-mnet-hl2
E
expires
Wed, 23 Sep 2020 18:38:29 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame A8F2
51 KB
18 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: t.co
URL: https://t.co/IvwHgUmxJ5
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
47b7eca532164db5ab2d449b46f69a7807b3c035f0a335362ae5c34342426763
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"642 / 342 of 1000 / last-modified: 1600859559"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
17510
x-xss-protection
0
expires
Wed, 23 Sep 2020 18:38:29 GMT
bping.php
lg3.media.net/
35 B
189 B
Image
General
Full URL
https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=639665355&vi=1600886303624985478&ugd=4&lf=6&kwrf=https%3A%2F%2Ft.co&cc=FR&sc=IDF&wsip=2886781041&r=1600886309124&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_uspa=0&hvsid=00001600886309117013824209925096&gdpr=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=21600
server
Apache
date
Wed, 23 Sep 2020 18:38:29 GMT
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Wed, 23 Sep 2020 18:38:29 GMT
Digging-The-Deep-Web.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/
6 KB
6 KB
Image
General
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png?resize=236%2C300&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i2.wp.com
Software
nginx /
Resource Hash
2cbb8dfc4483c9ce680df342866531ac656e8bed029dcd37a1872327023da5f8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT fra 3
date
Wed, 23 Sep 2020 18:38:29 GMT
x-content-type-options
nosniff
x-bytes-saved
49467
last-modified
Thu, 22 Nov 2018 08:33:49 GMT
server
nginx
etag
"45242b8df2596de9"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png>; rel="canonical"
content-length
6390
expires
Sat, 21 Nov 2020 20:33:49 GMT
securityaffairs-best-european-blog2.png
i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/06/
10 KB
10 KB
Image
General
Full URL
https://i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/06/securityaffairs-best-european-blog2.png?resize=300%2C217&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i2.wp.com
Software
nginx /
Resource Hash
e8caad51a19c5667e4fc7ae6a3b9bf8a23559bb64b09b0c6e90cad6d24083ea6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT fra 2
date
Wed, 23 Sep 2020 18:38:29 GMT
x-content-type-options
nosniff
x-bytes-saved
103276
last-modified
Tue, 02 Jun 2020 21:24:46 GMT
server
nginx
etag
"fed3375b73064b64"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2020/06/securityaffairs-best-european-blog2.png>; rel="canonical"
content-length
10314
expires
Fri, 03 Jun 2022 09:24:46 GMT
g.gif
pixel.wp.com/
50 B
115 B
Image
General
Full URL
https://pixel.wp.com/g.gif?v=ext&j=1%3A8.9.1&blog=29506073&post=108644&tz=0&srv=securityaffairs.co&host=securityaffairs.co&ref=https%3A%2F%2Ft.co%2FIvwHgUmxJ5&fcp=6828&rand=0.6958085249299362
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Wed, 23 Sep 2020 18:38:29 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
pubads_impl_2020091601.js
securepubads.g.doubleclick.net/gpt/ Frame C9A3
263 KB
92 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091601.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s22-in-f162.1e100.net
Software
sffe /
Resource Hash
3be81ab15cc2905d3ef54418cd0fa664e85d19c4a5550e28b071a39bd1316070
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Sep 2020 08:40:34 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
94378
x-xss-protection
0
expires
Wed, 23 Sep 2020 18:38:29 GMT
pview
l.sharethis.com/
0
340 B
XHR
General
Full URL
https://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&fpc=6f69f6a-174bc427f72-552dd18f-1&sessionID=1600886308722.87256&hostname=securityaffairs.co&location=%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&product=simpleshare&fcmp=false&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&refQuery=IvwHgUmxJ5&refDomain=t.co&bsamesite=true&consentDomain=.consensu.org&gdpr_domain=.consensu.org&gdpr_domain_v1=.consensu.org&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&title=Group-IB%20detects%20a%20series%20of%20ransomware%20attacks%20by%20OldGremlinSecurity%20Affairs&sop=false&description=Researchers%20from%20threat%20hunting%20and%20intelligence%20firm%20Group-IB%20have%20detected%20a%20successful%20attack%20by%20a%20ransomware%20gang%20tracked%20as%20OldGremlin.%20Group-IB%2C%20a%20global%20threat%20hunting%20and%20intelligence%20company%20headquartered%20in%20Singapore%2C%20has%20detected%20a%20successful%20attack%20by%20a%20ransomware%20gang%2C%20codenamed%20OldGremlin.%20The%20Russian-speaking%20threat%20actors%20are%20relatively%20new%20to%20the%20Big%20Game%20Hunting.%20Since%20%5B%E2%80%A6%5D
Requested by
Host: ws.sharethis.com
URL: https://ws.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.127.132.197 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 23 Sep 2020 18:38:29 GMT
Access-Control-Max-Age
1728000
Access-Control-Allow-Origin
https://securityaffairs.co
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
pubads_impl_2020091702.js
securepubads.g.doubleclick.net/gpt/ Frame A8F2
264 KB
93 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091702.js?21067516
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s22-in-f162.1e100.net
Software
sffe /
Resource Hash
bf854a7b7ea523eaf0e05e333f6768d66af9f3430b9e2770edc995a169e24167
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 17 Sep 2020 18:00:22 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
94763
x-xss-protection
0
expires
Wed, 23 Sep 2020 18:38:29 GMT
pubads_impl_2020092201.js
securepubads.g.doubleclick.net/gpt/ Frame 58E9
264 KB
93 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020092201.js?21067535
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s22-in-f162.1e100.net
Software
sffe /
Resource Hash
5e1390f7c515a04fbd18d7c3e864de65e7fc473f8a2e5134f74a79e122911dd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Sep 2020 08:40:46 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
94816
x-xss-protection
0
expires
Wed, 23 Sep 2020 18:38:29 GMT
djax_elastic.js
cdn.pixfuture.com/ Frame EB26
28 KB
28 KB
Script
General
Full URL
https://cdn.pixfuture.com/djax_elastic.js
Requested by
Host: served-by.pixfuture.com
URL: https://served-by.pixfuture.com/www/delivery/headerbid_refresh_alex.php?dat=24270x300x250x4142x_ADSLOT1&keywords=groupib,detects,series,ransomware,attacks,oldgremlinsecurity,affairs&refUrl=https://t.co/IvwHgUmxJ5&refresh=false&innerWidth=1600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4671 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
24b5b710e6775ec2974c8b28d69d4344c6384734de05cec54dcee8741edf8c61

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:29 GMT
cf-cache-status
DYNAMIC
last-modified
Mon, 14 Sep 2020 15:51:58 GMT
server
cloudflare
etag
"5f5f919e-6fa1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/javascript
status
200
cache-control
max-age=172800, public, no-transform
accept-ranges
bytes
cf-ray
5d76620ada0e175e-FRA
content-length
28577
cf-request-id
055ddb9ac40000175e832bb200000001
expires
Fri, 25 Sep 2020 18:38:29 GMT
auc.js
cdn.pixfuture.com/ Frame EB26
298 KB
299 KB
Script
General
Full URL
https://cdn.pixfuture.com/auc.js
Requested by
Host: served-by.pixfuture.com
URL: https://served-by.pixfuture.com/www/delivery/headerbid_refresh_alex.php?dat=24270x300x250x4142x_ADSLOT1&keywords=groupib,detects,series,ransomware,attacks,oldgremlinsecurity,affairs&refUrl=https://t.co/IvwHgUmxJ5&refresh=false&innerWidth=1600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4671 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ef666022c3b2e7ce78c9a82d0629305bf3812f8d787cb957f218159637ee7d4

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:29 GMT
cf-cache-status
DYNAMIC
last-modified
Wed, 19 Aug 2020 13:43:38 GMT
server
cloudflare
etag
"5f3d2c8a-4a928"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/javascript
status
200
cache-control
max-age=172800, public, no-transform
accept-ranges
bytes
cf-ray
5d76620ada0f175e-FRA
content-length
305448
cf-request-id
055ddb9ac40000175e832bc200000001
expires
Fri, 25 Sep 2020 18:38:29 GMT
djax_elastic.js
cdn.pixfuture.com/ Frame D881
28 KB
28 KB
Script
General
Full URL
https://cdn.pixfuture.com/djax_elastic.js
Requested by
Host: served-by.pixfuture.com
URL: https://served-by.pixfuture.com/www/delivery/headerbid_refresh_alex.php?dat=24272x320x50x4142x_ADSLOT1&keywords=groupib,detects,series,ransomware,attacks,oldgremlinsecurity,affairs&refUrl=https://t.co/IvwHgUmxJ5&refresh=false&innerWidth=1600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4671 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
24b5b710e6775ec2974c8b28d69d4344c6384734de05cec54dcee8741edf8c61

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:29 GMT
cf-cache-status
DYNAMIC
last-modified
Mon, 14 Sep 2020 15:51:58 GMT
server
cloudflare
etag
"5f5f919e-6fa1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/javascript
status
200
cache-control
max-age=172800, public, no-transform
accept-ranges
bytes
cf-ray
5d76620ada13175e-FRA
content-length
28577
cf-request-id
055ddb9ac40000175e832be200000001
expires
Fri, 25 Sep 2020 18:38:29 GMT
auc.js
cdn.pixfuture.com/ Frame D881
298 KB
299 KB
Script
General
Full URL
https://cdn.pixfuture.com/auc.js
Requested by
Host: served-by.pixfuture.com
URL: https://served-by.pixfuture.com/www/delivery/headerbid_refresh_alex.php?dat=24272x320x50x4142x_ADSLOT1&keywords=groupib,detects,series,ransomware,attacks,oldgremlinsecurity,affairs&refUrl=https://t.co/IvwHgUmxJ5&refresh=false&innerWidth=1600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4671 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ef666022c3b2e7ce78c9a82d0629305bf3812f8d787cb957f218159637ee7d4

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:29 GMT
cf-cache-status
DYNAMIC
last-modified
Wed, 19 Aug 2020 13:43:38 GMT
server
cloudflare
etag
"5f3d2c8a-4a928"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/javascript
status
200
cache-control
max-age=172800, public, no-transform
accept-ranges
bytes
cf-ray
5d76620ada12175e-FRA
content-length
305448
cf-request-id
055ddb9ac40000175e832bd200000001
expires
Fri, 25 Sep 2020 18:38:29 GMT
pview
l.sharethis.com/
0
315 B
Image
General
Full URL
https://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&fpc=6f69f6a-174bc427f72-552dd18f-1&sessionID=1600886308722.87256&hostname=securityaffairs.co&location=%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&product=simpleshare&fcmp=false&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&refQuery=IvwHgUmxJ5&refDomain=t.co&bsamesite=true&consentDomain=.consensu.org&gdpr_domain=.consensu.org&gdpr_domain_v1=.consensu.org&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&title=Group-IB%20detects%20a%20series%20of%20ransomware%20attacks%20by%20OldGremlinSecurity%20Affairs&sop=false&description=Researchers%20from%20threat%20hunting%20and%20intelligence%20firm%20Group-IB%20have%20detected%20a%20successful%20attack%20by%20a%20ransomware%20gang%20tracked%20as%20OldGremlin.%20Group-IB%2C%20a%20global%20threat%20hunting%20and%20intelligence%20company%20headquartered%20in%20Singapore%2C%20has%20detected%20a%20successful%20attack%20by%20a%20ransomware%20gang%2C%20codenamed%20OldGremlin.%20The%20Russian-speaking%20threat%20actors%20are%20relatively%20new%20to%20the%20Big%20Game%20Hunting.%20Since%20%5B%E2%80%A6%5D&description=Researchers%20from%20threat%20hunting%20and%20intelligence%20firm%20Group-IB%20have%20detected%20a%20successful%20attack%20by%20a%20ransomware%20gang%20tracked%20as%20OldGremlin.%20Group-IB%2C%20a%20global%20threat%20hunting%20and%20intelligence%20company%20headquartered%20in%20Singapore%2C%20has%20detected%20a%20successful%20attack%20by%20a%20ransomware%20gang%2C%20codenamed%20OldGremlin.%20The%20Russian-speaking%20threat%20actors%20are%20relatively%20new%20to%20the%20Big%20Game%20Hunting.%20Since%20%5B%E2%80%A6%5D&img_pview=true
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.127.132.197 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 23 Sep 2020 18:38:29 GMT
Access-Control-Max-Age
1728000
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
fcmain.js
contextual.media.net/1017354394/
90 KB
25 KB
Script
General
Full URL
https://contextual.media.net/1017354394/fcmain.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=762221962&size=300x250&cc=FR&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&kwrf=https%3A%2F%2Ft.co&nse=0&vi=1600886303397163734&lw=1&ugd=4&rtbs=1&hlt=1&dfp=1&nb=1&cb=window._mNDetails.initAd
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b002154cdbff6d415dd69ebf8377690cb7d19041b7d12e5bb00387f8f76b4a81
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
x-mnt-hl2
8-18
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
max-age=300
date
Wed, 23 Sep 2020 18:38:30 GMT
x-mnt-w
8-16, 8-12
content-length
25488
expires
Wed, 23 Sep 2020 18:43:30 GMT
fcmain.js
contextual.media.net/1017354394/
85 KB
25 KB
Script
General
Full URL
https://contextual.media.net/1017354394/fcmain.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=FR&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&kwrf=https%3A%2F%2Ft.co&nse=0&vi=1600886303245755615&lw=1&ugd=4&rtbs=1&hlt=1&dfp=1&nb=1&cb=window._mNDetails.initAd
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
bb2883d2c929454318b1dfd8ba02d6dc928a091981d56531d4b63f02675f7361
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
x-mnt-hl2
8-18
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
max-age=300
date
Wed, 23 Sep 2020 18:38:30 GMT
x-mnt-w
8-21, 8-8
content-length
25167
expires
Wed, 23 Sep 2020 18:43:30 GMT
fcmain.js
contextual.media.net/1017354394/
99 KB
26 KB
Script
General
Full URL
https://contextual.media.net/1017354394/fcmain.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=639665355&size=300x600&cc=FR&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&kwrf=https%3A%2F%2Ft.co&nse=0&vi=1600886303624985478&lw=1&ugd=4&rtbs=1&hlt=1&dfp=1&nb=1&cb=window._mNDetails.initAd
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
a97dd7a8a9ec291a9938f77e47b2f8c2259cd8a9c9a93705174d6a8c500adfab
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
x-mnt-hl2
8-18
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
max-age=300
date
Wed, 23 Sep 2020 18:38:30 GMT
x-mnt-w
8-1, 8-18
content-length
26376
expires
Wed, 23 Sep 2020 18:43:30 GMT
jquery3_5_1.min.js
cdn.pixfuture.com/ Frame EB26
87 KB
88 KB
Script
General
Full URL
https://cdn.pixfuture.com/jquery3_5_1.min.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/djax_elastic.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4671 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:29 GMT
cf-cache-status
DYNAMIC
last-modified
Wed, 26 Aug 2020 15:41:27 GMT
server
cloudflare
etag
"5f4682a7-15d84"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/javascript
status
200
cache-control
max-age=172800, public, no-transform
accept-ranges
bytes
cf-ray
5d76620c0d79175e-FRA
content-length
89476
cf-request-id
055ddb9b810000175e832df200000001
expires
Fri, 25 Sep 2020 18:38:29 GMT
jquery3_5_1.min.js
cdn.pixfuture.com/ Frame D881
87 KB
88 KB
Script
General
Full URL
https://cdn.pixfuture.com/jquery3_5_1.min.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/djax_elastic.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4671 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:29 GMT
cf-cache-status
DYNAMIC
last-modified
Wed, 26 Aug 2020 15:41:27 GMT
server
cloudflare
etag
"5f4682a7-15d84"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/javascript
status
200
cache-control
max-age=172800, public, no-transform
accept-ranges
bytes
cf-ray
5d76620c0d7b175e-FRA
content-length
89476
cf-request-id
055ddb9b820000175e832e0200000001
expires
Fri, 25 Sep 2020 18:38:29 GMT
integrator.js
adservice.google.de/adsid/ Frame 58E9
109 B
890 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020092201.js?21067535
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 18:38:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 58E9
109 B
890 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020092201.js?21067535
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 18:38:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ Frame 58E9
48 KB
12 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1502173912472842&correlator=327399521196900&output=ldjh&impl=fif&eid=21066466%2C21067535%2C21066994&vrg=2020092201&npa=1&guci=1.2.0.0.2.1.0.0&sc=1&sfv=1-0-37&ecs=20200923&iu_parts=45361917%2C8CU5BD6EW-184323154-Single_post_ads&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&prev_scp=crid%3D184323154%26mnet_segment%3D0.06%26mnet_variant%3D454%26pub_domain%3Dsecurityaffairs.co%26mnet_cc%3DFR%26mnet_bucketid%3Db3%26PubMaticSS%3D1610%26RubiconSS%3D2209%26mnet_pid%3D8PRHGG6T9%26fp%3Dqcqj&eri=4&cookie_enabled=1&bc=31&abxe=1&dt=1600886309862&dlt=1600886309110&idt=662&ea=0&frm=23&biw=1600&bih=1200&isw=300&ish=250&oid=3&adxs=980&adys=413&adks=4133934225&ucis=ysekgji4cfim&ifi=1&ifk=281093816&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&top=securityaffairs.co&dssz=5&icsg=170&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x250&msz=300x250&ga_vid=991729917.1600886310&ga_sid=1600886310&ga_hid=667865487&fws=256&ohw=0&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfV0.
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020092201.js?21067535
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.23.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s22-in-f162.1e100.net
Software
cafe /
Resource Hash
23fbc3ff40c721a5bc44b4e164affb8fdf97df9dc562db5c68d8df8de899e786
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11374
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://securityaffairs.co
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
321367e28afa0a657117604da9c84c8b.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 58E9
0
0
Other
General
Full URL
https://321367e28afa0a657117604da9c84c8b.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020092201.js?21067535
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 58E9
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020092201.js?21067535
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

