urlscan.io logo urlscan.io
SecurityTrails logo

www.rekings.com Open in urlscan Pro
185.186.52.36  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.rekings.com/njrat/
Submission: On August 28 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 3 countries across 4 domains to perform 61 HTTP transactions. The main IP is 185.186.52.36, located in London, United Kingdom and belongs to GENIUS-SECURITY-LTD, NL. The main domain is www.rekings.com.
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on December 3rd 2017. Valid for: 3 years.
This is the only time www.rekings.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 49 185.186.52.36 206397 (GENIUS-SE...)
2 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 54.216.227.150 16509 (AMAZON-02)
1 176.34.84.103 16509 (AMAZON-02)
5 37.59.26.52 16276 (OVH)
61 7
49    185.186.52.36 (London, United Kingdom)

ASN206397 (GENIUS-SECURITY-LTD, NL)
www.rekings.com
2    2a00:1450:4001:81e::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
4    2a00:1450:4001:821::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
1    54.216.227.150 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-216-227-150.eu-west-1.compute.amazonaws.com
code.jivosite.com
1    176.34.84.103 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-176-34-84-103.eu-west-1.compute.amazonaws.com
code.jivosite.com
5    37.59.26.52 (France)

ASN16276 (OVH, FR)
PTR: ns3061991.ip-37-59-26.eu
cdn-fr.jivosite.com
Domain Requested by
49 www.rekings.com 1 redirects www.rekings.com
5 cdn-fr.jivosite.com code.jivosite.com
4 fonts.gstatic.com www.rekings.com
2 code.jivosite.com www.rekings.com
code.jivosite.com
2 fonts.googleapis.com www.rekings.com
61 5

This site contains links to these domains. Also see Links.

Domain
urlpoints.net
www.virustotal.com
vimeo.com
en.wikipedia.org
www.sandboxie.com
www.jivochat.com
Subject Issuer Validity Valid
rekings.com
COMODO RSA Domain Validation Secure Server CA		 2017-12-03 -
2020-12-02		 3 years crt.sh
*.googleapis.com
Google Internet Authority G3		 2018-08-07 -
2018-10-16		 2 months crt.sh
*.google.com
Google Internet Authority G3		 2018-08-07 -
2018-10-16		 2 months crt.sh
*.jivosite.com
Go Daddy Secure Certificate Authority - G2		 2017-04-10 -
2020-06-04		 3 years crt.sh

This page contains 2 frames:

Primary Page: https://www.rekings.com/njrat/
Frame ID: 7B7F5D0CEFDE0C95A88159EDD8BFD3DA
Requests: 63 HTTP requests in this frame

Frame: data://truncated
Frame ID: 840DDD37E3E93E080A37109EFA57FBB7
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://www.rekings.com/njrat HTTP 301
    https://www.rekings.com/njrat/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • env /woocommerce/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+wp-(?:content|includes)/i
  • script /\/wp-includes\//i
  • env /woocommerce/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+wp-(?:content|includes)/i
  • script /\/wp-includes\//i
  • env /woocommerce/i
Overall confidence: 100%
Detected patterns
  • env /^TweenMax$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • env /^Modernizr$/i
Overall confidence: 100%
Detected patterns
  • env /^twemoji$/i
Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

61
Requests

100 %
HTTPS

33 %
IPv6

4
Domains

5
Subdomains

7
IPs

3
Countries

875 kB
Transfer

2521 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.rekings.com/njrat HTTP 301
    https://www.rekings.com/njrat/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

61 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.rekings.com/njrat/
Redirect Chain
  • https://www.rekings.com/njrat
  • https://www.rekings.com/njrat/
195 KB
60 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX / PHP/7.2.9
Resource Hash
9d4b6be9b5aa8175a0c27e05670785dcb1b9a499c3b29d03512713f618a34dec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.rekings.com
:scheme
https
:path
/njrat/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
7B7F5D0CEFDE0C95A88159EDD8BFD3DA