2
prebid.mgid.com/prebid/ Frame D881
0
174 B
XHR
General
Full URL
https://prebid.mgid.com/prebid/2
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:30 GMT
cf-cache-status
DYNAMIC
x-mg-request-uuid
dc9caf8e-afd0-4561-8201-dae9bd0440b0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
204
p3p
CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
https://securityaffairs.co
cache-control
max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials
true
cf-ray
5d76620daa9f0476-CDG
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
055ddb9c87000004769e236200000001
server
cloudflare
arj
pixfuture2-d.openx.net/w/1.0/ Frame D881
173 B
360 B
XHR
General
Full URL
https://pixfuture2-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=cd4dbf2c-cce0-4ab2-af82-040ab9e49526&nocache=1600886309964&gdpr=0&schain=1.0%2C1!pixfuture.com%2C4142%2C1%2C%2C%2C&aus=320x50&divIds=24272x320x50x4142x_ADSLOT1&auid=540580841&tps=bXlrZXl3b3JkPWdyb3VwaWIsZGV0ZWN0cyxzZXJpZXMscmFuc29td2FyZSxhdHRhY2tzLG9sZGdyZW1saW5zZWN1cml0eSxhZmZhaXJzJm15b3RoZXJrZXl3b3JkPWdyb3VwaWIsZGV0ZWN0cyxzZXJpZXMscmFuc29td2FyZSxhdHRhY2tzLG9sZGdyZW1saW5zZWN1cml0eSxhZmZhaXJz
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.193.0 /
Resource Hash
5c694f9fa4a1b64cd4bf585c6283dea32408419dad6df0ca8b4ea5da1f04579f

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
server
OXGW/16.193.0
status
200
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://securityaffairs.co
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
164
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
translator
hbopenbid.pubmatic.com/ Frame D881
0
117 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Wed, 23 Sep 2020 18:38:30 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-origin
https://securityaffairs.co
hb
ice.360yield.com/ Frame D881
94 B
310 B
XHR
General
Full URL
https://ice.360yield.com/hb?jsonp=%7B%22bid_request%22%3A%7B%22secure%22%3A1%2C%22id%22%3A%22157fe6ba3065b2a%22%2C%22version%22%3A%227.0.0-JS-6.3.0%22%2C%22referrer%22%3A%22https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html%22%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22pixfuture.com%22%2C%22sid%22%3A%224142%22%2C%22hp%22%3A1%7D%5D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22845ef463bb5852%22%2C%22bidfloor%22%3A0.1%2C%22bidfloorcur%22%3A%22USD%22%2C%22pid%22%3A22292114%2C%22tid%22%3A%22cd4dbf2c-cce0-4ab2-af82-040ab9e49526%22%2C%22banner%22%3A%7B%7D%7D%5D%7D%7D
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.169.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
06aded8ded5c624897594d096db31ef293a895baea1c6298deb67ef1e626c9c9

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
200
date
Wed, 23 Sep 2020 18:38:30 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://securityaffairs.co
content-type
application/json; charset=UTF-8
content-length
94
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
ortb
bid.contextweb.com/header/ Frame D881
0
187 B
XHR
General
Full URL
https://bid.contextweb.com/header/ortb?src=prebid
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
198.148.27.133 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 23 Sep 2020 18:38:29 GMT
server
envoy
status
204
access-control-allow-origin
https://securityaffairs.co
access-control-expose-headers
Access-Control-Allow-Origin
access-control-allow-credentials
true
x-envoy-upstream-service-time
74
x-no-bid-reason
Connection Problem
trinity.json
apex.go.sonobi.com/ Frame D881
1 KB
2 KB
XHR
General
Full URL
https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2212efa0d4fdf1f89%22%3A%22277a716b3c3b01668abf%7C320x50%7Cf%3D0.1%22%7D&ref=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&s=6b630f37-6c0e-4807-b711-fb776d680e17&pv=2a0e88b4-5cd0-4e1d-aefc-0f59846d2291&vp=mobile&lib_name=prebid&lib_v=3.21.0&us=0&ius=1&gdpr=false&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22pixfuture.com%22%2C%22sid%22%3A%224142%22%2C%22hp%22%3A1%7D%5D%7D&kw=groupib%2Cdetects%2Cseries%2Cransomware%2Cattacks%2Coldgremlinsecurity%2Caffairs
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-apex.go.sonobi.com
Software
sonobi-go /
Resource Hash
d643e5af5996ee2c294007422c559a5934f3cdd7d16cdc40d40f7e06da860cc8
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:30 GMT
Content-Encoding
gzip
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
apex-ams-1-6-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, private
Access-Control-Allow-Credentials
true
Tcn
Choice
Content-Type
application/json
Content-Length
586
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
prebid
ib.adnxs.com/ut/v3/ Frame D881
19 B
714 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.52 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:30 GMT
X-Proxy-Origin
82.102.18.114; 82.102.18.114; 725.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.141:80
AN-X-Request-Uuid
8a23c486-b2e3-4d4e-bcb4-373b42390d67
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
hb
ice.360yield.com/ Frame EB26
94 B
310 B
XHR
General
Full URL
https://ice.360yield.com/hb?jsonp=%7B%22bid_request%22%3A%7B%22secure%22%3A1%2C%22id%22%3A%2217e0fde99f8073b%22%2C%22version%22%3A%227.0.0-JS-6.3.0%22%2C%22referrer%22%3A%22https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html%22%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22pixfuture.com%22%2C%22sid%22%3A%224142%22%2C%22hp%22%3A1%7D%5D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%222158102b54421e%22%2C%22bidfloor%22%3A0.1%2C%22bidfloorcur%22%3A%22USD%22%2C%22pid%22%3A22254128%2C%22tid%22%3A%228a8ec724-f004-421e-8b4b-c87d1f43f346%22%2C%22banner%22%3A%7B%7D%7D%5D%7D%7D
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.169.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
72a31dc8c0d50bd3ee468d9b16cf5f02998f89bb1f203327eabd648587d3987a

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
200
date
Wed, 23 Sep 2020 18:38:30 GMT
access-control-allow-credentials
true
access-control-allow-origin
https://securityaffairs.co
content-type
application/json; charset=UTF-8
content-length
94
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
ADTECH;apid=1Afa07391e-fdcb-11ea-8414-126272b4dea0;cfp=1;rndc=1600886309;v=2;cmd=bid;cors=yes;alias=19a311f1fd613ff;misc=1600886309990
adserver-us.adtech.advertising.com/pubapi/3.0/9834/3344884/0/0/ Frame EB26
Redirect Chain
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/9834/3344884/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=19a311f1fd613ff;misc=1600886309990;
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/9834/3344884/0/0/ADTECH;cfp=1;rndc=1600886309;v=2;cmd=bid;cors=yes;alias=19a311f1fd613ff;misc=1600886309990
  • https://adserver-us.adtech.advertising.com/pubapi/3.0/9834/3344884/0/0/ADTECH;apid=1Afa07391e-fdcb-11ea-8414-126272b4dea0;cfp=1;rndc=1600886309;v=2;cmd=bid;cors=yes;alias=19a311f1fd613ff;misc=16008...
48 B
105 B
XHR
General
Full URL
https://adserver-us.adtech.advertising.com/pubapi/3.0/9834/3344884/0/0/ADTECH;apid=1Afa07391e-fdcb-11ea-8414-126272b4dea0;cfp=1;rndc=1600886309;v=2;cmd=bid;cors=yes;alias=19a311f1fd613ff;misc=1600886309990
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Adtech Adserver /
Resource Hash
f2ff1ea9bd613614bdca5217eb025f5909f63c608dea2fe642c31b89f1d492ba

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:30 GMT
server
Adtech Adserver
status
200
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json
access-control-allow-origin
https://securityaffairs.co
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
48
expires
Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:30 GMT
server
nginx
status
302
location
https://adserver-us.adtech.advertising.com/pubapi/3.0/9834/3344884/0/0/ADTECH;apid=1Afa07391e-fdcb-11ea-8414-126272b4dea0;cfp=1;rndc=1600886309;v=2;cmd=bid;cors=yes;alias=19a311f1fd613ff;misc=1600886309990
access-control-allow-methods
POST,GET,HEAD,OPTIONS
p3p
CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin
https://securityaffairs.co
cache-control
no-store, no-cache
access-control-allow-credentials
true
content-length
0
expires
Mon, 15 Jun 1998 00:00:00 GMT
arj
pixfuture2-d.openx.net/w/1.0/ Frame EB26
172 B
558 B
XHR
General
Full URL
https://pixfuture2-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=8a8ec724-f004-421e-8b4b-c87d1f43f346&nocache=1600886309991&gdpr=0&schain=1.0%2C1!pixfuture.com%2C4142%2C1%2C%2C%2C&aus=300x250&divIds=24270x300x250x4142x_ADSLOT1&auid=540580840&tps=bXlrZXl3b3JkPWdyb3VwaWIsZGV0ZWN0cyxzZXJpZXMscmFuc29td2FyZSxhdHRhY2tzLG9sZGdyZW1saW5zZWN1cml0eSxhZmZhaXJzJm15b3RoZXJrZXl3b3JkPWdyb3VwaWIsZGV0ZWN0cyxzZXJpZXMscmFuc29td2FyZSxhdHRhY2tzLG9sZGdyZW1saW5zZWN1cml0eSxhZmZhaXJz
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.193.0 /
Resource Hash
c48d1de550053233bc4ecba2e6e2d133a098907cb57d365c5e1c51f9d56c8f26

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
server
OXGW/16.193.0
status
200
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://securityaffairs.co
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
162
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
trinity.json
apex.go.sonobi.com/ Frame EB26
1 KB
2 KB
XHR
General
Full URL
https://apex.go.sonobi.com/trinity.json?key_maker=%7B%228e1c5ed4b28447%22%3A%22833199e4bd4003904bc3%7C300x250%7Cf%3D0.1%22%7D&ref=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&s=39006191-2f8a-4485-ba7b-11f56c25977a&pv=b35d38aa-c7ad-42a1-a157-e3d5a61c86e7&vp=mobile&lib_name=prebid&lib_v=3.21.0&us=0&ius=1&gdpr=false&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22pixfuture.com%22%2C%22sid%22%3A%224142%22%2C%22hp%22%3A1%7D%5D%7D&kw=groupib%2Cdetects%2Cseries%2Cransomware%2Cattacks%2Coldgremlinsecurity%2Caffairs
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-apex.go.sonobi.com
Software
sonobi-go /
Resource Hash
a55043b5129985eac0818f34ce8005760217298d866fc0ed82ea4c6536343f24
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:30 GMT
Content-Encoding
gzip
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
apex-ams-1-6-128
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, private
Access-Control-Allow-Credentials
true
Tcn
Choice
Content-Type
application/json
Content-Length
586
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
translator
hbopenbid.pubmatic.com/ Frame EB26
0
61 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Wed, 23 Sep 2020 18:38:30 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-origin
https://securityaffairs.co
ortb
bid.contextweb.com/header/ Frame EB26
0
57 B
XHR
General
Full URL
https://bid.contextweb.com/header/ortb?src=prebid
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
198.148.27.133 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

date
Wed, 23 Sep 2020 18:38:30 GMT
server
envoy
status
204
access-control-allow-origin
https://securityaffairs.co
access-control-expose-headers
Access-Control-Allow-Origin
access-control-allow-credentials
true
x-envoy-upstream-service-time
601
x-no-bid-reason
Request Timeout
2
prebid.mgid.com/prebid/ Frame EB26
0
657 B
XHR
General
Full URL
https://prebid.mgid.com/prebid/2
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:30 GMT
cf-cache-status
DYNAMIC
x-mg-request-uuid
c3622208-f765-4100-82cd-edc12e139a73
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
204
p3p
CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
https://securityaffairs.co
cache-control
max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials
true
cf-ray
5d76620daaa50476-CDG
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
055ddb9c87000004769e237200000001
server
cloudflare
prebid
ib.adnxs.com/ut/v3/ Frame EB26
19 B
713 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.52 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:30 GMT
X-Proxy-Origin
82.102.18.114; 82.102.18.114; 725.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.56:80
AN-X-Request-Uuid
7f0e75ed-3248-4f15-a72c-d19fa642b568
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
integrator.js
adservice.google.de/adsid/ Frame A8F2
109 B
868 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091702.js?21067516
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame A8F2
109 B
868 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091702.js?21067516
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ Frame A8F2
42 KB
11 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1011687657204240&correlator=3545803275130945&output=ldjh&impl=fif&eid=21066465%2C21067516%2C21067199&vrg=2020091702&npa=1&guci=1.2.0.0.2.1.0.0&sc=1&sfv=1-0-37&ecs=20200923&iu_parts=45361917%2C8CU5BD6EW-639665355-Skyscraper_post_yahoo_300_x_600&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&prev_scp=crid%3D639665355%26mnet_segment%3D0.06%26mnet_variant%3D454%26pub_domain%3Dsecurityaffairs.co%26mnet_cc%3DFR%26mnet_bucketid%3Db3%26PubMaticSS%3D1610%26RubiconSS%3D2209%26mnet_pid%3D8PRHGG6T9%26fp%3Dqcqj&eri=4&cookie_enabled=1&bc=31&abxe=1&dt=1600886310059&dlt=1600886309155&idt=850&ea=0&frm=23&biw=1600&bih=1200&isw=300&ish=600&oid=3&adxs=980&adys=1520&adks=2499085226&ucis=cg09rol7v61t&ifi=1&ifk=281105880&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&top=securityaffairs.co&dssz=5&icsg=170&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x600&msz=300x600&ga_vid=924256182.1600886310&ga_sid=1600886310&ga_hid=123925663&fws=256&ohw=0&btvi=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfV0.
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091702.js?21067516
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.23.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s22-in-f162.1e100.net
Software
cafe /
Resource Hash
efab424137496fe71d56303d65cf773614479519e37bcc3cfb998c7bc4026966
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10835
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://securityaffairs.co
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
ca6624df3d636591ab3085d983574842.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame A8F2
0
0
Other
General
Full URL
https://ca6624df3d636591ab3085d983574842.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091702.js?21067516
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame A8F2
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091702.js?21067516
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

integrator.js
adservice.google.de/adsid/ Frame C9A3
109 B
126 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091601.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame C9A3
109 B
126 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091601.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ Frame C9A3
48 KB
11 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3004539379749096&correlator=126839461705301&output=ldjh&impl=fif&eid=21067393&vrg=2020091601&npa=1&guci=1.2.0.0.2.1.0.0&sc=1&sfv=1-0-37&ecs=20200923&iu_parts=45361917%2C8CU5BD6EW-762221962-300x250_inside_post&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&prev_scp=crid%3D762221962%26mnet_segment%3D0.06%26mnet_variant%3D454%26pub_domain%3Dsecurityaffairs.co%26mnet_cc%3DFR%26mnet_bucketid%3Db3%26PubMaticSS%3D1610%26RubiconSS%3D2209%26mnet_pid%3D8PRHGG6T9%26fp%3Dqcqj&eri=4&cookie_enabled=1&bc=31&abxe=1&dt=1600886310105&dlt=1600886309071&idt=1003&ea=0&frm=23&biw=1600&bih=1200&isw=300&ish=250&oid=3&adxs=476&adys=3486&adks=3236558092&ucis=6jastk9e1wv&ifi=1&ifk=281093816&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&top=securityaffairs.co&dssz=5&icsg=170&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x250&msz=300x250&ga_vid=348164364.1600886310&ga_sid=1600886310&ga_hid=342718729&fws=256&ohw=0&btvi=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfV0.
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091601.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.23.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s22-in-f162.1e100.net
Software
cafe /
Resource Hash
c571657e095288e79a8f049524663392db75d0c788ce381fc3f5807f2e0a3519
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11494
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://securityaffairs.co
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
a0d272f7821b449096461d37c24767a2.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame C9A3
0
0
Other
General
Full URL
https://a0d272f7821b449096461d37c24767a2.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091601.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame C9A3
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091601.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 34C2
89 KB
32 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/djax_elastic.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
828167a34dc57d7b98fdab4265dc3a38b2845f9ebb0f9393e5560fd2ae0caf3f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
32267
x-xss-protection
0
server
cafe
etag
7259451736485547330
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 23 Sep 2020 18:38:30 GMT
demo_track.js
served-by.pixfuture.com/www/headerbid/library/tracking/ Frame D881
3 KB
3 KB
Script
General
Full URL
https://served-by.pixfuture.com/www/headerbid/library/tracking/demo_track.js?v604
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
7b420ad439dadbbbc88cef506a6e2ea73c331178f08f984c6b230cec7ac66a04