Response headers

status
200
content-type
text/html; charset=UTF-8
vary
Accept-Encoding Accept-Encoding,User-Agent
x-powered-by
PHP/7.2.9
x-pingback
https://www.rekings.com/xmlrpc.php
link
<https://www.rekings.com/wp-json/>; rel="https://api.w.org/", <https://www.rekings.com/?p=475>; rel=shortlink
server
NGUARDX
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
date
Tue, 28 Aug 2018 14:09:05 GMT
x-page-speed
1.12.34.3-0
cache-control
max-age=0, no-cache
content-encoding
gzip

Redirect headers

status
301
content-type
text/html; charset=UTF-8
location
https://www.rekings.com/njrat/
x-powered-by
PHP/7.2.9
x-pingback
https://www.rekings.com/xmlrpc.php
vary
User-Agent
server
NGUARDX
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
date
Tue, 28 Aug 2018 14:09:04 GMT
x-page-speed
1.12.34.3-0
cache-control
max-age=0, no-cache
aqpb-view.css
www.rekings.com/wp-content/plugins/aqua-page-builder/assets/stylesheets/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/aqua-page-builder/assets/stylesheets/aqpb-view.css
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
fb37b651a49507abc28084e7bcb570efe22b2d5200ce1479d4dacd2328c9469f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/aqua-page-builder/assets/stylesheets/aqpb-view.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
12179
status
200
content-length
1735
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-Z1iE7Rslov"
vary
Accept-Encoding User-Agent,Save-Data
content-type
text/css
expires
Wed, 26 Sep 2018 14:54:43 GMT
cache-control
max-age=2508336, public
accept-ranges
bytes
x-proxy-cache
BYPASS
css
fonts.googleapis.com/ 		11 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Lato:100,300,regular,700,900%7COpen+Sans:300%7CIndie+Flower:regular%7COswald:300,regular,700&subset=latin%2Clatin-ext
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81e::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
6d7fe7c23d430676228f1fc2d54dc00699c3e36d9d264f327e80d84408a41dbc
Security Headers
Name Value
Strict-Transport-Security max-age=3600
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=3600
content-encoding
gzip
last-modified
Tue, 28 Aug 2018 14:09:05 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Tue, 28 Aug 2018 14:09:05 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
x-xss-protection
1; mode=block
expires
Tue, 28 Aug 2018 14:09:05 GMT
pagenavi-css.css
www.rekings.com/wp-content/themes/nevia/ 		0
296 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/themes/nevia/pagenavi-css.css
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/themes/nevia/pagenavi-css.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
x-content-type-options
nosniff
last-modified
Thu, 14 Feb 2013 17:59:36 GMT
server
NGUARDX
x-frame-options
SAMEORIGIN
content-type
text/css
status
200
expires
Thu, 27 Sep 2018 14:09:06 GMT
cache-control
max-age=2592000 public
accept-ranges
bytes
vary
User-Agent
content-length
0
x-xss-protection
1; mode=block
x-proxy-cache
BYPASS
frontend.css
www.rekings.com/wp-content/plugins/download-monitor/assets/css/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/download-monitor/assets/css/frontend.css
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
7b78aa7793348400240ee901df802dccd7f3f508694ffc79f3556f04dfea6670
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/download-monitor/assets/css/frontend.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 27 Aug 2018 14:54:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
5203
status
200
content-length
1219
x-xss-protection
1; mode=block
last-modified
Mon, 06 Aug 2018 16:08:22 GMT
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-s7O_3SpZ1W"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
max-age=2592000, public
accept-ranges
bytes
x-proxy-cache
BYPASS
expires
Wed, 26 Sep 2018 14:54:43 GMT
style.css
www.rekings.com/wp-content/themes/nevia/ 		78 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/themes/nevia/style.css
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
185e0d72fdba4ec241289b779eabd494831f8d9bae49b94fe7dfd6c0ebdba7d2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/themes/nevia/style.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
101418
status
200
content-length
15312
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-_qtXc-4HP3"
vary
Accept-Encoding User-Agent,Save-Data
content-type
text/css
expires
Mon, 03 Sep 2018 10:57:28 GMT
cache-control
max-age=506901, public
accept-ranges
bytes
x-proxy-cache
BYPASS
woocommerce.css
www.rekings.com/wp-content/themes/nevia/css/ 		26 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/themes/nevia/css/woocommerce.css
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
1b3a1db34e8d98d4e74654e21841ff7e057660d4481bbe7aff8d16da765d85d9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/themes/nevia/css/woocommerce.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
33746
status
200
content-length
5715
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-U91IKyOqVG"
vary
Accept-Encoding User-Agent,Save-Data
content-type
text/css
expires
Mon, 03 Sep 2018 10:57:34 GMT
cache-control
max-age=506907, public
accept-ranges
bytes
x-proxy-cache
BYPASS
wp-emoji-release.min.js
www.rekings.com/wp-includes/js/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-includes/js/wp-emoji-release.min.js
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
79d597aef034a0fa19f5c8abe8bbcfaf218c3729bf22adab65e9de60d9c6556a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-includes/js/wp-emoji-release.min.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
12026
status
200
content-length
4314
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-DET_4Zm6gJ"
vary
Accept-Encoding
content-type
application/javascript
expires
Fri, 21 Sep 2018 08:20:49 GMT
cache-control
max-age=2052702, public
accept-ranges
bytes
x-proxy-cache
MISS
jquery.js
www.rekings.com/wp-includes/js/jquery/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-includes/js/jquery/jquery.js
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
cdfe845b25091a21147fe4a683515b000208ae4f67810f243d7bf96bc3484115
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-includes/js/jquery/jquery.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
97184
status
200
content-length
33695
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-pPCPAKkkss"
vary
Accept-Encoding
content-type
application/javascript
expires
Fri, 21 Sep 2018 11:46:33 GMT
cache-control
max-age=2065046, public
accept-ranges
bytes
x-proxy-cache
MISS
greensock.js
www.rekings.com/wp-content/plugins/LayerSlider/static/layerslider/js/ 		114 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/LayerSlider/static/layerslider/js/greensock.js
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
39168f75e12852929b883c3e65ae2cff76347d0e21f1f00c2addee8bd485c7e2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/LayerSlider/static/layerslider/js/greensock.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
117557
status
200
content-length
38953
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-611DIvfYGK"
vary
Accept-Encoding
content-type
application/javascript
expires
Fri, 21 Sep 2018 11:46:33 GMT
cache-control
max-age=2065046, public
accept-ranges
bytes
x-proxy-cache
MISS
layerslider.kreaturamedia.jquery.js
www.rekings.com/wp-content/plugins/LayerSlider/static/layerslider/js/ 		114 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/LayerSlider/static/layerslider/js/layerslider.kreaturamedia.jquery.js
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
5bcacc51356dcb482c298a58cd31d0462b8b4f746b04f0714d4f47141b9c555a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/LayerSlider/static/layerslider/js/layerslider.kreaturamedia.jquery.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
116611
status
200
content-length
43764
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-Q0bQC2Nms2"
vary
Accept-Encoding
content-type
application/javascript
expires
Fri, 21 Sep 2018 11:46:33 GMT
cache-control
max-age=2065046, public
accept-ranges
bytes
x-proxy-cache
MISS
layerslider.transitions.js
www.rekings.com/wp-content/plugins/LayerSlider/static/layerslider/js/ 		23 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/LayerSlider/static/layerslider/js/layerslider.transitions.js
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
529bda78540c766f0f30396a6239e335895ea61ec757f5d4ac217a4d90d8a7ab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/LayerSlider/static/layerslider/js/layerslider.transitions.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
23831
status
200
content-length
3156
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-Q3opZIj8qS"
vary
Accept-Encoding
content-type
application/javascript
expires
Fri, 21 Sep 2018 11:46:33 GMT
cache-control
max-age=2065046, public
accept-ranges
bytes
x-proxy-cache
MISS
wpdcookiejs,_customcookie.js+autogrow,_jquery.autogrowtextarea.min.js.pagespeed.jc.dbPryiZ8uK.js
www.rekings.com/wp-content/plugins/wpdiscuz/assets/third-party/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/wpdiscuz/assets/third-party/wpdcookiejs,_customcookie.js+autogrow,_jquery.autogrowtextarea.min.js.pagespeed.jc.dbPryiZ8uK.js