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 23 Sep 2020 18:38:30 GMT
Last-Modified
Mon, 06 Jul 2020 13:30:16 GMT
Server
nginx/1.10.3 (Ubuntu)
ETag
"5f032768-a4e"
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800
Access-Control-Allow-Credentials
true
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Content-Length
2638
Expires
Fri, 25 Sep 2020 18:38:30 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012009010507000/ Frame EBE3
206 KB
57 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012009010507000/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020092201.js?21067535
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
12a24c1feb4b8e8e3872a9fedee80fcce55a6f59b14607d640fcf4f3054ec43e
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
99746
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
57296
x-xss-protection
0
server
sffe
date
Tue, 22 Sep 2020 14:56:04 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"9e379dcbf00ec980"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Sep 2021 14:56:04 GMT
amp-ad-exit-0.1.js
cdn.ampproject.org/rtv/012009010507000/v0/ Frame EBE3
16 KB
6 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012009010507000/v0/amp-ad-exit-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020092201.js?21067535
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d337aa4ea0cace6bd743ef8c3b5d1d20e6e676bb4a650c7335a7383635529f31
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
99757
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5755
x-xss-protection
0
server
sffe
date
Tue, 22 Sep 2020 14:55:53 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"c8394c73e5080432"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Sep 2021 14:55:53 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/012009010507000/v0/ Frame EBE3
95 KB
29 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012009010507000/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020092201.js?21067535
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
76a8c8ef4cde9cbd17bbaecf11ee316fab4e55cc661093e4b2d80a4e1ff52897
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
99754
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29275
x-xss-protection
0
server
sffe
date
Tue, 22 Sep 2020 14:55:56 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"56557b91d9fb04b1"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Sep 2021 14:55:56 GMT
amp-fit-text-0.1.js
cdn.ampproject.org/rtv/012009010507000/v0/ Frame EBE3
4 KB
2 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012009010507000/v0/amp-fit-text-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020092201.js?21067535
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6fca0b40781598023aed9b45225711771eafce8f14392a49d6ed57d567255002
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
99746
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1795
x-xss-protection
0
server
sffe
date
Tue, 22 Sep 2020 14:56:04 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"b0cc102b09e8903d"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Sep 2021 14:56:04 GMT
amp-form-0.1.js
cdn.ampproject.org/rtv/012009010507000/v0/ Frame EBE3
47 KB
14 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012009010507000/v0/amp-form-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020092201.js?21067535
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
21cb9221d772cfd0d3de7240fe5c07ee1c06b9bd945111a2e0491ae243eb0b41
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
99754
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14591
x-xss-protection
0
server
sffe
date
Tue, 22 Sep 2020 14:55:56 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"4ca25f57e218a94a"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Sep 2021 14:55:56 GMT
truncated
/ Frame EBE3
211 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
009c8d0fc728e428a19dca24595d8011e60490f35b63c0665b3ac3dcfba8f954

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
downsize_200k_v1
tpc.googlesyndication.com/simgad/16134110849776752827/ Frame EBE3
11 KB
11 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/16134110849776752827/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIjQIQjQEYASABLQAAAD8wjgI4jQFFAACAPw&rs=AOga4qlhQysb12jIJ2PLWe7F_HeV2RUU7A
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9078c52983e95e9499566ecffbf7556c962f0804e0d44a9ccf3a59aa9b96f5e7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 07:52:05 GMT
x-content-type-options
nosniff
last-modified
Mon, 23 Mar 2020 08:40:22 GMT
server
sffe
age
38785
status
200
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10914
x-xss-protection
0
expires
Thu, 23 Sep 2021 07:52:05 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame EBE3
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CtMJHJpZrX_sO8sjv9Q_a3IhQ-ann9V6k-7-E6QuK2IvwhQEQASDQlpgcYPuBgICICqABhf2j8wPIAQapAm8cA8fnbZM-4AIAqAMByAMKqgSkAk_Qbu9Lbat-8FfEvZZib_AjPbNY0_HDaQEsJ-s_gz9dERpL08z2JmUCYKgQDPXDdhERnH2IXoQmYr3_IwgR74egLUEz2Ey1lQB0Q6H_K5b1Y-t3_iDMII0neHVTn8E0BFZ4SYZEbbLyXC0mD6CpZD23dgZYWPY6DP-HpWwyzMZf93nztW5y34hpjXx0iHLtuVbhq7-SeqV4wgVj8T9rB3nLBV_iaUnHm41Ii3JMLk-u0Uzx4Gnb-Vk8CW3ipaSa1DcyNMWWAxMi-O3Q5_n0lerbZDKD-g6ONUT6YUCvLJdKoOiCiWQUStkjb3dJdySABuBDh3zuWAipDj8kypFgTXuhzh46g8oYvL5Zt7vajlDwt7V4jmLCOcObXIVHPCuDON-IAO7ABOi91P7zAuAEAZIFBAgEGAGSBQQIBRgEoAY3gAfjgtwMqAeOzhuoB9XJG6gHk9gbqAe6BqgH8NkbqAfy2RuoB6a-G6gH7NUb2AcB8gcEEICSD9IICQiA4YBwEAEYHfIIG2FkeC1zdWJzeW4tNzI0MzM1MjQzOTEwMjU1M4AKA8gLAbIMFHB1Yi03NDM5MDQxMjU1NTMzODA42BMM&sigh=j7Rbia-FQiM&template_id=492&tpd=AGWhJmt8kdcGr_YiIHCGCSqn7fd0YtOubhQMTeSuHjg-YkLU4w
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.23.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s22-in-f162.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

l
www.google.com/ads/measurement/ Frame EBE3
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRSSxMLv90dyHqVi16oE0rscFPVdWuS9PpuoBdC3U08K4jyRO9n2ujaoTxUTurFYp97zdeg
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame EBE3
2 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 11:08:58 GMT
x-content-type-options
nosniff
server
cafe
age
26972
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Thu, 24 Sep 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame EBE3
295 B
388 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Sep 2020 21:26:58 GMT
x-content-type-options
nosniff
server
cafe
age
76292
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Wed, 23 Sep 2020 21:26:58 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame 58E9
8 KB
7 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020092201&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020092201.js?21067535
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
32ceee30f4fc985fdb9515dd49f1b5a7773060a91c949c807b0b01f85b73e75c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6358
x-xss-protection
0
rtblog.php
lg3.media.net/
35 B
189 B
Image
General
Full URL
https://lg3.media.net/rtblog.php?&gdpr=1&vgd_l1rakh=1600886303128301027&vgd_sc=IDF&vgd_hbReqId=T1600747106C8S19U612&vgd_uspa=0&vgd_isiolc=1&l3ch=4&cc=FR&vgd_implt=0&movlimp=0&vgd_dfp_tgt={%22crid%22:%22184323154%22,%22mnet_segment%22:%220.06%22,%22mnet_variant%22:%22454%22,%22pub_domain%22:%22securityaffairs.co%22,%22mnet_cc%22:%22FR%22,%22mnet_bucketid%22:%22b3%22,%22mnet_nat_tpid%22:%22%22,%22PubMaticSS%22:%221610%22,%22RubiconSS%22:%222209%22,%22mnet_pid%22:%228PRHGG6T9%22}&vgd_asn=9009&vgd_scr_h=1200&vgd_scr_w=1600&vgd_optout=0&vgd_l2type=setting&vgd_bdata=sd2%3Dnull%7C%7Cbb%3D100%7C%7Cvv%3D1%7C%7Cerpm%3D0.06%7C%7Cogerpm%3D0.06%7C%7Csid%3D184323154%7C%7Csd%3D1%7C%7Cuid%3Dl0JgaM7YEWhNRTdrW%7C%7Cdc2%3D1%7C%7Cbtd%3D168749648060760625029724408577138688%7C%7Cscd%3Didf%7C%7Cuim%3D0%7C%7Css%3D1600x1200%7C%7Cuiw%3D-1%7C%7Clast%3D0%7C%7CCI%3D2139%7C%7Cip%3D1vyuSC%7C%7Cfbb%3D0%7C%7Ctb%3D-1%7C%7Cct%3Dsaint-denis%7C%7Crc%3D1%7C%7Cbasis2%3D196%7C%7Curl_b%3D0.08%7C%7Cbasis1%3D196%7C%7CisRef%3D0%7C%7Clc%3D0%7C%7Curl_tvi%3D0%7C%7Curl_l%3D10%7C%7Cbid%3D0.06%7C%7Crivis%3D0%2C0%7C%7Cdc%3D7%7C%7Cgcat%3D500433%7C%7Cogbid%3D0.06%7C%7Ccbdp%3D0.06%7C%7Cbflag%3D1%7C%7Csobp%3D0%7C%7Cddiv%3D%25%25DFP_DIV%25%25%7C%7Cdmm%3D%7C%7Cibc%3D1%7C%7Cmx_sd%3D1%7C%7Cddt%3D-1%7C%7Cnsz%3D1%7C%7Ctgs%3D300x250%7C%7Cbsb%3D0%7C%7Cbsp%3D0&vgd_is_amp=0&vgd_rensize=300_250&vgd_l2wsip=2886781036&wsip=2886781036&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&pid=8PO4A4J48&size=300x250&vi=1600886303245755615&ugd=4&kwrf=https%3A%2F%2Ft.co&bdrid=8&subBdr=454&bdrct=0.06&adx=1&oref=https%3A%2F%2Ft.co&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_crefurl=https%3A%2F%2Ft.co%2FIvwHgUmxJ5&vgd_dfpnc=0&vgd_refadx=15&vgd_demp=false&vgd_refcnf={%22a2y%22:{%22afterLoadSecs%22:30,%22afterViewSecs%22:10,%22percentTraffic%22:95,%22ignoreSessionDisable%22:true,%22both%22:false}}&rtbsd=10&bto=0&vgd_aid=329181030049505581600886309105&vgd_rt=489&pti=41&https=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&vgd_mseg=0.06&hvsid=00001600886309100013824209927324&gdpr=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=21600
server
Apache
date
Wed, 23 Sep 2020 18:38:30 GMT
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Wed, 23 Sep 2020 18:38:30 GMT
show_ads_impl_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20200921/r20190131/ Frame 34C2
229 KB
86 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20200921/r20190131/show_ads_impl_fy2019.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4321766aa8d6f8003df215dc963cbfb70fac2fcdd4e28525fa13b01081f51b4d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
87796
x-xss-protection
0
server
cafe
etag
3062304390244193928
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 23 Sep 2020 18:38:30 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20200921/r20190131/ Frame 0DB1
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20200921/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20200921/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUkDe2stRtcSkdlu56z2krI4oEfaG5RHZ1g6wof3iyE6_wbREVq6lQRzrUts
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Tue, 22 Sep 2020 22:03:26 GMT
expires
Tue, 06 Oct 2020 22:03:26 GMT
content-type
text/html; charset=UTF-8
etag
17942277541989656716
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4728
x-xss-protection
0
age
74104
cache-control
public, max-age=1209600
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 58E9
14 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020092201.js?21067535
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1591403518460474"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5540
x-xss-protection
0
expires
Wed, 23 Sep 2020 18:38:30 GMT
demo_track.php
served-by.pixfuture.com/www/headerbid/library/tracking/ Frame D881
36 B
615 B
XHR
General
Full URL
https://served-by.pixfuture.com/www/headerbid/library/tracking/demo_track.php
Requested by
Host: served-by.pixfuture.com
URL: https://served-by.pixfuture.com/www/headerbid/library/tracking/demo_track.js?v604
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
e70696531ebef4e25c157f95ad6730a529ac4df922aa285b3d6e9236007e8820

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:30 GMT
Content-Encoding
gzip
Server
nginx/1.10.3 (Ubuntu)
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires
Fri, 25 Sep 2020 18:38:30 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012009010507000/ Frame E6B6
206 KB
57 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012009010507000/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091702.js?21067516
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
12a24c1feb4b8e8e3872a9fedee80fcce55a6f59b14607d640fcf4f3054ec43e
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
99746
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
57296
x-xss-protection
0
server
sffe
date
Tue, 22 Sep 2020 14:56:04 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"9e379dcbf00ec980"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Sep 2021 14:56:04 GMT
amp-ad-exit-0.1.js
cdn.ampproject.org/rtv/012009010507000/v0/ Frame E6B6
16 KB
6 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012009010507000/v0/amp-ad-exit-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091702.js?21067516
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d337aa4ea0cace6bd743ef8c3b5d1d20e6e676bb4a650c7335a7383635529f31
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
99757
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5755
x-xss-protection
0
server
sffe
date
Tue, 22 Sep 2020 14:55:53 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"c8394c73e5080432"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Sep 2021 14:55:53 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/012009010507000/v0/ Frame E6B6
95 KB
29 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012009010507000/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091702.js?21067516
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
76a8c8ef4cde9cbd17bbaecf11ee316fab4e55cc661093e4b2d80a4e1ff52897
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
99754
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29275
x-xss-protection
0
server
sffe
date
Tue, 22 Sep 2020 14:55:56 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"56557b91d9fb04b1"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Sep 2021 14:55:56 GMT
amp-fit-text-0.1.js
cdn.ampproject.org/rtv/012009010507000/v0/ Frame E6B6
4 KB
2 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012009010507000/v0/amp-fit-text-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091702.js?21067516
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6fca0b40781598023aed9b45225711771eafce8f14392a49d6ed57d567255002
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
99746
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1795
x-xss-protection
0
server
sffe
date
Tue, 22 Sep 2020 14:56:04 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"b0cc102b09e8903d"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Sep 2021 14:56:04 GMT
amp-form-0.1.js
cdn.ampproject.org/rtv/012009010507000/v0/ Frame E6B6
47 KB
14 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012009010507000/v0/amp-form-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091702.js?21067516
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
21cb9221d772cfd0d3de7240fe5c07ee1c06b9bd945111a2e0491ae243eb0b41
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
99754
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14591
x-xss-protection
0
server
sffe
date
Tue, 22 Sep 2020 14:55:56 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"4ca25f57e218a94a"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Sep 2021 14:55:56 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E6B6
2 KB
2 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091702.js?21067516
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 11:08:58 GMT
x-content-type-options
nosniff
server
cafe
age
26972
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Thu, 24 Sep 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E6B6
295 B
319 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091702.js?21067516
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Sep 2020 21:26:58 GMT
x-content-type-options
nosniff
server
cafe
age
76292
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Wed, 23 Sep 2020 21:26:58 GMT
truncated
/ Frame E6B6
217 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9b3faf696980c8b38be6e9b3cb30c009aacf6299e15a3c6b7a3f0371937bfb3f

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
16296616441242161557
tpc.googlesyndication.com/simgad/ Frame E6B6
100 KB
100 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/16296616441242161557?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkyrSDBzhyf6SRQ3sJBbQT0JWvdgg
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9b3989ca46a92da6edae9d51ddfce33e71bd99d068b36183a6afc6930fd1452b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 04:59:00 GMT
x-content-type-options
nosniff
last-modified
Wed, 23 Sep 2020 03:26:51 GMT
server
sffe
age
49170
status
200
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
102049
x-xss-protection
0
expires
Thu, 23 Sep 2021 04:59:00 GMT
l
www.google.com/ads/measurement/ Frame E6B6
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTQlN_6PViVWSvoYjgsoDDZ2AUUtQzODx0Ts98sis8Moe3ggKmYJAW0sDw4PAQVshbSjK0L
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

adview
securepubads.g.doubleclick.net/pagead/ Frame E6B6
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CVIdIJpZrX5aRB8yngAezxYr4Beqr2Mpentf4jK0M2tkeEAEg0JaYHGD7gYCAiAqgAfGD_ZUDyAEC4AIAqAMByAMIqgSkAk_QxivdMmvw2TqNiHqrYvpS6EQUzDyJ7JpZzT7bZctRZh87vGFlclQFD39oIFO8wcL-ShCoqEa-j1MTnttR6NFkB9DfTF2eKb3YlMUgsZB_a0aJfy78CmAeDVISpgVmVyknuVort0VSWsI8iN44V0xXGJBSmQ-s3TVmXfobQK6BKrGbFxl-8IsR8GpNBEal-MXWLq4oIbaZL58_LamcRuzyPw-f0C-34_zG2oxYOcyxuM5qfO_DxNMHrLFA4yr0Vv-1G2v-8QTnpugXQpWebQTtQT7ijiF_MJaIjU_hoFtdnLm0AMKEPZRKkq-prLnvLY7Ku5v9b1pTndbhiVSSrIq1SvhOZYUxtIb1VS7u7P1tjAwmvNYD0mlvAWU7aGX4QG7WjmXABOm84PC0AuAEAZIFBAgEGAGSBQQIBRgEoAYCgAelo7puqAeOzhuoB9XJG6gHk9gbqAe6BqgH8NkbqAfy2RuoB6a-G6gH7NUb2AcB8gcEENjHDNIICQiA4YBwEAEYHfIIG2FkeC1zdWJzeW4tNzI0MzM1MjQzOTEwMjU1M4AKA8gLAbIMFHB1Yi03NDM5MDQxMjU1NTMzODA42BMM&sigh=WCnWuAS2F6o&tpd=AGWhJmsnbDOJ1N01RmBn0pEvKTqt4O0bFm6pZSHJU4YZ3F3hYA
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.23.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s22-in-f162.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