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
f6fd58a2249524e368bd3d7b62d917e2c7188959751d4293c07ff4c5015f6d3e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/wpdiscuz/assets/third-party/wpdcookiejs,_customcookie.js+autogrow,_jquery.autogrowtextarea.min.js.pagespeed.jc.dbPryiZ8uK.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 21 Aug 2018 23:53:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
4483
status
200
content-length
1486
x-xss-protection
1; mode=block
x-page-speed
1.12.34.3-0
last-modified
Tue, 21 Aug 2018 23:53:03 GMT
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"0"
vary
Accept-Encoding
content-type
application/javascript
expires
Wed, 21 Aug 2019 23:53:03 GMT
cache-control
max-age=31536000, public
accept-ranges
bytes
x-proxy-cache
HIT
wpdiscuz.js
www.rekings.com/wp-content/plugins/wpdiscuz/assets/js/ 		39 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/wpdiscuz/assets/js/wpdiscuz.js
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
0ea08c3d9ce73c7fb8d602fc898d87aa937aaf4aa6912f4601716f11acddb5a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/wpdiscuz/assets/js/wpdiscuz.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
64734
status
200
content-length
8023
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-wuPoohItV1"
vary
Accept-Encoding
content-type
application/javascript
expires
Thu, 06 Sep 2018 08:59:11 GMT
cache-control
max-age=759004, public
accept-ranges
bytes
x-proxy-cache
HIT
logo.png
www.rekings.com/wp-content/uploads/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rekings.com/wp-content/uploads/logo.png
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
1f7ef6d676d72341c5a67f48ed51eed08fd989f8cddc7f05a75d7947746d3067
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/uploads/logo.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
x-content-type-options
nosniff
x-original-content-length
14838
server
NGUARDX
etag
W/"PSA-aj-NJOPLYQWzo"
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
cache-control
max-age=2063972, public
x-proxy-cache
HIT
accept-ranges
bytes
vary
User-Agent
content-length
12045
x-xss-protection
1; mode=block
expires
Fri, 21 Sep 2018 11:28:39 GMT
njRAT-0.8.0-LIME-EDITION-640x462.png
www.rekings.com/wp-content/uploads/2018/05/ 		29 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rekings.com/wp-content/uploads/2018/05/njRAT-0.8.0-LIME-EDITION-640x462.png
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
7fbcdaf59a07c42b9557b3f852ff4e33f7aabba6e18e3f60b089fa1ed14927f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/uploads/2018/05/njRAT-0.8.0-LIME-EDITION-640x462.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
x-content-type-options
nosniff
x-original-content-length
238225
server
NGUARDX
etag
W/"PSA-aj-mbB_UFLGzX"
x-frame-options
SAMEORIGIN
content-type
image/webp
status
200
cache-control
max-age=582675, public
x-proxy-cache
MISS
accept-ranges
bytes
vary
User-Agent,Save-Data
content-length
29876
x-xss-protection
1; mode=block
expires
Tue, 04 Sep 2018 08:00:23 GMT
donate-1.png
www.rekings.com/wp-content/uploads/2018/08/ 		811 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rekings.com/wp-content/uploads/2018/08/donate-1.png
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
cb9a9ca1569053c14c268da8907f00c0cd26117ae746cede836cff299a0a0b8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/uploads/2018/08/donate-1.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
x-content-type-options
nosniff
x-original-content-length
812
server
NGUARDX
etag
W/"PSA-aj-khmlVPLhb1"
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
cache-control
max-age=695560, public
x-proxy-cache
MISS
accept-ranges
bytes
vary
User-Agent
content-length
811
x-xss-protection
1; mode=block
expires
Wed, 05 Sep 2018 15:21:48 GMT
logo-footer.png
www.rekings.com/wp-content/uploads/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rekings.com/wp-content/uploads/logo-footer.png
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
cff154f0d7dc23949bc6b2c081c1f24cffbb98ac04f8e41e67d81fcf02c392b4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/uploads/logo-footer.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 22 Aug 2018 09:54:10 GMT
x-content-type-options
nosniff
last-modified
Thu, 19 May 2016 12:25:18 GMT
server
NGUARDX
etag
W/"PSA-3WqsSfb5Qy"
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
expires
Fri, 21 Sep 2018 09:54:10 GMT
cache-control
max-age=2592000, public
accept-ranges
bytes
vary
User-Agent
content-length
2511
x-xss-protection