sodar
pagead2.googlesyndication.com/getconfig/ Frame A8F2
8 KB
7 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020091702&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091702.js?21067516
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
22dab4d474a6928ebc129984dcdbd38cee70f7a2d33ab9e77119efad1d503913
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6412
x-xss-protection
0
rtblog.php
lg3.media.net/
35 B
189 B
Image
General
Full URL
https://lg3.media.net/rtblog.php?&gdpr=1&vgd_l1rakh=1600886303128301027&vgd_sc=IDF&vgd_hbReqId=T1600747106C8S19U612&vgd_uspa=0&vgd_isiolc=1&l3ch=4&cc=FR&vgd_implt=0&movlimp=0&vgd_dfp_tgt={%22crid%22:%22639665355%22,%22mnet_segment%22:%220.06%22,%22mnet_variant%22:%22454%22,%22pub_domain%22:%22securityaffairs.co%22,%22mnet_cc%22:%22FR%22,%22mnet_bucketid%22:%22b3%22,%22mnet_nat_tpid%22:%22%22,%22PubMaticSS%22:%221610%22,%22RubiconSS%22:%222209%22,%22mnet_pid%22:%228PRHGG6T9%22}&vgd_asn=9009&vgd_scr_h=1200&vgd_scr_w=1600&vgd_optout=0&vgd_l2type=setting&vgd_bdata=sd2%3Dnull%7C%7Cbb%3D100%7C%7Cvv%3D1%7C%7Cerpm%3D0.06%7C%7Cogerpm%3D0.06%7C%7Csid%3D639665355%7C%7Csd%3D1%7C%7Cuid%3Dl0JghnEcD1pXFjIcm%7C%7Cdc2%3D1%7C%7Cbtd%3D168749648060760625029724408577138688%7C%7Cbat%3D0%2C0%2C0%7C%7Cscd%3Didf%7C%7Cuim%3D0%7C%7Css%3D1600x1200%7C%7Cuiw%3D-1%7C%7Clast%3D0%7C%7CCI%3D2139%7C%7Cip%3D1vyuSC%7C%7Cfbb%3D0%7C%7Ctb%3D-1%7C%7Cct%3Dsaint-denis%7C%7Crc%3D1%7C%7Cbasis2%3D196%7C%7Curl_b%3D0.08%7C%7Cbasis1%3D196%7C%7CisRef%3D0%7C%7Clc%3D0%7C%7Curl_tvi%3D0%7C%7Curl_l%3D10%7C%7Cbid%3D0.06%7C%7Crivis%3D0%2C0%7C%7Cdc%3D7%7C%7Cgcat%3D500433%7C%7Cogbid%3D0.06%7C%7Ccbdp%3D0.06%7C%7Cbflag%3D1%7C%7Csobp%3D0%7C%7Cddiv%3D%25%25DFP_DIV%25%25%7C%7Cdmm%3D%7C%7Cibc%3D1%7C%7Cmx_sd%3D1%7C%7Cddt%3D-1%7C%7Cnsz%3D1%7C%7Ctgs%3D300x600%7C%7Cbsb%3D0%7C%7Cbsp%3D0&vgd_is_amp=0&vgd_rensize=300_600&vgd_l2wsip=2886781335&wsip=2886781335&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=639665355&pid=8PO4A4J48&size=300x600&vi=1600886303624985478&ugd=4&kwrf=https%3A%2F%2Ft.co&bdrid=8&subBdr=454&bdrct=0.06&adx=1&oref=https%3A%2F%2Ft.co&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_crefurl=https%3A%2F%2Ft.co%2FIvwHgUmxJ5&vgd_dfpnc=0&vgd_refadx=15&vgd_demp=false&vgd_refcnf={%22a2y%22:{%22afterLoadSecs%22:30,%22afterViewSecs%22:10,%22percentTraffic%22:95,%22ignoreSessionDisable%22:true,%22both%22:false}}&rtbsd=10&bto=0&vgd_aid=424379737197480641600886309125&vgd_rt=535&pti=41&https=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&vgd_mseg=0.06&hvsid=00001600886309117013824209925096&gdpr=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=21600
server
Apache
date
Wed, 23 Sep 2020 18:38:30 GMT
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Wed, 23 Sep 2020 18:38:30 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame EBE3
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
0
Image
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date
Wed, 23 Sep 2020 18:38:30 GMT
x-content-type-options
nosniff
server
safe
status
302
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
246
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ Frame 34C2
109 B
126 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200921/r20190131/show_ads_impl_fy2019.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 34C2
109 B
126 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200921/r20190131/show_ads_impl_fy2019.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
afr.php
served-by.pixfuture.com/www/delivery/ Frame 6B87
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=1139220782&adk=2470624294&adf=1357492129&w=320&lmt=1600886310&npa=1&guci=1.2.0.0.2.1.0.0&url=...
  • https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5531
0
0
Document
General
Full URL
https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5531
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200921/r20190131/show_ads_impl_fy2019.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash

Request headers

Host
served-by.pixfuture.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

Server
nginx/1.10.3 (Ubuntu)
Date
Wed, 23 Sep 2020 18:38:31 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Cache-Control
max-age=172800 public, no-transform
Pragma
no-cache
Expires
Fri, 25 Sep 2020 18:38:31 GMT
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Content-Encoding
gzip

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
location
https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5531
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 23 Sep 2020 18:38:30 GMT
server
cafe
content-length
46
x-xss-protection
0
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
osd.js
www.googletagservices.com/activeview/js/current/ Frame 34C2
72 KB
27 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200921/r20190131/show_ads_impl_fy2019.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b1109f4331a2b98162695b55b54a61fb6b0d010e90ab72ecc4543c89f617fa90
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1600688589454019"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
27590
x-xss-protection
0
expires
Wed, 23 Sep 2020 18:38:30 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/16134110849776752827/ Frame EBE3
11 KB
11 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/16134110849776752827/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIjQIQjQEYASABLQAAAD8wjgI4jQFFAACAPw&rs=AOga4qlhQysb12jIJ2PLWe7F_HeV2RUU7A
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009010507000/amp4ads-v0.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9078c52983e95e9499566ecffbf7556c962f0804e0d44a9ccf3a59aa9b96f5e7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 07:52:05 GMT
x-content-type-options
nosniff
last-modified
Mon, 23 Mar 2020 08:40:22 GMT
server
sffe
age
38785
status
200
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10914
x-xss-protection
0
expires
Thu, 23 Sep 2021 07:52:05 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame EBE3
2 KB
2 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009010507000/amp4ads-v0.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 11:08:58 GMT
x-content-type-options
nosniff
server
cafe
age
26972
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Thu, 24 Sep 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame EBE3
295 B
319 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009010507000/amp4ads-v0.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Sep 2020 21:26:58 GMT
x-content-type-options
nosniff
server
cafe
age
76292
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Wed, 23 Sep 2020 21:26:58 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012009010507000/ Frame 6EBA
206 KB
56 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012009010507000/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091601.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
12a24c1feb4b8e8e3872a9fedee80fcce55a6f59b14607d640fcf4f3054ec43e
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
99746
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
57296
x-xss-protection
0
server
sffe
date
Tue, 22 Sep 2020 14:56:04 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"9e379dcbf00ec980"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Sep 2021 14:56:04 GMT
amp-ad-exit-0.1.js
cdn.ampproject.org/rtv/012009010507000/v0/ Frame 6EBA
16 KB
6 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012009010507000/v0/amp-ad-exit-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091601.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d337aa4ea0cace6bd743ef8c3b5d1d20e6e676bb4a650c7335a7383635529f31
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
99757
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5755
x-xss-protection
0
server
sffe
date
Tue, 22 Sep 2020 14:55:53 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"c8394c73e5080432"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Sep 2021 14:55:53 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/012009010507000/v0/ Frame 6EBA
95 KB
29 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012009010507000/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091601.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
76a8c8ef4cde9cbd17bbaecf11ee316fab4e55cc661093e4b2d80a4e1ff52897
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
99754
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29275
x-xss-protection
0
server
sffe
date
Tue, 22 Sep 2020 14:55:56 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"56557b91d9fb04b1"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Sep 2021 14:55:56 GMT
amp-fit-text-0.1.js
cdn.ampproject.org/rtv/012009010507000/v0/ Frame 6EBA
4 KB
2 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012009010507000/v0/amp-fit-text-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091601.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6fca0b40781598023aed9b45225711771eafce8f14392a49d6ed57d567255002
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
99746
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1795
x-xss-protection
0
server
sffe
date
Tue, 22 Sep 2020 14:56:04 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"b0cc102b09e8903d"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Sep 2021 14:56:04 GMT
amp-form-0.1.js
cdn.ampproject.org/rtv/012009010507000/v0/ Frame 6EBA
47 KB
14 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012009010507000/v0/amp-form-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091601.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
21cb9221d772cfd0d3de7240fe5c07ee1c06b9bd945111a2e0491ae243eb0b41
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
99754
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14591
x-xss-protection
0
server
sffe
date
Tue, 22 Sep 2020 14:55:56 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"4ca25f57e218a94a"
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 22 Sep 2021 14:55:56 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6EBA
2 KB
2 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091601.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 11:08:58 GMT
x-content-type-options
nosniff
server
cafe
age
26972
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Thu, 24 Sep 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6EBA
295 B
319 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091601.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Sep 2020 21:26:58 GMT
x-content-type-options
nosniff
server
cafe
age
76292
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Wed, 23 Sep 2020 21:26:58 GMT
truncated
/ Frame 6EBA
215 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
81f8ae856e54e1ae071f008c738da02898661c7cc68ebc0245bba3fcbb236a1d

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
downsize_200k_v1
tpc.googlesyndication.com/simgad/11836928567881954846/ Frame 6EBA
4 KB
4 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/11836928567881954846/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIjQIQjQEYASABLQAAAD8wjgI4jQFFAACAPw&rs=AOga4qmLuNdx_4H4qhsu9WeUqnIeQhjGxw
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a2ae3b1227534679fe794fe07595b331b06e3999c3985a8f8d26cecfafe46917
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 21 Sep 2020 11:14:47 GMT
x-content-type-options
nosniff
last-modified
Thu, 14 May 2020 12:22:17 GMT
server
sffe
age
199423
status
200
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3969
x-xss-protection
0
expires
Tue, 21 Sep 2021 11:14:47 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame 6EBA
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=C0uBSJpZrX6GZDYCL7_UPuva0sAubvbijX-mzrpLuC4nj_5PyDRABINCWmBxg-4GAgIgKoAHjnJmJA8gBBqkCAW6dO8eZsz7gAgCoAwHIAwqqBLMCT9DXst2_3ps-TSHTWaINB9Y7czjtAg0n6PjMZ8EkZ-mTfG4Xm9ZS1MD5pYO8GQljQNufVvL-ZQTZYa7KZzHpIEJ_M5-SPLBOIbgZCtnn-vkKlpRFipSxBTQSxz0rnPNVxAZgoyGyN31zXbwcuEFU5Z0MaGwLjdcOEJqRtPg9dkXuej1VE1iAl766hWB55bwvCKnhykgTZeojqZPjRtPUC-174HcHsyKhNM56M46WnyEpRO_h1F-k1lec7I93jEbfE5jZhbx-IJJywX2ey272i5n2-IFvdRKcCtKpcKuy4dXXE3acQudbRL_2qgzyzxyqvcEJQZvDMnGIaBNE-t39ZHtpxHkwyyjYU4ogn-1rmFJvje7dIyyPR_sioohRVLWPfX_2CpmSFnnykNyAed59HmOCo8AErJqc_owD4AQBkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBjeAB4Xj5naoB47OG6gH1ckbqAeT2BuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwHyBwQQiYUR0ggJCIDhgHAQARgd8ggbYWR4LXN1YnN5bi03MjQzMzUyNDM5MTAyNTUzgAoDyAsBsgwUcHViLTc0MzkwNDEyNTU1MzM4MDjYEwyIFAI&sigh=LGVvAH1vdWs&template_id=492&tpd=AGWhJmvvmuhWKuAgIGCABtDHgJwj-IDz9voAOLfGAM1P1bsjPg
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.23.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s22-in-f162.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

l
www.google.com/ads/measurement/ Frame 6EBA
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTbp7L6Elpwo7LzqrSdJlaIzMyPz-D5e452djuCwX5Fx7x3Pw_VYATtnADdCSv9igMjUoKj
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

sodar
pagead2.googlesyndication.com/getconfig/ Frame C9A3
8 KB
6 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020091601&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091601.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0063808906febaca52c44457586e65c33b76fe9bdd6589cdee931842fcd30f84
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6433
x-xss-protection
0
rtblog.php
lg3.media.net/
35 B
189 B
Image
General
Full URL
https://lg3.media.net/rtblog.php?&gdpr=1&vgd_l1rakh=1600886303128301027&vgd_sc=IDF&vgd_hbReqId=T1600747106C8S19U612&vgd_uspa=0&vgd_isiolc=1&l3ch=4&cc=FR&vgd_implt=0&movlimp=0&vgd_dfp_tgt={%22crid%22:%22762221962%22,%22mnet_segment%22:%220.06%22,%22mnet_variant%22:%22454%22,%22pub_domain%22:%22securityaffairs.co%22,%22mnet_cc%22:%22FR%22,%22mnet_bucketid%22:%22b3%22,%22mnet_nat_tpid%22:%22%22,%22PubMaticSS%22:%221610%22,%22RubiconSS%22:%222209%22,%22mnet_pid%22:%228PRHGG6T9%22}&vgd_asn=9009&vgd_scr_h=1200&vgd_scr_w=1600&vgd_optout=0&vgd_l2type=setting&vgd_bdata=sd2%3Dnull%7C%7Cbb%3D100%7C%7Cvv%3D1%7C%7Cerpm%3D0.06%7C%7Cogerpm%3D0.06%7C%7Csid%3D762221962%7C%7Csd%3D1%7C%7Cuid%3D3o7iBj4GdxWEYwDR9c%7C%7Cdc2%3D1%7C%7Cbtd%3D168749648060760625029724408577138688%7C%7Cscd%3Didf%7C%7Cuim%3D0%7C%7Css%3D1600x1200%7C%7Cuiw%3D-1%7C%7Clast%3D0%7C%7CCI%3D2139%7C%7Cip%3D1vyuSC%7C%7Cfbb%3D0%7C%7Ctb%3D-1%7C%7Cct%3Dsaint-denis%7C%7Crc%3D1%7C%7Cbasis2%3D196%7C%7Curl_b%3D0.08%7C%7Cbasis1%3D196%7C%7CisRef%3D0%7C%7Clc%3D0%7C%7Curl_tvi%3D0%7C%7Curl_l%3D10%7C%7Cbid%3D0.06%7C%7Crivis%3D0%2C0%7C%7Cdc%3D7%7C%7Cgcat%3D500433%7C%7Cogbid%3D0.06%7C%7Ccbdp%3D0.06%7C%7Cbflag%3D1%7C%7Csobp%3D0%7C%7Cddiv%3D%25%25DFP_DIV%25%25%7C%7Cdmm%3D%7C%7Cibc%3D1%7C%7Cmx_sd%3D1%7C%7Cddt%3D-1%7C%7Cnsz%3D1%7C%7Ctgs%3D300x250%7C%7Cbsb%3D0%7C%7Cbsp%3D0&vgd_is_amp=0&vgd_rensize=300_250&vgd_l2wsip=2886781043&wsip=2886781043&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=762221962&pid=8PO4A4J48&size=300x250&vi=1600886303397163734&ugd=4&kwrf=https%3A%2F%2Ft.co&bdrid=8&subBdr=454&bdrct=0.06&adx=1&oref=https%3A%2F%2Ft.co&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_crefurl=https%3A%2F%2Ft.co%2FIvwHgUmxJ5&vgd_dfpnc=0&vgd_refadx=15&vgd_demp=false&vgd_refcnf={%22a2y%22:{%22afterLoadSecs%22:30,%22afterViewSecs%22:10,%22percentTraffic%22:95,%22ignoreSessionDisable%22:true,%22both%22:false}}&rtbsd=10&bto=0&vgd_aid=253286132883618771600886308993&vgd_rt=581&pti=41&https=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&vgd_mseg=0.06&hvsid=00001600886308949013824209929000&gdpr=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=21600
server
Apache
date
Wed, 23 Sep 2020 18:38:30 GMT
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Wed, 23 Sep 2020 18:38:30 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame A8F2
14 KB
5 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091702.js?21067516
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1591403518460474"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5540
x-xss-protection
0
expires
Wed, 23 Sep 2020 18:38:30 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame C9A3
14 KB
5 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020091601.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1591403518460474"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5540
x-xss-protection
0
expires
Wed, 23 Sep 2020 18:38:30 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/210/ Frame 6847
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/210/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
4590
date
Wed, 23 Sep 2020 17:37:51 GMT
expires
Thu, 23 Sep 2021 17:37:51 GMT
last-modified
Wed, 26 Feb 2020 19:47:50 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
3639
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
si
googleads.g.doubleclick.net/pagead/drt/ Frame 6EBA
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
0
Image
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date
Wed, 23 Sep 2020 18:38:30 GMT
x-content-type-options
nosniff
server
safe
status
302
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
246
x-xss-protection
0
si
googleads.g.doubleclick.net/pagead/drt/ Frame E6B6
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
0
Image
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date
Wed, 23 Sep 2020 18:38:30 GMT
x-content-type-options
nosniff
server
safe
status
302
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
246
x-xss-protection
0
runner.html
tpc.googlesyndication.com/sodar/sodar2/210/ Frame CDE8
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/210/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
4590
date
Wed, 23 Sep 2020 17:37:51 GMT
expires
Thu, 23 Sep 2021 17:37:51 GMT
last-modified
Wed, 26 Feb 2020 19:47:50 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
3639
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
runner.html
tpc.googlesyndication.com/sodar/sodar2/210/ Frame 1859
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/210/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
4590
date
Wed, 23 Sep 2020 17:37:51 GMT
expires
Thu, 23 Sep 2021 17:37:51 GMT
last-modified
Wed, 26 Feb 2020 19:47:50 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
3639
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 72A8
89 KB
32 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/djax_elastic.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
828167a34dc57d7b98fdab4265dc3a38b2845f9ebb0f9393e5560fd2ae0caf3f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
32267
x-xss-protection
0
server
cafe
etag
7259451736485547330
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 23 Sep 2020 18:38:30 GMT
demo_track.js
served-by.pixfuture.com/www/headerbid/library/tracking/ Frame EB26
3 KB
3 KB
Script
General
Full URL
https://served-by.pixfuture.com/www/headerbid/library/tracking/demo_track.js?v92
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
7b420ad439dadbbbc88cef506a6e2ea73c331178f08f984c6b230cec7ac66a04