1; mode=block
x-proxy-cache
MISS
bitcoin.png
www.rekings.com/wp-content/uploads/icon/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rekings.com/wp-content/uploads/icon/bitcoin.png
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
cd5e1399e437b01c47c4a4c29b1568abafdf06db5d2bc145704a42dae756d37e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/uploads/icon/bitcoin.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
x-content-type-options
nosniff
x-original-content-length
1168
server
NGUARDX
etag
W/"PSA-aj-NkEz2GsKlM"
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
cache-control
max-age=1502203, public
x-proxy-cache
MISS
accept-ranges
bytes
vary
User-Agent
content-length
1133
x-xss-protection
1; mode=block
expires
Fri, 14 Sep 2018 23:25:51 GMT
litecoin.png
www.rekings.com/wp-content/uploads/icon/ 		488 B
791 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rekings.com/wp-content/uploads/icon/litecoin.png
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
401eafaf8ea103ec8fa4c66f9b594951fa04bc29eda5024bb39f7d01ce1be695
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/uploads/icon/litecoin.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
x-content-type-options
nosniff
x-original-content-length
519
server
NGUARDX
etag
W/"PSA-aj-R5zb57p2LH"
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
cache-control
max-age=2058302, public
x-proxy-cache
MISS
accept-ranges
bytes
vary
User-Agent
content-length
488
x-xss-protection
1; mode=block
expires
Fri, 21 Sep 2018 09:54:10 GMT
ethereum.png
www.rekings.com/wp-content/uploads/icon/ 		661 B
963 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rekings.com/wp-content/uploads/icon/ethereum.png
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
5dc9d8251c819a31f03fd4f8525ca64fc10f834227a702315d720f652c5e4ef6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/uploads/icon/ethereum.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
x-content-type-options
nosniff
x-original-content-length
720
server
NGUARDX
etag
W/"PSA-aj-VidUsq8L5P"
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
cache-control
max-age=2058302, public
x-proxy-cache
MISS
accept-ranges
bytes
vary
User-Agent
content-length
661
x-xss-protection
1; mode=block
expires
Fri, 21 Sep 2018 09:54:10 GMT
escrow.png
www.rekings.com/wp-content/uploads/icon/ 		651 B
954 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rekings.com/wp-content/uploads/icon/escrow.png
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
7656af89ef181eb283465c838125e58b7126781854ba70472710d1b275cf20a8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/uploads/icon/escrow.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
x-content-type-options
nosniff
x-original-content-length
658
server
NGUARDX
etag
W/"PSA-aj-xNYC5i54Zv"
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
cache-control
max-age=2054769, public
x-proxy-cache
MISS
accept-ranges
bytes
vary
User-Agent
content-length
651
x-xss-protection
1; mode=block
expires
Fri, 21 Sep 2018 08:55:17 GMT
perfectmoney.png
www.rekings.com/wp-content/uploads/icon/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rekings.com/wp-content/uploads/icon/perfectmoney.png
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
eeadedd2bb8a1c6695cdfd592021afcfb1eb520a5f19549beb59014a86565c85
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/uploads/icon/perfectmoney.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
x-content-type-options
nosniff
x-original-content-length
1181
server
NGUARDX
etag
W/"PSA-aj-kK2Dsc5WrC"
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
cache-control
max-age=2054769, public
x-proxy-cache
MISS
accept-ranges
bytes
vary
User-Agent
content-length
1152
x-xss-protection
1; mode=block
expires
Fri, 21 Sep 2018 08:55:17 GMT
payeer.png
www.rekings.com/wp-content/uploads/icon/ 		626 B
930 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rekings.com/wp-content/uploads/icon/payeer.png
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
59ed3629f0231b42f350a86dc312919a967bdab5a4ad673912fcec7003432a2f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/uploads/icon/payeer.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
x-content-type-options
nosniff
x-original-content-length
647
server
NGUARDX
etag
W/"PSA-aj-vGJBv1SGMH"
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
cache-control
max-age=2058302, public
x-proxy-cache
MISS
accept-ranges
bytes
vary
User-Agent
content-length
626
x-xss-protection
1; mode=block
expires
Fri, 21 Sep 2018 09:54:10 GMT