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 23 Sep 2020 18:38:30 GMT
Last-Modified
Mon, 06 Jul 2020 13:30:16 GMT
Server
nginx/1.10.3 (Ubuntu)
ETag
"5f032768-a4e"
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800
Access-Control-Allow-Credentials
true
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Content-Length
2638
Expires
Fri, 25 Sep 2020 18:38:30 GMT
16296616441242161557
tpc.googlesyndication.com/simgad/ Frame E6B6
100 KB
100 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/16296616441242161557?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkyrSDBzhyf6SRQ3sJBbQT0JWvdgg
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009010507000/amp4ads-v0.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9b3989ca46a92da6edae9d51ddfce33e71bd99d068b36183a6afc6930fd1452b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 04:59:00 GMT
x-content-type-options
nosniff
last-modified
Wed, 23 Sep 2020 03:26:51 GMT
server
sffe
age
49170
status
200
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
102049
x-xss-protection
0
expires
Thu, 23 Sep 2021 04:59:00 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E6B6
2 KB
2 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009010507000/amp4ads-v0.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 11:08:58 GMT
x-content-type-options
nosniff
server
cafe
age
26972
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Thu, 24 Sep 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame E6B6
295 B
319 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012009010507000/amp4ads-v0.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 22 Sep 2020 21:26:58 GMT
x-content-type-options
nosniff
server
cafe
age
76292
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Wed, 23 Sep 2020 21:26:58 GMT
show_ads_impl_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20200921/r20190131/ Frame 72A8
229 KB
86 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20200921/r20190131/show_ads_impl_fy2019.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4321766aa8d6f8003df215dc963cbfb70fac2fcdd4e28525fa13b01081f51b4d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
87796
x-xss-protection
0
server
cafe
etag
3062304390244193928
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 23 Sep 2020 18:38:30 GMT
demo_track.php
served-by.pixfuture.com/www/headerbid/library/tracking/ Frame EB26
36 B
615 B
XHR
General
Full URL
https://served-by.pixfuture.com/www/headerbid/library/tracking/demo_track.php
Requested by
Host: served-by.pixfuture.com
URL: https://served-by.pixfuture.com/www/headerbid/library/tracking/demo_track.js?v92
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
e70696531ebef4e25c157f95ad6730a529ac4df922aa285b3d6e9236007e8820

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:31 GMT
Content-Encoding
gzip
Server
nginx/1.10.3 (Ubuntu)
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires
Fri, 25 Sep 2020 18:38:31 GMT
integrator.js
adservice.google.de/adsid/ Frame 72A8
109 B
149 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200921/r20190131/show_ads_impl_fy2019.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 18:38:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 72A8
109 B
149 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200921/r20190131/show_ads_impl_fy2019.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 18:38:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 9CFD
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=1680648786&adk=1022037533&adf=1357492134&w=300&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&ea=0&flash=0&wgl=1&dt=1600886310971&bpp=5&bdt=64&idt=92&shv=r20200921&cbv=r20190131&ptt=5&saldr=sa&correlator=6004642682137&frm=23&ife=1&pv=1&ga_vid=1797332611.1600886311&ga_sid=1600886311&ga_hid=1286253930&ga_fc=0&iag=63&icsg=170&nhd=3&dssz=6&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&isw=0&ish=0&ifk=1585841457&scr_x=0&scr_y=0&oid=3&pvsid=3335063561645774&pem=624&ref=https%3A%2F%2Ft.co%2FIvwHgUmxJ5&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C0&vis=1&rsz=%7C%7CEr%7C&abl=CS&pfx=0&fu=8196&bc=31&ifi=1&uci=1.aghmwxxniyuh&fsb=1&dtd=100
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200921/r20190131/show_ads_impl_fy2019.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=1680648786&adk=1022037533&adf=1357492134&w=300&npa=1&guci=1.2.0.0.2.1.0.0&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&ea=0&flash=0&wgl=1&dt=1600886310971&bpp=5&bdt=64&idt=92&shv=r20200921&cbv=r20190131&ptt=5&saldr=sa&correlator=6004642682137&frm=23&ife=1&pv=1&ga_vid=1797332611.1600886311&ga_sid=1600886311&ga_hid=1286253930&ga_fc=0&iag=63&icsg=170&nhd=3&dssz=6&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&isw=0&ish=0&ifk=1585841457&scr_x=0&scr_y=0&oid=3&pvsid=3335063561645774&pem=624&ref=https%3A%2F%2Ft.co%2FIvwHgUmxJ5&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C0&vis=1&rsz=%7C%7CEr%7C&abl=CS&pfx=0&fu=8196&bc=31&ifi=1&uci=1.aghmwxxniyuh&fsb=1&dtd=100
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUkDe2stRtcSkdlu56z2krI4oEfaG5RHZ1g6wof3iyE6_wbREVq6lQRzrUts; DSID=NO_DATA
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 23 Sep 2020 18:38:31 GMT
server
cafe
content-length
20434
x-xss-protection
0
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
osd.js
www.googletagservices.com/activeview/js/current/ Frame 72A8
72 KB
27 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200921/r20190131/show_ads_impl_fy2019.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b1109f4331a2b98162695b55b54a61fb6b0d010e90ab72ecc4543c89f617fa90
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1600688589454019"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
27590
x-xss-protection
0
expires
Wed, 23 Sep 2020 18:38:31 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame 34C2
8 KB
6 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200921&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200921/r20190131/show_ads_impl_fy2019.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7ce000f165a460015d2bcee66a4434e105a5ab229ec09039d01956147aa7fd3a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 18:38:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6500
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 34C2
14 KB
5 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200921/r20190131/show_ads_impl_fy2019.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1591403518460474"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5540
x-xss-protection
0
expires
Wed, 23 Sep 2020 18:38:31 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 58E9
0
85 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=210&t=2&li=gpt_2020092201&jk=1502173912472842&bg=!R0SlRFxY98K5pwYyvA8CAAAA21IAAAAOCgGPmShQneWftIU8Rd1W5eBOr6EP4ZMtNT1OQtOv1D4tPDaN1PSi2Bp_s48eqI0cb39sZKP7p31QyRkMx93iBmXXe1gSXFuQAJYH4ThaEATuTKond-e5StlnXH1y7sol83pskMq2uhucN_duT6aIXMuiJEICMUisO3bzTQPO6U4QGHOv1dAggG3Sr1aSnQQLg1_TCmda1yYYFSrEpZ6bxboWmWoWec3p_tNiYuHGc06Zso4XTPZPRyTZJLWzn4XuMqnzQKELVolMy931tYkWxm60MRDcHUqzwDnPzxCiORMNPiqykzeKVVOLs33EW2PRG8Ikv8ltV0qeehSKDABDgtZFzEHVL0kgs_5gSTafatsE5wen-Jagbb8t_pJg19Qu8r0V_rDWH8ihjMLdTtHi6ilFO4p9otatgLlK9vcVUS8brvxSc0u_NpDf1w3UmDliKEFAqwnkCTkbbUT4bWXcakFdEKOOFA_13xbrdY6C3PfQ_MBdbUykyX43NdAjI6RNAm7YAYYmUVMk04y1dc-g8_cvmQHHST-jpRp_Gb8a-07l41l-0LgNapxfiGcRxPJNKuQarMFWq_9N15PyUk0CHXJlgyPqjHgqfoyKAEoDytmUfN-ZVpvrO888s9xI-SNi82F3W8RIiZrbnlXmnEGhJFYE6F36XYRtu6ywhPJLRHGhvV1D5K2XJ6h1RQXGmdLVkGvEyxC2upbr2AeDD26c8-jtFrI-CI9RPKEDLRhjQud-y7ucUqqoSqxA6YoGzEj4iaJE9kyNiP56gbqKmfDAW3ShoLO28KCPZNyELE8o1xSYy1szulBoTYmr9s_7FzX9FUehRYt9aB6CDfk5be6EP3WgXldnIGMhkxFGBtRcq9aXOduUtUVl1otDNba6VHq3N5DWvQjvAAUdjxNcyBWRzoBgt3Lv2WRN5il3GedWfKQ3P_BaSCgYdVt0LlZaaRmxMaRaKbLi4MzeYl87kIOHUXPb-Dey9Ho44bM0HlqJUuH9LloRwE7_FE2Zu1aAt5zTofFZt8qF9UC4QlmdtMtWrQvCCrEX6wtvJCSLAWPgSQU1w7i3viGjy8X9pOzdt8WfqtaCJ8u_kWDbQEnzVxhbI1dNrc9LgA2SMzi5q3S34Wlaufb1Q4TWOZ6ws7I
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:31 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame A8F2
0
22 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=210&t=2&li=gpt_2020091702&jk=1011687657204240&bg=!IyClIDhYPHvslGhQQ4sCAAAAvFIAAAATCgHlAHK3mvDSJeJf5rBwxYNwSH299DPVHsnn2cBktk4p0tLI3xZi15xSU6X-ALrTWx84FVufgbYlSAqQz3psWepQauEcyk9UDEQjb0aPR-avNgMAgMyu2lgHwsisXnKljkmFAUnlCrwwbNrwF2S7iR5MTblX2TkqFps4f1JdAMh34z4zTKCbh4SqZdvBrhDmKPJ-cwWdeemPc-OyfdlR36DQYYNxpQ8KwQ8ONjbZLt9extaA1B6vbyu9lnsh0IhxAp7QFStHjkC9nYXmMTqazo2PPmgiz5fddvkiE1JuFnijuhYYzIyaen_6qh1lv95m6hx4YWeeVadbESWXZvDv8EKAOjKgYKzB_WphpSQz37HZwvRN0jygA7gvgBabKbvmZ6wEmQeLWg2DTg-hF6YcWSocPUKq1W0mL6cVSnJJZQmD224RQedlFUk-x2r7mfb1fkNa7QCBZSVxvJ4voJRg5-1W8KMqpCDId6DxzMzDHcgqGGHpFz0JV3KjDCC5NZROFEX7jE13riKpp5qX38-61Ux1MlSRlbR5cUEbVfHKxKYeJh1hZ6zPJz2u4erARa24n48D-rHDaFz0YAjQQUalH7lDedAJlUs6uI-6wA-kxeJVbznhwboAqclwzcYwbSePOUSNYk2ZzbKZAce5LUZzTPl2hTABH3_5PW8vVALNHirPyQcH8UH8ZYaFRqaW4htOil5wCiTolZoqnDlG20Z3nk5S4aAMF35xBpLyLIxFRx0b7OEEbhD4L0--ki4Pc4dGNiYb1MVZXIOnfKiw5HpllByVybWKt_h2ZulmbcUIpWMMZch5fwCCwX6l4ehYmncLPsVivKBc8GrZCF3HbsFKfg_H4JVkQioHjpcL_DnEclKWJOyIGRhJaN3dvis2vn3SDhQi3Y9AjWW5rlLy04Zj4_e69ZNbblzn1WvGkZud2dIeHPrvUvw9gYeZWcELy9p2426-X1ZFmhwa0GtEg5scWSwyiYVcpySKjSLy7F7vTjwOxpuiN4v_MgN4XLt0PoPQxYZ6SelQkL8trSLt8bQJrFDgetvGrif9IkLrcppdCQZ9lma0exsySMpIZcdq3IkDz1u0HjjgMsMkMqtzk0wngRGq-v_Rr-etY7NAUCYZsO9fuDf4IgTdBpuKg9u76IUCU2nC-gTZC2dBs5WJ9Gxq8QilQhmmnOOlfP9PJU-4Piw9QiIIpGpsYlk7kjG5hpn249BsGmDFEEIp1N96gdIruIDMVq_zqbm7gqabuANno6Gepw
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:31 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame C9A3
0
22 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=210&t=2&li=gpt_2020091601&jk=3004539379749096&bg=!YWKlYnpYMiAoXeCClEICAAAAs1IAAAAXCgHtAo7Jz_G_nICOewqlfApdtk0nz9uhZ0OpO5ZLQGD2QJIDfF0vLB_Ovi8EKlfU9qZgsjTdlUEkK-vyEOgQQDyC2Y2lIxsl_NRnDZyykEVc7_gwOGhjRPn9688OmsMuyhiuSDcukgqYRXrhid-PiPineALiakqnfkQTFcF7U600T5aStAoJ4dYrMCWQLnPUqTtLLqGsvVzeS4oUdPoJacFSTygegrf4kIw1RZBXg_nwE9xKJa_5IldZ0OibDYDCJ_1S5MaZtCURFMISU5tz8u3PQFBkhdQw8qugPi8c7Pz6G46PrwiuWaHnW0rcoKcP8hjdlPWvk-Y65g8Gm4bd1RIGsvP53zk0Y4paT_cqCzJL5g-TI6QW6ll3sjXs0AgK0b3gbRXMTpUy-ph_nnHx9N40LSJ1BFWwiZSVaCxPJyWoMxyEhEU3_RnDQg7vuUNIh0qNqbTrhoCMC0OVXgc2be3dr3BbdCFgzvfKyRGOeLu1c-mcAdjFsKaSDOOHjqJLoGVxHOxdZ0CJDw9SDPsLBXS525quPKmFyr64dnmk0qfD3-lI87j0kM2lyhUCrEf6EUUralN3pB-XhC5TDIL1717dqgE0Kr1tF4hogKMUfYqEgcm9nmFCHD-WT-3FF9fqsly-g2TSCpDGG6nz3fYk15kBx7TE5N_SflmPJ9iTTYbtWhsFx1a28lSzjS9C7u3dEZXSA6GROaYHa5TbF29iAXUjnjPynavEv99K4_YkaZxCGz3M4BdTHysbQlr9XAvxptyZiDVXOpaNop23CudzfEb2aD-djAe5CBu0sY0lRXBI-FdnmhmH-mAsW4ZpTOxysg5NVWisFD-hG3-0M-UrsJkw0-kZSM_XS0VKzvByhMikbBeqdg9-RzdQfnFVqLld2AMlRYMN-gZ2TpSdk-uZh_LwCSVXVOSFH6HsfLImx3uDNfaKsDUhLBMyWHnfhk74ArdMeW9VVYTzAHquAxV7NsUsq9eL5IbG0dPuKTMuYlNaXwrdz24n_C3xP3wrCnPHeAJtl1pAreDr7RfOPmY76Ct14uvMQ_nblgoHzv3Eh9NZP23w0_8AMf1x8jmKv4Sq2QJG6U0ePGZMyG1q-kQSukCTY3r8unCwGheJRDobskqBWnOivA1nAjwCz22UjS9pLNKVp1skRCPMdRPhZeHQ6lQfh9rCpL69ecH5roJsdyZaJPsYOzZJhwd8pHKAsy1bWuyiZO8a-s5tz84mTaVSWB3XQKiBA0AUqxkbkoNmOq1_XS23-uhpOFrY
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:31 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/210/ Frame E9AE
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/210/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
4590
date
Wed, 23 Sep 2020 17:37:51 GMT
expires
Thu, 23 Sep 2021 17:37:51 GMT
last-modified
Wed, 26 Feb 2020 19:47:50 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
3640
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
gen_204
pagead2.googlesyndication.com/pagead/ Frame 34C2
0
39 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=210&t=2&li=gda_r20200921&jk=1111301735696087&bg=!GxilGABYfx5oOu5pqMoCAAAARFIAAAANCgFZgVuiLy_cr5Ji0YE8a_DiRLEBs4oLzI4ZsNrjbYmMk0LoxsewZ9GEbEnx2zqDPJA1IYRlskMdo-Dq3Soc47DyBvAHMkSRVBujaQGWgbABATAtigeXX-05CNAbcv5pZ11qlRhqwCuGy77DEl-FD5OHvCO1KebgzOoIxC43m_41g5mjktRvnXtTpB8Ezak-VHkKih8zxkXzcBCXEzhYPrDBkkC-k4aRkvHCokSSoljjFy-IzEDIdKiMv0A2mdcQs54sPtGaCBOi-2on6m5V_Xt2cJNDrHepJvRxfafusQwNiDU1G2sR9zNpfOF3pqDLnhIyK-D8gyQPOS1dlh_ZO6kAbWhG2HUNH_lsneo4Z8rrLMo_byjBRs72b2Nx_lK3EQRVKNmxJthjTekxqY5Hl_KKYAXaKSPxv1qUIUdnYFlT3H3xUmS1tFNKzyK0961p30tu7X1WxqprJqi6mQH_c64OCVDDaeOoTXqYR5uDmWbwY9DD-hw6X_M5MztXGnIOWEGlGmG7zpEtpt1qWI9MKIC7ghvu9Hcs_MYuZT__R_xczD3Aaz9WooK0Sj-Zkb7ne6AHydozKcEIWi0DyFMAHZIDYz_FyIT5jaO-aFfq6vhp6dMi7-vy08Rw5Ygxt2mW2ESDB8tSFRTe89nK73LiaRiAYdUnLq4AkCcBvVIX5PReU3l1RcS_-IxhE2i3hgVNeRRmgVSX0pCs4v-dLHIQXXOGFHQTTOjSJqi9tZLIZI2hlAyGMgg-gNHt3VIg5qBesxj4ZiewsHhmsr0D2AeDM1FT3yeE1VVb98f1kc2vUnBfKVYENIeSD9Gd91z87ryE36dq_fZZZVCOGsbb0Sc-niSxXj-WOngCVFhq8VcsaXzGjd77IllikyR5zWebl6qUookOoMFO1BRcDvMHJ70ciIU3_heZQX0uwHEpICPIFKOtIuZbz7u4Uqhgw29zP0EIm2p0N074gxZGq_FMdeC6cNM2RZUCcFQMtFxqvDzHbWsTixv4FS5iPLezDqL6l-Pz93vZLgy8sLHTXfVdL0x132_tY19zfDtgF386qZutKyRy89fs1GSbQ2vbShpF6CMI59Mul6KsnqeVOZ7inQRNrHGtyyK2FqrQHb9QrNOIovaZP9zXitUiZ2_D9trQSg
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:31 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pd
eu-u.openx.net/w/1.0/ Frame DDD9
0
0
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.193.0 /
Resource Hash

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=8234c821-0f7c-0d62-14dd-34a91039e98d|1600886310
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

status
200
vary
Accept, Accept-Encoding
set-cookie
i=8234c821-0f7c-0d62-14dd-34a91039e98d|1600886310; Version=1; Expires=Thu, 23-Sep-2021 18:38:31 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1600886311|gekin0vNiygu; Version=1; Expires=Thu, 08-Oct-2020 18:38:31 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.193.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Wed, 23 Sep 2020 18:38:31 GMT
content-type
text/html
content-length
420
content-encoding
gzip
via
1.1 google
alt-svc
clear
visitormatch
bh.contextweb.com/ Frame 5728
0
0
Document
General
Full URL
https://bh.contextweb.com/visitormatch
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(9.4.14.v20181114) /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

:method
GET
:authority
bh.contextweb.com
:scheme
https
:path
/visitormatch
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

status
200
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cw-server
bh-deployment-577cbfbc5c-kgdcz
cache-control
private, max-age=0, no-cache, no-store
expires
-1
content-language
en-US
content-type
text/html;charset=iso-8859-1
server
Jetty(9.4.14.v20181114)
strict-transport-security
max-age=15768000
set-cookie
INGRESSCOOKIE=28ad33fcd53acc5a; path=/; HttpOnly; Secure; SameSite=None
async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 179B
0
0
Document
General
Full URL
https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.83 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software
nginx/1.9.13 /
Resource Hash

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

Last-Modified
Fri, 20 May 2016 02:07:09 GMT
ETag
"573e714d-3e3"
Server
nginx/1.9.13
Content-Type
text/html
Vary
Accept-Encoding
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Length
506
Cache-Control
max-age=31536000
Expires
Thu, 23 Sep 2021 18:38:31 GMT
Date
Wed, 23 Sep 2020 18:38:31 GMT
Connection
keep-alive
showad.js
ads.pubmatic.com/AdServer/js/ Frame E9A1
0
0
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software
Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

Last-Modified
Sat, 01 Aug 2020 14:58:34 GMT
ETag
"13006b6-94fd-5abd223c2ac92"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
13837
Content-Type
text/html; charset=UTF-8
Cache-Control
public, max-age=109551
Expires
Fri, 25 Sep 2020 01:04:22 GMT
Date
Wed, 23 Sep 2020 18:38:31 GMT
Connection
keep-alive
Vary
Accept-Encoding
cm
bidswitch-eu.splicky.com/ Frame D881
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=sonobi
  • https://x.bidswitch.net/ul_cb/sync?ssp=sonobi
  • https://bidswitch-eu.splicky.com/cm?bidswitch_ssp_id=sonobi&bsw_custom_parameter=5b56abc1-1b9c-4c0f-b9e6-aafb84d19301
0
0
Image
General
Full URL
https://bidswitch-eu.splicky.com/cm?bidswitch_ssp_id=sonobi&bsw_custom_parameter=5b56abc1-1b9c-4c0f-b9e6-aafb84d19301
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
88.99.98.226 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

status
302
date
Wed, 23 Sep 2020 18:38:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
location
//bidswitch-eu.splicky.com/cm?bidswitch_ssp_id=sonobi&bsw_custom_parameter=5b56abc1-1b9c-4c0f-b9e6-aafb84d19301
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
us.gif
sync.go.sonobi.com/ Frame D881
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=0b24fdfc82&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=0b24fdfc82&gdpr=0&gdpr_consent=
  • https://sync.go.sonobi.com/us.gif?nw=td&nuid=70991e68-ae8e-4ace-a893-d4a0387c084b&pubid=0b24fdfc82
49 B
513 B
Image
General
Full URL
https://sync.go.sonobi.com/us.gif?nw=td&nuid=70991e68-ae8e-4ace-a893-d4a0387c084b&pubid=0b24fdfc82
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:31 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:31 GMT
x-aspnet-version
4.0.30319
status
302
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://sync.go.sonobi.com/us.gif?nw=td&nuid=70991e68-ae8e-4ace-a893-d4a0387c084b&pubid=0b24fdfc82
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
227
usg.gif
sync.go.sonobi.com/ Frame D881
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_cm&google_hm=MTdmMTc3N2EtNTViMC00ZDc0LTgzOTctYzc1YTViY2FjZmQ4
  • https://sync.go.sonobi.com/usg.gif?google_gid=CAESEAXYegOu22LPYjze1glTQdI&google_cver=1
49 B
509 B
Image
General
Full URL
https://sync.go.sonobi.com/usg.gif?google_gid=CAESEAXYegOu22LPYjze1glTQdI&google_cver=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:31 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:31 GMT
server
HTTP server (unknown)
status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://sync.go.sonobi.com/usg.gif?google_gid=CAESEAXYegOu22LPYjze1glTQdI&google_cver=1
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
288
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
us.gif
sync.go.sonobi.com/ Frame D881
Redirect Chain
  • https://p.rfihub.com/cm?pub=35683&in=1
  • https://sync.go.sonobi.com/us.gif?nw=zt&nuid=2159827872193790504
49 B
509 B
Image
General
Full URL
https://sync.go.sonobi.com/us.gif?nw=zt&nuid=2159827872193790504
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:31 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location
https://sync.go.sonobi.com/us.gif?nw=zt&nuid=2159827872193790504
Server
Jetty(9.0.6.v20130930)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
us.gif
sync.go.sonobi.com/ Frame D881
Redirect Chain
  • https://sync.mathtag.com/sync/img?cs_wd_sy=1&dp=43&redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dmediamath%26nuid%3D[MM_UUID]
  • https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=3bd65f6b-9627-4100-b71b-36895b4db4d5
49 B
509 B
Image
General
Full URL
https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=3bd65f6b-9627-4100-b71b-36895b4db4d5
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:31 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Wed, 23 Sep 2020 18:38:31 GMT
Server
MT3 3091 d17e67c master zrh-pixel-x8
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=3bd65f6b-9627-4100-b71b-36895b4db4d5
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Wed, 23 Sep 2020 18:38:30 GMT
RX-f24b1df4-e8dc-41d6-abaf-9d88193ea827-003
sync.targeting.unrulymedia.com/csync/ Frame D881
Redirect Chain
  • https://sync.1rx.io/usersync2/sonobi&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2246676445
  • https://sync.1rx.io/usersync/tradedesk/70991e68-ae8e-4ace-a893-d4a0387c084b
  • https://sync.1rx.io/usersync/tradedesk/70991e68-ae8e-4ace-a893-d4a0387c084b?zcc=1&dspret=0&cb=1600886311677
  • https://sync.targeting.unrulymedia.com/csync/RX-f24b1df4-e8dc-41d6-abaf-9d88193ea827-003
43 B
452 B
Image
General
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-f24b1df4-e8dc-41d6-abaf-9d88193ea827-003
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
213.19.147.150 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
Tengine /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 23 Sep 2020 18:38:32 GMT
Server
Tengine
Connection
keep-alive
Content-Length
43
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:31 GMT
Server
Tengine
Transfer-Encoding
chunked
Content-Type
text/html
Location
https://sync.targeting.unrulymedia.com/csync/RX-f24b1df4-e8dc-41d6-abaf-9d88193ea827-003
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Expires
0
rtset
bh.contextweb.com/bh/ Frame D881
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?do=add&pid=560606&ev=17f1777a-55b0-4d74-8397-c75a5bcacfd8&daaqp=1&rurl=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dpp%26nuid%3D%25%25VGUID%25%25
  • https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=X1hKdjJtZzRQTjNrM2NRVGpLdk5rdw&gdpr=&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm=&google_sc=&google_hm=X1hKdjJtZzRQTjNrM2NRVGpLdk5rdw&gdpr=&gdpr_consent=&google_tc=
  • https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=&gdpr_consent=&ev=CAESEMVFqaaW7Z6ElhRj_psRp9w&google_cver=1
49 B
333 B
Image
General
Full URL
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=&gdpr_consent=&ev=CAESEMVFqaaW7Z6ElhRj_psRp9w&google_cver=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(9.4.14.v20181114) /
Resource Hash
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
content-language
en-US
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
status
200
cache-control
private, max-age=0, no-cache, no-store
content-type
image/gif;charset=iso-8859-1
cw-server
bh-deployment-577cbfbc5c-gjsqf
expires
-1

Redirect headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:31 GMT
server
HTTP server (unknown)
status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=&gdpr_consent=&ev=CAESEMVFqaaW7Z6ElhRj_psRp9w&google_cver=1
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
334
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame 72A8
8 KB
6 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200921&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200921/r20190131/show_ads_impl_fy2019.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a9ee2a5de08a58db6391306bbf472458f01bac4222ede902038f4cad3d0100c5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 23 Sep 2020 18:38:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6501
x-xss-protection
0
bqi.php
lg3.media.net/
15 B
15 B
Image
General
Full URL
https://lg3.media.net/bqi.php?lf=3&&vgd_l2type=setting&vgd_viab=1&katid=801333296&kals=ttype=10002||pc=13&katen=1&pc=13&kata=aton&katbid=-21&kasts=tstype=-10408||gbid=-1&cme=XVK9LqZbwBguHAwk9zkNRKGWOwPk9S5nBTDu7PPRvTK3JTpqA1h3nC5O8F8-g0NwPeiThoOphTCOPXcm7QCVZFwUgOupEcTCq1zFmsKqj3m1TcOBHRBDnbVaQXeEWynUjjipk23tGIuPOotgEjhI6sZXQMzogJ9tNal3jhwJefxu_FAFyPN0onYpicrtqKDCjB8rokV0PjQpUJ7mEzMUiLr7WNY5_ce5||NDHRnZ9Gz3KXlI-i9OnZqQ==|5gDUJdTGiJzedmq9hanWYg==|y2SqoJcE0s-9IUO1sSido6Y3VR48iOc4|Y03IWM0_n517_AztxVlWKQTp0JT0nyJ0Luk9O1tN6COQnr3FG3517XeXK71Ra_iRX7iXGPKBvK12lMbRoqdVitQfEt_rZANPsWtlhCloD4FHGKyTs3CCfw==|N7fu2vKt8_s=|G9p_T8SVnpm9TtkrxzcwpPx7_2EaiJVcdfN4XC85gVV4zFFnAyQ8CbNQGJjK2hU_l6OMtLhLfpDxTxiL2Ax_VT4Qipm9CPDMOYdC6yxosGjZZYQV4tTnVdEB33WtmC6FHZbWQogvgcnKp4NA-5qPwcrEQU8qt0erYZfk3HyLnk-ckjf1tSApDlFonV-MWIxeF-o8HNJVvD7pTBtwvYPajw==|&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&pid=8PO4A4J48&size=300x250&vi=1600886303245755615&l1ch=1&l2ch=0&l2wsip=2886781036&ugd=4&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&kwrf=https%3A%2F%2Ft.co&bdrid=8&subBdr=454&cc=FR&sc=IDF&vgd_isiolc=1&hvsid=00001600886309100013824209927324
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=21600
server
Apache
date
Wed, 23 Sep 2020 18:38:31 GMT
ntcoent-length
15
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
status
200
cache-control
max-age=0, no-cache, no-store
content-length
15
expires
Wed, 23 Sep 2020 18:38:31 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 72A8
14 KB
5 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200921/r20190131/show_ads_impl_fy2019.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 23 Sep 2020 18:38:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1591403518460474"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5540
x-xss-protection
0
expires
Wed, 23 Sep 2020 18:38:31 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/210/ Frame 5B40
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/210/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
4590
date
Wed, 23 Sep 2020 17:37:51 GMT
expires
Thu, 23 Sep 2021 17:37:51 GMT
last-modified
Wed, 26 Feb 2020 19:47:50 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
3640
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
activeview
pagead2.googlesyndication.com/pcs/ Frame EBE3
42 B
189 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss44R9fK_xdwiy0R4RmOT-u897SnwcIG5_AgW1xPuRax35X4cQd1I9D7-0vFyEg-QR4EORh3nWDyMr1xoo4uOVh_MVhtFfAAvJWCtYiOTPIQktnS_aakknWj5Njbg&sai=AMfl-YSlDkO5KRNx992founb-ZAR9lwGT6H-SxDjfJxwDUb5gwbBnf-2Eot7_TzKV8JDT-oZn8y0Zr-V_LhWvWbtugPu1nJABzYyP2SAsoybomM0Hb51G19KcZeUGZ4iqoA&sig=Cg0ArKJSzNASMRDDVzHQEAE&cid=CAASPeRoRUJapjlAvusWjWmoB27uCTAfX35oQ9Vq0cgubaHIujDTsNH4mLuMkqdFNfvXDk2znz8rY1QK9Oo6bPI&id=ampim&o=980,413&d=300,250&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=285&tls=1285&g=100&h=100&tt=1286&r=v&avms=ampa&adk=4133934225
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:31 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
us.gif
sync.go.sonobi.com/ Frame EB26
Redirect Chain
  • https://p.rfihub.com/cm?pub=35683&in=1
  • https://sync.go.sonobi.com/us.gif?nw=zt&nuid=1871878971747009633
49 B
509 B
Image
General
Full URL
https://sync.go.sonobi.com/us.gif?nw=zt&nuid=1871878971747009633
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:32 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location
https://sync.go.sonobi.com/us.gif?nw=zt&nuid=1871878971747009633
Server
Jetty(9.0.6.v20130930)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
us.gif
sync.go.sonobi.com/ Frame EB26
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=sonobi
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=sonobi&bsw_param=09c5b672-9a17-401c-ae54-ab48fa723d79&google_hm=MDljNWI2NzItOWExNy00MDFjLWFlNTQtYWI0OGZhNzIzZDc5
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEM4PhbzwA2iXCDqZ736HM0g&google_cver=1&ssp=sonobi&bsw_param=09c5b672-9a17-401c-ae54-ab48fa723d79
  • https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=09c5b672-9a17-401c-ae54-ab48fa723d79
49 B
509 B
Image
General
Full URL
https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=09c5b672-9a17-401c-ae54-ab48fa723d79
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:32 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

status
302
date
Wed, 23 Sep 2020 18:38:32 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
location
//sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=09c5b672-9a17-401c-ae54-ab48fa723d79
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
us.gif
sync.go.sonobi.com/ Frame EB26
Redirect Chain
  • https://sync.1rx.io/usersync2/sonobi&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-f24b1df4-e8dc-41d6-abaf-9d88193ea827-003&rndcb=2868726503
  • https://p.rfihub.com/cm?in=1&pub=20513&ssp=adconductor
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=1871878971747009633&expires=30&ssp=adconductor
  • https://sync.1rx.io/usersync/bidswitch/09c5b672-9a17-401c-ae54-ab48fa723d79?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-f24b1df4-e8dc-41d6-abaf-9d88193ea827-003?redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Drhythmxchange%26nuid%3DRX-f24b1df4-e8dc-41d6-abaf-9d8...
  • https://sync.go.sonobi.com/us.gif?nw=rhythmxchange&nuid=RX-f24b1df4-e8dc-41d6-abaf-9d88193ea827-003
49 B
513 B
Image
General
Full URL
https://sync.go.sonobi.com/us.gif?nw=rhythmxchange&nuid=RX-f24b1df4-e8dc-41d6-abaf-9d88193ea827-003
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:32 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Wed, 23 Sep 2020 18:38:32 GMT
Server
Tengine
ETag
RXf24b1df4e8dc41d6abaf9d88193ea827003
Transfer-Encoding
chunked
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location
https://sync.go.sonobi.com/us.gif?nw=rhythmxchange&nuid=RX-f24b1df4-e8dc-41d6-abaf-9d88193ea827-003
Connection
keep-alive
Content-Type
text/html
us.gif
sync.go.sonobi.com/ Frame EB26
Redirect Chain
  • https://sync.mathtag.com/sync/img?cs_wd_sy=1&dp=43&redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dmediamath%26nuid%3D[MM_UUID]
  • https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=c5ea5f6b-9627-4400-9f0a-ce73dd1f77dd
49 B
513 B
Image
General
Full URL
https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=c5ea5f6b-9627-4400-9f0a-ce73dd1f77dd
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:32 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Wed, 23 Sep 2020 18:38:32 GMT
Server
MT3 3091 d17e67c master zrh-pixel-x23
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=c5ea5f6b-9627-4400-9f0a-ce73dd1f77dd
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Wed, 23 Sep 2020 18:38:31 GMT
us.gif
sync.go.sonobi.com/ Frame EB26
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=0b24fdfc82&gdpr=0&gdpr_consent=
  • https://sync.go.sonobi.com/us.gif?nw=td&nuid=3f7a93bf-aab2-4968-b6b3-42ababafc88b&pubid=0b24fdfc82
49 B
509 B
Image
General
Full URL
https://sync.go.sonobi.com/us.gif?nw=td&nuid=3f7a93bf-aab2-4968-b6b3-42ababafc88b&pubid=0b24fdfc82
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:32 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:32 GMT
x-aspnet-version
4.0.30319
status
302
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://sync.go.sonobi.com/us.gif?nw=td&nuid=3f7a93bf-aab2-4968-b6b3-42ababafc88b&pubid=0b24fdfc82
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
227
pd
eu-u.openx.net/w/1.0/ Frame B0C4
Redirect Chain
  • https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
  • https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
0
0
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.193.0 /
Resource Hash

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=b42d7903-2346-0c65-2eb3-c370a3b0baa0|1600886311
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

status
200
vary
Accept, Accept-Encoding
set-cookie
i=b42d7903-2346-0c65-2eb3-c370a3b0baa0|1600886311; Version=1; Expires=Thu, 23-Sep-2021 18:38:32 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1600886312|gekin0vNiygu; Version=1; Expires=Thu, 08-Oct-2020 18:38:32 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.193.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Wed, 23 Sep 2020 18:38:32 GMT
content-type
text/html
content-length
418
content-encoding
gzip
via
1.1 google
alt-svc
clear