aqua-page-builder,_assets,_javascripts,_aqpb-view.js+woocommerce,_assets,_js,_jquery-blockui,_jquery.blockUI.min.js+woocommerce,_assets,_js,_js-cookie,_js.cookie.min.js.pagespeed.jc.GWoTHKsLgV.js
www.rekings.com/wp-content/plugins/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/aqua-page-builder,_assets,_javascripts,_aqpb-view.js+woocommerce,_assets,_js,_jquery-blockui,_jquery.blockUI.min.js+woocommerce,_assets,_js,_js-cookie,_js.cookie.min.js.pagespeed.jc.GWoTHKsLgV.js
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
5f648fea00f2e61023d676ed351d57e6b25740f4c5cd1456c484448602201f34
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/aqua-page-builder,_assets,_javascripts,_aqpb-view.js+woocommerce,_assets,_js,_jquery-blockui,_jquery.blockUI.min.js+woocommerce,_assets,_js,_js-cookie,_js.cookie.min.js.pagespeed.jc.GWoTHKsLgV.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 22 Aug 2018 09:55:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
12494
status
200
content-length
4421
x-xss-protection
1; mode=block
x-page-speed
1.12.34.3-0
last-modified
Wed, 22 Aug 2018 09:55:17 GMT
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"0"
vary
Accept-Encoding
content-type
application/javascript
expires
Thu, 22 Aug 2019 09:55:17 GMT
cache-control
max-age=31536000, public
accept-ranges
bytes
x-proxy-cache
MISS
jquery.form.min.js
www.rekings.com/wp-includes/js/jquery/ 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-includes/js/jquery/jquery.form.min.js
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
3ffe72ec886b260bd3fbfb3047fe92e3a78d874d18d46269490dc63536a9188e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-includes/js/jquery/jquery.form.min.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
16598
status
200
content-length
6089
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-wqN99Ot7DM"
vary
Accept-Encoding
content-type
application/javascript
expires
Thu, 06 Sep 2018 08:41:45 GMT
cache-control
max-age=757958, public
accept-ranges
bytes
x-proxy-cache
MISS
plugins,_woocommerce,_assets,_js,_flexslider,_jquery.flexslider.min.js+themes,_nevia,_js,_jquery.twitter.js+themes,_nevia,_js,_jquery.nevia.plugins.js.pagespeed.jc.zuJl0tqjPn.js
www.rekings.com/wp-content/ 		33 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins,_woocommerce,_assets,_js,_flexslider,_jquery.flexslider.min.js+themes,_nevia,_js,_jquery.twitter.js+themes,_nevia,_js,_jquery.nevia.plugins.js.pagespeed.jc.zuJl0tqjPn.js
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
421e91e3eca4aef605d48e9dc6b04242f5d1645b7ce5458e4c6ebc5ae9fa9eef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins,_woocommerce,_assets,_js,_flexslider,_jquery.flexslider.min.js+themes,_nevia,_js,_jquery.twitter.js+themes,_nevia,_js,_jquery.nevia.plugins.js.pagespeed.jc.zuJl0tqjPn.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sat, 25 Aug 2018 02:42:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
39734
status
200
content-length
9491
x-xss-protection
1; mode=block
x-page-speed
1.12.34.3-0
last-modified
Sat, 25 Aug 2018 02:42:34 GMT
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"0"
vary
Accept-Encoding
content-type
application/javascript
expires
Sun, 25 Aug 2019 02:42:34 GMT
cache-control
max-age=31536000, public
accept-ranges
bytes
x-proxy-cache
MISS
jquery.isotope.min.js+jquery.isotope.nevia.js+jquery.jcarousel.js.pagespeed.jc.fGEts_dXMk.js
www.rekings.com/wp-content/themes/nevia/js/ 		32 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/themes/nevia/js/jquery.isotope.min.js+jquery.isotope.nevia.js+jquery.jcarousel.js.pagespeed.jc.fGEts_dXMk.js
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
c8bb383be22629a655e70cc1330ebc067ce527088ac8e1c391e638bb75172169
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/themes/nevia/js/jquery.isotope.min.js+jquery.isotope.nevia.js+jquery.jcarousel.js.pagespeed.jc.fGEts_dXMk.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sat, 25 Aug 2018 02:42:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
32915
status
200
content-length
9135
x-xss-protection
1; mode=block
x-page-speed
1.12.34.3-0
last-modified
Sat, 25 Aug 2018 02:42:34 GMT
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"0"
vary
Accept-Encoding
content-type
application/javascript
expires
Sun, 25 Aug 2019 02:42:34 GMT
cache-control
max-age=31536000, public
accept-ranges
bytes
x-proxy-cache
MISS
jquery.fancybox.min.js
www.rekings.com/wp-content/themes/nevia/js/ 		26 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/themes/nevia/js/jquery.fancybox.min.js
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