Redirect headers

status
302
set-cookie
i=b42d7903-2346-0c65-2eb3-c370a3b0baa0|1600886311; Version=1; Expires=Thu, 23-Sep-2021 18:38:31 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.193.0
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
date
Wed, 23 Sep 2020 18:38:31 GMT
content-length
0
via
1.1 google
alt-svc
clear
showad.js
ads.pubmatic.com/AdServer/js/ Frame 78E1
0
0
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software
Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
KADUSERCOOKIE=A26B0344-6513-4D46-A1A0-2A07320D968B; chkChromeAb67Sec=1; DPSync3=1600905600%3A174%7C1602028800%3A197_219_201; SyncRTB3=1602028800%3A7_223_21_8_88_78_3_71_166_99_56_81_220_204_176_189_13_165_5_54_161_22_55_104%7C1601424000%3A67_2_15%7C1602115200%3A35%7C1603411200%3A203%7C1601683200%3A63
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

Last-Modified
Sat, 01 Aug 2020 14:58:34 GMT
ETag
"13006b6-94fd-5abd223c2ac92"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
13837
Content-Type
text/html; charset=UTF-8
Cache-Control
public, max-age=109550
Expires
Fri, 25 Sep 2020 01:04:22 GMT
Date
Wed, 23 Sep 2020 18:38:32 GMT
Connection
keep-alive
Vary
Accept-Encoding
visitormatch
bh.contextweb.com/ Frame 6855
0
0
Document
General
Full URL
https://bh.contextweb.com/visitormatch
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(9.4.14.v20181114) /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

:method
GET
:authority
bh.contextweb.com
:scheme
https
:path
/visitormatch
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
INGRESSCOOKIE=51d330c8e0d9ea9e
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

status
200
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cw-server
bh-deployment-577cbfbc5c-gjsqf
cache-control
private, max-age=0, no-cache, no-store
expires
-1
content-language
en-US
content-type
text/html;charset=iso-8859-1
server
Jetty(9.4.14.v20181114)
strict-transport-security
max-age=15768000
async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 1E72
0
0
Document
General
Full URL
https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/auc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.249.83 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software
nginx/1.9.13 /
Resource Hash

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Response headers

Last-Modified
Fri, 20 May 2016 02:07:09 GMT
ETag
"573e714d-3e3"
Server
nginx/1.9.13
Content-Type
text/html
Vary
Accept-Encoding
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Content-Length
506
Cache-Control
max-age=31536000
Expires
Thu, 23 Sep 2021 18:38:31 GMT
Date
Wed, 23 Sep 2020 18:38:31 GMT
Connection
keep-alive
rtset
bh.contextweb.com/bh/ Frame EB26
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?do=add&pid=560606&ev=617fe50d-78ef-499a-ba13-099a16ba9233&daaqp=1&rurl=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dpp%26nuid%3D%25%25VGUID%25%25
  • https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=dnpzSGl6RHN1TW05Z1c1RmRkZkdVZw&gdpr=&gdpr_consent=
  • https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=&gdpr_consent=&ev=CAESEMVFqaaW7Z6ElhRj_psRp9w&google_cver=1
49 B
333 B
Image
General
Full URL
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=&gdpr_consent=&ev=CAESEMVFqaaW7Z6ElhRj_psRp9w&google_cver=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(9.4.14.v20181114) /
Resource Hash
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
content-language
en-US
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
status
200
cache-control
private, max-age=0, no-cache, no-store
content-type
image/gif;charset=iso-8859-1
cw-server
bh-deployment-577cbfbc5c-gjsqf
expires
-1

Redirect headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:32 GMT
server
HTTP server (unknown)
status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=&gdpr_consent=&ev=CAESEMVFqaaW7Z6ElhRj_psRp9w&google_cver=1
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
334
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
usg.gif
sync.go.sonobi.com/ Frame EB26
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_cm&google_hm=NjE3ZmU1MGQtNzhlZi00OTlhLWJhMTMtMDk5YTE2YmE5MjMz
  • https://sync.go.sonobi.com/usg.gif?google_gid=CAESEIkHeORHWA82ANjOOUOl3Nw&google_cver=1
49 B
513 B
Image
General
Full URL
https://sync.go.sonobi.com/usg.gif?google_gid=CAESEIkHeORHWA82ANjOOUOl3Nw&google_cver=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 23 Sep 2020 18:38:32 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:32 GMT
server
HTTP server (unknown)
status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://sync.go.sonobi.com/usg.gif?google_gid=CAESEIkHeORHWA82ANjOOUOl3Nw&google_cver=1
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
288
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 72A8
0
24 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=210&t=2&li=gda_r20200921&jk=3335063561645774&bg=!XF-lX0dYfvtNxU-rbVcCAAAAwlIAAAAOCgDUJisnE7gSFGcqnKdM3A_CAJyRQSbMgxEdeVyc2CZmEj1gHzA1YJuiBKmYuRltD-Yw9oQ7j68i60pCxGZm5r-kfN09QZ-G7CESxnGEjnyGeQF7O1IjkAmpMaynLlEidGhq3gEtA5jHhgOsOlfaTCHPVPHnmaqgAZ5ke_BMLXtLQNLnwbfmv-WatXaoD-WbOmalDPPFdp2hAm_KEm1vNrDcSZCpZowNLovxJUBBrzrfEIw0q8xE4lf1YlCwIgtPfFWVw4rm9CXGlOGgl5NE6mLlpeOBZNaZAf9KSYcGcSRIhl2OH42ZkTOTv2Uy1YIRYM6NBZPD4Z_wmROhedfSi3SZ4SspB8F-hhDUVjxzJNedSKBlOYTQFm_yyomX19hbBSpZOXMl8vOsEJ_iVlfjvAMryiGMACJ2p6JZkPKAVDRABRADt-elalECGffEbkQaM0NY0Ramr6Z2cf-AZgxLb1n5Ul3gpTRYRAt1NXDuAhhjcEfYJeTqpk0JLRAU0tY8lT6-useD9wa2PBBj6tzijS2GwhIzR8bkyNz3f1SIl2iLup6mw313FuExjbL-CrT9s89CayZ4cLnGvNyDxXlQW2AP44ei1ov0eKKh-L9wQHo4Iytyea1bIOQYRWNzEqnxstUgvvPLv44El99Vy7_XEBphoplnUd2I61qXiq5qGzFmzKuX32ARZ7_m97_OhqQoVilxr-isoyIZdoPw2FAGkJN0CmqbWrDS0cQguRnwSH56eE-FtOqthZK5nio5RlnRxYbSpldyOefYrCkyRqoDDXbz96PlzvIxB8yXHPN_4oTTWmr9d7fvEENN7BzLAjchl8YlxeGWAtWMJhbwZBmSEzrTnRU1OKnGslxWSzfqBCOYiIZ-FA7Kf8B-XjCYnqXPoDITjBDOWeb3Tc70HceIB622MhOzI4tNTu-THuV9nTlwMw2kwm47pxTjRmoNSckFEckDwXqyKvy3
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:31 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
log
hblg.media.net/
35 B
194 B
Image
General
Full URL
https://hblg.media.net/log?logid=aplog&pid=8PREB0781&itype=HB-CM&dn=securityaffairs.co&cid=8HB41O6BH&svr=2020092111_39&servname=hbcm_na&gdpr=1&csex=2&csstr=&tcf_cmp=&tcf_status=&tcf_prp=&usp_status=0&usp_enf=1&usp_string=&ufca=&usp_ldf=&ugd=4&adt=desktop&vid=00001600886309570013824209926074&vsid=&sd=1&gtd=400&inid=0&gfd=&cc=FR&sc=IDF&ct=PARIS&abte=CONTROL&adbd=0&amp=0&version=1&sB=true&cors=true&disB=false&ice=0&vw=1600&vh=1200&pht=5144&cl=&__rk=0&app=0&rtype=&vendor=Google%20Inc.&isSafari=0&pvid=0&prvAccId=&prvApiId=&exid=&pcId=0000EEA&pseat=&adj1=0&adj0=0&adj2=0&adj3=0&mowxReqId=&crid=170605770&g=0&size=300x250&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=0&bdp=0&cbdp=0&dcbdp=0&ckfl=&cs=&mnet_ckfl=&cat=&attr=&pvAgNm=&pvAgId=&advId=&advNm=&advUrl=&dfpBd=0&nms=1&di=&dt=&epc=&ogbdp=0&s=1&snm=success&dbf=1&bdata=&cmpid=&bId=&pcrid=&ruct=0&brs=&brr=&iurl=&htps=0&ptype=27&pbidflr=0&exp=&bfs=0&seat=&nbr=&ba=1&ybnca_gbid=&ybnca_erpm=&ybnca_vbid=&yogbdp=&yErpmFlag=&smsrc=1&strg=&ybnca_bbid=&prvReqId=&dStat=&ogbid=0&acid=253286132883618771600886308993&act=headerBid&dtfdl=&dspltime=&ttfd=&rtime=&dtc=&rtbsv2=&apid=&wsip=&ltime=&abs=&ssregion=&ssreqid=&sssvnm=&top=0&btm=0&lft=0&rght=0&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=-1&patkey=&patint=&pc=&spSource=0&spIvt=0&spId=&spFst=0&spIsReq=0&spTo=0&pgcatiab=&pgcatiab2=&pgcatsprig=&gFunDl=false&ngFunDl=false&rDl=false&refVisId=&osnbr=&brf=0&iwb=1&toconsider=0&dcs=&auMxTm=&actltime=573&acsn=1&dfpDiv=&dfpAdPath=&dfpPos=&sbdrid=454&bbdrid=&td=%7C&pvNbr=&pvNbrDtls=&lper=1&pvid=0&prvAccId=&prvApiId=&exid=&pcId=0000EEA&pseat=&adj1=0&adj0=0&adj2=0&adj3=0&mowxReqId=&crid=512365842&g=0&size=300x250&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=0&bdp=0&cbdp=0&dcbdp=0&ckfl=&cs=&mnet_ckfl=&cat=&attr=&pvAgNm=&pvAgId=&advId=&advNm=&advUrl=&dfpBd=0&nms=1&di=&dt=&epc=&ogbdp=0&s=1&snm=success&dbf=1&bdata=&cmpid=&bId=&pcrid=&ruct=0&brs=&brr=&iurl=&htps=0&ptype=27&pbidflr=0&exp=&bfs=0&seat=&nbr=&ba=0&ybnca_gbid=&ybnca_erpm=&ybnca_vbid=&yogbdp=&yErpmFlag=&smsrc=1&strg=&ybnca_bbid=&prvReqId=&dStat=&ogbid=0&acid=329181030049505581600886309105&act=headerBid&dtfdl=&dspltime=&ttfd=&rtime=&dtc=&rtbsv2=&apid=&wsip=&ltime=&abs=&ssregion=&ssreqid=&sssvnm=&top=0&btm=0&lft=0&rght=0&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=-1&patkey=&patint=&pc=&spSource=0&spIvt=0&spId=&spFst=0&spIsReq=0&spTo=0&pgcatiab=&pgcatiab2=&pgcatsprig=&gFunDl=false&ngFunDl=false&rDl=false&refVisId=&osnbr=&brf=0&iwb=1&toconsider=0&dcs=&auMxTm=&actltime=485&acsn=1&dfpDiv=&dfpAdPath=&dfpPos=&sbdrid=454&bbdrid=&td=%7C&pvNbr=&pvNbrDtls=&lper=1&pvid=0&prvAccId=&prvApiId=&exid=&pcId=0000EEA&pseat=&adj1=0&adj0=0&adj2=0&adj3=0&mowxReqId=&crid=555212031&g=0&size=300x600&sec=&chnl=&prspt=headerBid&rfc=0&tref=0&fpuReq=0&bdp=0&cbdp=0&dcbdp=0&ckfl=&cs=&mnet_ckfl=&cat=&attr=&pvAgNm=&pvAgId=&advId=&advNm=&advUrl=&dfpBd=0&nms=1&di=&dt=&epc=&ogbdp=0&s=1&snm=success&dbf=1&bdata=&cmpid=&bId=&pcrid=&ruct=0&brs=&brr=&iurl=&htps=0&ptype=27&pbidflr=0&exp=&bfs=0&seat=&nbr=&ba=0&ybnca_gbid=&ybnca_erpm=&ybnca_vbid=&yogbdp=&yErpmFlag=&smsrc=1&strg=&ybnca_bbid=&prvReqId=&dStat=&ogbid=0&acid=424379737197480641600886309125&act=headerBid&dtfdl=&dspltime=&ttfd=&rtime=&dtc=&rtbsv2=&apid=&wsip=&ltime=&abs=&ssregion=&ssreqid=&sssvnm=&top=0&btm=0&lft=0&rght=0&ttm=0&vtm=0&sttm=0&svtm=0&mnrfc=0&mnrf=0&invw=-1&patkey=&patint=&pc=&spSource=0&spIvt=0&spId=&spFst=0&spIsReq=0&spTo=0&pgcatiab=&pgcatiab2=&pgcatsprig=&gFunDl=false&ngFunDl=false&rDl=false&refVisId=&osnbr=&brf=0&iwb=1&toconsider=0&dcs=&auMxTm=&actltime=532&acsn=1&dfpDiv=&dfpAdPath=&dfpPos=&sbdrid=454&bbdrid=&td=%7C&pvNbr=&pvNbrDtls=&lper=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&kwrf=https%3A%2F%2Ft.co&epurl=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Jetty(9.4.25.v20191220) /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:36 GMT
server
Jetty(9.4.25.v20191220)
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Wed, 23 Sep 2020 18:38:36 GMT
log
hblg.media.net/
35 B
194 B
Image
General
Full URL
https://hblg.media.net/log?logid=kfk&evtid=relog&pid=8PREB0781&itype=HB-CM&dn=securityaffairs.co&cid=8HB41O6BH&svr=2020092111_39&servname=hbcm_na&gdpr=1&csex=2&csstr=&tcf_cmp=&tcf_status=&tcf_prp=&usp_status=0&usp_enf=1&usp_string=&ufca=&usp_ldf=&ugd=4&adt=desktop&vid=00001600886309570013824209926074&vsid=&sd=1&gtd=400&inid=0&gfd=&cc=FR&sc=IDF&ct=PARIS&abte=CONTROL&adbd=0&amp=0&version=1&sB=true&cors=true&disB=false&ice=0&vw=1600&vh=1200&pht=5144&cl=&__rk=0&app=0&rtype=&vendor=Google%20Inc.&isSafari=0&ffp=0.06&efp=qcqj&mdf=0.06&mdk=mnet_segment&rp=&rf=&rfs=nfetched&dfpAdPath=%2F45361917%2F8CU5BD6EW-184323154-Single_post_ads&src=Dynamic&lper=1&ffp=0.06&efp=qcqj&mdf=0.06&mdk=mnet_segment&rp=&rf=&rfs=nfetched&dfpAdPath=%2F45361917%2F8CU5BD6EW-639665355-Skyscraper_post_yahoo_300_x_600&src=Dynamic&lper=1&ffp=0.06&efp=qcqj&mdf=0.06&mdk=mnet_segment&rp=&rf=&rfs=nfetched&dfpAdPath=%2F45361917%2F8CU5BD6EW-762221962-300x250_inside_post&src=Dynamic&lper=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F108644%2Fmalware%2Foldgremlin-ransomware-attacks.html&kwrf=https%3A%2F%2Ft.co&epurl=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.68.31 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-68-31.deploy.static.akamaitechnologies.com
Software
Jetty(9.4.25.v20191220) /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 23 Sep 2020 18:38:36 GMT
server
Jetty(9.4.25.v20191220)
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Wed, 23 Sep 2020 18:38:36 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Roboto+Condensed%3A400italic%2C700italic%2C400%2C700&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Cgreek%2Ccyrillic%2Clatin-ext%2Cvietnamese&ver=ab666092e6aa075ec4beae7c3cab6002
Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=ab666092e6aa075ec4beae7c3cab6002
Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Playfair+Display%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=ab666092e6aa075ec4beae7c3cab6002
Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=ab666092e6aa075ec4beae7c3cab6002

Verdicts & Comments Add Verdict or Comment

97 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes string| em_version boolean| em_track_user string| em_no_track_reason string| disableStr function| __gaTrackerIsOptedOut function| __gaTrackerOptout function| gaOptout string| GoogleAnalyticsObject function| __gaTracker function| ga object| _wpemojiSettings object| FB object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| twemoji object| wp object| exactmetrics_frontend function| ExactMetrics object| ExactMetricsObject undefined| $ function| jQuery object| Cli_Data object| cli_cookiebar_settings object| log_object object| CLI_Cookie object| CLI object| cliBlocker string| CLI_ACCEPT_COOKIE_NAME string| CLI_PREFERNCE_COOKIE number| CLI_ACCEPT_COOKIE_EXPIRE boolean| CLI_COOKIEBAR_AS_POPUP object| stlib boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus boolean| sop_pview_logged string| stWidgetVersion string| refQuery object| stLight boolean| st_showing object| st object| __stdos__ function| __sharethis__docReady object| __sharethis__ object| icwp_wpsf_vars_lpantibot object| iCWP_WPSF_LoginGuard_Gasp boolean| cli_flush_cache object| _mNHandle string| medianet_versionId object| _mN object| _mNSrv function| setup string| _mN_Idf string| _mN_ctrM number| _mN_ctr object| mnjs object| hbCMBidxc function| _cR function| _cD object| _mNDetails function| _cmL1Require function| _cmL1Define object| _mN_dy object| _mNadPrvLog function| refreshTag string| refreshInterval string| keyword object| click_object object| Main object| BrowserDetect object| jQuery1124036621555774783787 object| mejs function| onYouTubePlayerAPIReady function| onYouTubePlayerReady function| MediaElement function| MediaElementPlayer function| $j function| imagePreview object| _stq string| currentText string| categoryCookie object| categoryCookieValue object| cli_chkbox_elm string| cli_chkbox_data_id string| cli_chkbox_data_id_trimmed function| st_go function| linktracker_init object| wpcom object| google_reactive_ads_global_state object| ampInaboxPositionObserver object| ampInaboxFrameOverlayManager object| google_ad_modifications number| google_global_correlator object| google_prev_clients object| google_jobrunner

32 Cookies

Domain/Path Name / Value
.adform.net/ Name: uid
Value: 8719475888376965311
.doubleclick.net/ Name: IDE
Value: AHWqTUk9AspsAbcGLGQp3ngBeoO4MdJt9IN8eh23noUC0Js06fTb0t56b_oIC11m
.pubmatic.com/ Name: PugT
Value: 1600886315
.pubmatic.com/ Name: KRTBCOOKIE_1051
Value: 22884-18072662227232058608
.pubmatic.com/ Name: SPugT
Value: 1600886314
.pubmatic.com/ Name: KRTBCOOKIE_188
Value: 3189-no-consent
.pubmatic.com/ Name: KRTBCOOKIE_699
Value: 22727-AAM_Qk6-1ywAAA-UU8REzQ
.pubmatic.com/ Name: KRTBCOOKIE_107
Value: 1471-uid:tAwPFzfl1Kl9EY5
.pubmatic.com/ Name: KRTBCOOKIE_409
Value: 22966-fLfChebJqxogKSMUfbYEVhse&KRTB&23212-fLfChebJqxogKSMUfbYEVhse
.pubmatic.com/ Name: KRTBCOOKIE_153
Value: 19420-MkKoBD4SrFEqQfgFMkCzVzRF_VMqEP1eNBPw_U77&KRTB&22979-MkKoBD4SrFEqQfgFMkCzVzRF_VMqEP1eNBPw_U77
.pubmatic.com/ Name: KRTBCOOKIE_391
Value: 22924-8719475888376965311
.pubmatic.com/ Name: KRTBCOOKIE_279
Value: 22890-fb97a8b7-fdcb-11ea-ba77-430d98caecc5
.pubmatic.com/ Name: KRTBCOOKIE_1074
Value: 22956-e_72801681-e639-4209-a143-cf1bb0f2522f
.pubmatic.com/ Name: KRTBCOOKIE_1101
Value: 23040-6875754350402992269
.pubmatic.com/ Name: KRTBCOOKIE_377
Value: 22918-3f7a93bf-aab2-4968-b6b3-42ababafc88b&KRTB&23031-3f7a93bf-aab2-4968-b6b3-42ababafc88b
.pubmatic.com/ Name: KRTBCOOKIE_22
Value: 14911-8941654166213270103
.pubmatic.com/ Name: KRTBCOOKIE_27
Value: 16735-uid:a9565f6b-9627-4900-919a-458a2006beab&KRTB&16736-uid:a9565f6b-9627-4900-919a-458a2006beab&KRTB&23019-uid:a9565f6b-9627-4900-919a-458a2006beab&KRTB&23114-uid:a9565f6b-9627-4900-919a-458a2006beab
.pubmatic.com/ Name: KRTBCOOKIE_80
Value: 16514-CAESEClR2udqS6sq7wb6YTfWG4Q&KRTB&22987-CAESEClR2udqS6sq7wb6YTfWG4Q&KRTB&23025-CAESEClR2udqS6sq7wb6YTfWG4Q
.pubmatic.com/ Name: SyncRTB3
Value: 1601683200%3A63%7C1602028800%3A78_56_54_220_22_104_165_5_223_166_99_204_13_88_71_189_7_21_8_55_3_81_161_176%7C1601424000%3A67_2_15%7C1603411200%3A203%7C1606003200%3A69%7C1602115200%3A35
.pubmatic.com/ Name: chkChromeAb67Sec
Value: 2
.pubmatic.com/ Name: KRTBCOOKIE_594
Value: 17105-OPTOUT&KRTB&17107-OPTOUT
.openx.net/ Name: i
Value: b42d7903-2346-0c65-2eb3-c370a3b0baa0|1600886311
.tapad.com/ Name: TapAd_TS
Value: 1600886312306
.pubmatic.com/ Name: KTPCACOOKIE
Value: YES
bh.contextweb.com/ Name: INGRESSCOOKIE
Value: 51d330c8e0d9ea9e
.tapad.com/ Name: TapAd_DID
Value: fb367521-fdcb-11ea-be00-6246df869f1a
.pubmatic.com/ Name: DPSync3
Value: 1602028800%3A201_221_197_219%7C1600905600%3A174
.pubmatic.com/ Name: pi
Value: 158127:3
.pubmatic.com/ Name: KADUSERCOOKIE
Value: A26B0344-6513-4D46-A1A0-2A07320D968B
.pubmatic.com/ Name: KRTBCOOKIE_466
Value: 16530-09c5b672-9a17-401c-ae54-ab48fa723d79
.pubmatic.com/ Name: PUBMDCID
Value: 3
.openx.net/ Name: pd
Value: v2|1600886312|gekin0vNiygu

3 Console Messages

Source Level URL
Text
console-api info URL: https://cdn.ampproject.org/rtv/012009010507000/amp4ads-v0.js(Line 420)
Message:
Powered by AMP ⚡ HTML – Version 2009010507000 https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
console-api info URL: https://cdn.ampproject.org/rtv/012009010507000/amp4ads-v0.js(Line 420)
Message:
Powered by AMP ⚡ HTML – Version 2009010507000 https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html
console-api info URL: https://cdn.ampproject.org/rtv/012009010507000/amp4ads-v0.js(Line 420)
Message:
Powered by AMP ⚡ HTML – Version 2009010507000 https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

321367e28afa0a657117604da9c84c8b.safeframe.googlesyndication.com
a0d272f7821b449096461d37c24767a2.safeframe.googlesyndication.com
acdn.adnxs.com
ads.pubmatic.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
apex.go.sonobi.com
bh.contextweb.com
bid.contextweb.com
bidswitch-eu.splicky.com
buttons-config.sharethis.com
c.sharethis.mgr.consensu.org
ca6624df3d636591ab3085d983574842.safeframe.googlesyndication.com
cdn.ampproject.org
cdn.pixfuture.com
cm.g.doubleclick.net
connect.facebook.net
contextual.media.net
eu-u.openx.net
fonts.googleapis.com
google-analytics.com
googleads.g.doubleclick.net
hblg.media.net
hbopenbid.pubmatic.com
i0.wp.com
i1.wp.com
i2.wp.com
ib.adnxs.com
ice.360yield.com
l.sharethis.com
lg3.media.net
match.adsrvr.org
maxcdn.bootstrapcdn.com
p.rfihub.com
pagead2.googlesyndication.com
pixel.wp.com
pixfuture2-d.openx.net
platform-api.sharethis.com
prebid.mgid.com
secure.gravatar.com
securepubads.g.doubleclick.net
securityaffairs.co
served-by.pixfuture.com
stats.wp.com
sync.1rx.io
sync.go.sonobi.com
sync.mathtag.com
sync.targeting.unrulymedia.com
t.co
tpc.googlesyndication.com
ws.sharethis.com
www.google-analytics.com
www.google.com
www.googletagservices.com
x.bidswitch.net
fonts.googleapis.com
104.19.135.78
104.244.42.5
172.217.23.162
178.162.133.149
178.162.133.150
185.29.133.58
185.33.221.52
185.64.189.112
192.0.76.3
192.0.77.2
193.0.160.129
198.148.27.133
198.148.27.139
2.18.68.31
2001:4de0:ac19::1:b:1b
2001:8d8:100f:f000::289
213.19.147.150
216.58.212.162
23.210.249.83
23.210.249.92
2600:9000:2057:b200:3:c04e:c780:93a1
2600:9000:20e8:0:1c:8a07:5e80:93a1
2600:9000:20e8:8400:c:abe:f440:93a1
2600:9000:20e8:d400:c:a9b7:ddc0:93a1
2606:2800:233:97b6:26be:138a:cba8:bb01
2606:4700:20::ac43:4671
2a00:1450:4001:801::2001
2a00:1450:4001:802::2001
2a00:1450:4001:802::2002
2a00:1450:4001:802::2004
2a00:1450:4001:816::2002
2a00:1450:4001:817::2001
2a00:1450:4001:819::2004
2a00:1450:4001:81a::2001
2a00:1450:4001:820::200e
2a03:2880:f01c:8012:face:b00c:0:3
2a04:fa87:fffe::c000:4902
3.127.132.197
34.98.64.218
35.156.19.236
52.48.46.226
54.93.169.238
68.183.31.14
88.99.98.226
0063808906febaca52c44457586e65c33b76fe9bdd6589cdee931842fcd30f84
009c8d0fc728e428a19dca24595d8011e60490f35b63c0665b3ac3dcfba8f954
00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286
00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
06aded8ded5c624897594d096db31ef293a895baea1c6298deb67ef1e626c9c9
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34
083b39fcd8c99c9a41c40424ef0f84798a3e3026c1d8f780837a9e89b32fc945
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
093fa1b3be5a5ed806dc8873e932ce049231b1b9bab39fb85e63ab8229d57c0b
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878
0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
12a24c1feb4b8e8e3872a9fedee80fcce55a6f59b14607d640fcf4f3054ec43e
13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742
1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea
18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19
1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82
1ab970ff1c0ee9608c6ff1bf5b69cb7849878970c08dd775ad7cb846ff55d93e
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1f0864479892c756ec515a5eb5c58db8cb9d91e34c6c3e2a89aeb834eac6815a
2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3
21cb9221d772cfd0d3de7240fe5c07ee1c06b9bd945111a2e0491ae243eb0b41
22dab4d474a6928ebc129984dcdbd38cee70f7a2d33ab9e77119efad1d503913
2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732
23fbc3ff40c721a5bc44b4e164affb8fdf97df9dc562db5c68d8df8de899e786
24b5b710e6775ec2974c8b28d69d4344c6384734de05cec54dcee8741edf8c61
2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f
2cbb8dfc4483c9ce680df342866531ac656e8bed029dcd37a1872327023da5f8
2db5ea0ceb5aa35a0cb6d802015977435fef83133321296ee9535d3e50cde902
32ceee30f4fc985fdb9515dd49f1b5a7773060a91c949c807b0b01f85b73e75c
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
3afe47d0fe0b16bc5bddecdc9bcaca94ed420b8fd0ddee2ae77364403c794bb8
3be81ab15cc2905d3ef54418cd0fa664e85d19c4a5550e28b071a39bd1316070
4321766aa8d6f8003df215dc963cbfb70fac2fcdd4e28525fa13b01081f51b4d
45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6
47b7eca532164db5ab2d449b46f69a7807b3c035f0a335362ae5c34342426763
4c6b4ef22f4c5dd8fd6e17ab6706d8c55d236824c20b3d8dcd310f7de744def6
4e122620f7885cc60dbd04f68bbbb4b38096028684711bf2a1d370b31469be31
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee
55b19646abcf6c77f6db1e7d9aeac4fb26933af7438807c70332b134787dec34
56159a7fa211c042c8da7005984653715f938917383f74292247f7b271469fb6
5a9b21c4eae4b293b4f5e2544eadf2db4a80f16a5c0e78da98dc5cc821696ed0
5c694f9fa4a1b64cd4bf585c6283dea32408419dad6df0ca8b4ea5da1f04579f
5cbf31f01d7d1ce4853bcd6cc64dbfd103d412ec14d8bcc4ebca3b35dc3f3b74
5e1390f7c515a04fbd18d7c3e864de65e7fc473f8a2e5134f74a79e122911dd7
6083ab99860d08b524463c0a71edb943916013b9dfb088c99afcdd92131cf8fe
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
65cfa6801a0886fab249b224e8a6982b4740fe7879fce99ff13ddaac9aaca01a
66156947218c139e42fec91f2a7898786d08df3b7e05e89ec8925415e831432e
6fca0b40781598023aed9b45225711771eafce8f14392a49d6ed57d567255002
72a31dc8c0d50bd3ee468d9b16cf5f02998f89bb1f203327eabd648587d3987a
7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46
759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1
76a18f5f0637e0d73ce1afece898ce8b0fa75bb6b1c1990ae4a7ac6b083045ce
76a8c8ef4cde9cbd17bbaecf11ee316fab4e55cc661093e4b2d80a4e1ff52897
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
7a8cf6b7fce01f318e416ae1904132265526ca2b6ef3003f7fe831186a7380a0
7b420ad439dadbbbc88cef506a6e2ea73c331178f08f984c6b230cec7ac66a04
7ce000f165a460015d2bcee66a4434e105a5ab229ec09039d01956147aa7fd3a
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
81f8ae856e54e1ae071f008c738da02898661c7cc68ebc0245bba3fcbb236a1d
828167a34dc57d7b98fdab4265dc3a38b2845f9ebb0f9393e5560fd2ae0caf3f
8544f21a9a07940f2bdf465d82b1d476e38e68da5d90a487c6e2b905d6b29e83
8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
9078c52983e95e9499566ecffbf7556c962f0804e0d44a9ccf3a59aa9b96f5e7
96f39bc4007dfc2bb5466a7ac3e43df7b0bb3a8545e1b81d6153d09ee5a70e3b
9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b
9b3989ca46a92da6edae9d51ddfce33e71bd99d068b36183a6afc6930fd1452b
9b3faf696980c8b38be6e9b3cb30c009aacf6299e15a3c6b7a3f0371937bfb3f
9b5b9b8b1984a7b55656ca3d243deb436e049467353f6e61e73ac8bd0ab2a636
9ef666022c3b2e7ce78c9a82d0629305bf3812f8d787cb957f218159637ee7d4
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833
a2ae3b1227534679fe794fe07595b331b06e3999c3985a8f8d26cecfafe46917
a55043b5129985eac0818f34ce8005760217298d866fc0ed82ea4c6536343f24
a7e3c01bfef79f655cda0aac6f21735860494c82e9eabbdb9dd7d9ad6a977320
a97dd7a8a9ec291a9938f77e47b2f8c2259cd8a9c9a93705174d6a8c500adfab
a9ee2a5de08a58db6391306bbf472458f01bac4222ede902038f4cad3d0100c5
abee762892c40f51a87e6cb1b4412c35324d74881059ff3772fb102aab687ee7
b002154cdbff6d415dd69ebf8377690cb7d19041b7d12e5bb00387f8f76b4a81
b1109f4331a2b98162695b55b54a61fb6b0d010e90ab72ecc4543c89f617fa90
b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8
b397f92e5f197af9b4d9ceac02bdb1e06c304fb8fc8b22ce7689eb0e837a4e78
b834a80037718e3da7f92199034dc59611ed774af41f1e84fa1e0d97c4261192
b8fa20af264fcdd99621fc4e3a770927452b0fe382599e0d890a3bfa31152f80
b97d80b9eedfeb29936f0d7f89afbdd425ef8d930d09fa1f98030ceb8b26cabd
bb2883d2c929454318b1dfd8ba02d6dc928a091981d56531d4b63f02675f7361
bd63e6be549a87f3a6f05f55ade50685d68fe80569fb1098f5845666410372dd
bf0195350deb65b5c27ae5f781df87bd0be699111f87cd3615871920ccd1ad2d
bf479a376378cc786bf5cacdceffee643b734a3fb63127ce8be9662792fe48b1
bf854a7b7ea523eaf0e05e333f6768d66af9f3430b9e2770edc995a169e24167
bfdeb40cc7794459d81706f7083638a12f8659063a5c1d56be78f931646439e1
c48d1de550053233bc4ecba2e6e2d133a098907cb57d365c5e1c51f9d56c8f26
c571657e095288e79a8f049524663392db75d0c788ce381fc3f5807f2e0a3519
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
d23a871d90b722841184b08aefd2b6c3fa0fc467a1c67014c0ba920324149158
d24350e3a8c6e3963544189c3d0cfcd8c11e5dbac0de76aace83993b7d16dcf6
d337aa4ea0cace6bd743ef8c3b5d1d20e6e676bb4a650c7335a7383635529f31
d44b68c7b3e659196a6a72662f4e2e903044d6e64a6a5c0002602711cd68a8fa
d643e5af5996ee2c294007422c559a5934f3cdd7d16cdc40d40f7e06da860cc8
d931ba2089021a1357761939c18bcc09aa856d39be2a707ea450333f5b3443c4
d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e2dc35b0dbaa16b45d96eb3691927df48e091f4983ed2cc079568b789f9559da
e2eedfde61c7fe016ea75d948808661cb0efd7c380ec14e8eb4d6de1bf10d605
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e503c59c36fc19803b2e9572b10e7c06236bda692aebd97f29e2a5a96f9aa5b6
e70696531ebef4e25c157f95ad6730a529ac4df922aa285b3d6e9236007e8820
e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964
e8caad51a19c5667e4fc7ae6a3b9bf8a23559bb64b09b0c6e90cad6d24083ea6
ec4344adc742b2fbf294aeb340c91f1119885d17d96912e7163d2eec59a1ab69
ee657fa9cbe48aeeda44b31ed4ae2ca1d021a82e301e36a456eafb7c8dda7fb7
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efab424137496fe71d56303d65cf773614479519e37bcc3cfb998c7bc4026966
f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5
f1aaed98e9f38642918e63cd6179016ecb8adc6bb4895ef6c4938e9cc92ac6ab
f2ff1ea9bd613614bdca5217eb025f5909f63c608dea2fe642c31b89f1d492ba
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f4d4eda42f85c6ccbbb5de2aff596085b3b1d380c8585464f2e53df2cad66f8e
f54a0604a7f979b4e5bd1f5ae2b5c780ee94a91d43b7dc719ac78cbbf41a2060
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fec6411c0449c2f2b631cdb40900e968c49501f4e92e7b12e75e1e1bc6ed2813