deaa65e1185931a65cca1ee1a4b9919b014b74cd146bd7d242fd1648f7780b50
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/themes/nevia/js/jquery.fancybox.min.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
32326
status
200
content-length
9820
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-uB2YgiTyGA"
vary
Accept-Encoding
content-type
application/javascript
expires
Fri, 21 Sep 2018 09:54:11 GMT
cache-control
max-age=2058304, public
accept-ranges
bytes
x-proxy-cache
MISS
wp-content,_themes,_nevia,_js,_custom.js+wp-includes,_js,_comment-reply.min.js+wp-includes,_js,_wp-embed.min.js.pagespeed.jc.29S8-wfVKL.js
www.rekings.com/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content,_themes,_nevia,_js,_custom.js+wp-includes,_js,_comment-reply.min.js+wp-includes,_js,_wp-embed.min.js.pagespeed.jc.29S8-wfVKL.js
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
a15d561e431135230c01a52200a7f61b884179e98a8997de64fee19348c230e3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content,_themes,_nevia,_js,_custom.js+wp-includes,_js,_comment-reply.min.js+wp-includes,_js,_wp-embed.min.js.pagespeed.jc.29S8-wfVKL.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 22 Aug 2018 14:08:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
14575
status
200
content-length
3526
x-xss-protection
1; mode=block
x-page-speed
1.12.34.3-0
last-modified
Wed, 22 Aug 2018 14:08:53 GMT
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"0"
vary
Accept-Encoding
content-type
application/javascript
expires
Thu, 22 Aug 2019 14:08:53 GMT
cache-control
max-age=31536000, public
accept-ranges
bytes
x-proxy-cache
MISS
base.css
www.rekings.com/wp-content/themes/nevia/css/ 		4 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/themes/nevia/css/base.css
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
7163808e74b5f9998a0b1eb87c8ab3916f5dc576b0a5ae8126b091253c067449
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/themes/nevia/css/base.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
6114
status
200
content-length
1620
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-Hd8EE3HYL1"
vary
Accept-Encoding User-Agent,Save-Data
content-type
text/css
expires
Tue, 18 Sep 2018 19:28:08 GMT
cache-control
max-age=1833541, public
accept-ranges
bytes
x-proxy-cache
MISS
responsive.css
www.rekings.com/wp-content/themes/nevia/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/themes/nevia/css/responsive.css
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
be2928ed6980ab35ebce0f3e9edbad1bd8a51af21c8b7c5fea73fd7ad42b3f56
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/themes/nevia/css/responsive.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
6375
status
200
content-length
888
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-u_L_WNW4F0"
vary
Accept-Encoding User-Agent,Save-Data
content-type
text/css
expires
Tue, 18 Sep 2018 19:28:08 GMT
cache-control
max-age=1833541, public
accept-ranges
bytes
x-proxy-cache
MISS
icons.css
www.rekings.com/wp-content/themes/nevia/css/ 		18 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/themes/nevia/css/icons.css
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
aa25917905dd4e96e4ef5d707f3c194dd0d8d6b79790fe460ad39cb5d55fdbec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/themes/nevia/css/icons.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
25958
status
200
content-length
3277
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-EUElyYV45x"
vary
Accept-Encoding User-Agent,Save-Data
content-type
text/css
expires
Sat, 22 Sep 2018 01:13:01 GMT
cache-control
max-age=2113434, public
accept-ranges
bytes
x-proxy-cache
BYPASS
css
fonts.googleapis.com/ 		9 KB
840 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81e::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
c5e4ca72bae51e4f9d92854fc100003908a8774fa9723baa6fdb71252f18551e
Security Headers
Name Value
Strict-Transport-Security max-age=3600
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=3600
content-encoding
gzip
last-modified
Tue, 28 Aug 2018 14:09:05 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Tue, 28 Aug 2018 14:09:05 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
x-xss-protection
1; mode=block
expires
Tue, 28 Aug 2018 14:09:05 GMT
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v15/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v15/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8868d2a2f803ea6802d54a11564b5b96c7d8be56117a328c8f605539d6dee167
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700
Origin
https://www.rekings.com

Response headers

date
Fri, 17 Aug 2018 16:12:49 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 21:49:46 GMT
server
sffe
age
942977
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
8892
x-xss-protection
1; mode=block
expires
Sat, 17 Aug 2019 16:12:49 GMT
glyphicons_halflings.svg
www.rekings.com/wp-content/themes/nevia/images/ 		67 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rekings.com/wp-content/themes/nevia/images/glyphicons_halflings.svg
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
562afad850b3a16739146f53adc5455a312ab3733f4aeab4f3a9526e13435050
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/themes/nevia/images/glyphicons_halflings.svg
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/wp-content/themes/nevia/css/icons.css
:scheme
https
:method
GET
Referer
https://www.rekings.com/wp-content/themes/nevia/css/icons.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 23 Dec 2012 11:15:36 GMT
server
NGUARDX
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
expires
Thu, 27 Sep 2018 14:09:07 GMT
cache-control
max-age=2592000 public
accept-ranges
bytes
vary
Accept-Encoding,User-Agent
content-length
20614
x-xss-protection
1; mode=block
x-proxy-cache
BYPASS
breadcrumbs.png
www.rekings.com/wp-content/themes/nevia/images/ 		104 B
407 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rekings.com/wp-content/themes/nevia/images/breadcrumbs.png
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
fbc8da798cfc766041669f73e588b27e93dbdbfbb540785bcd59e819c5087b97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/themes/nevia/images/breadcrumbs.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/wp-content/themes/nevia/style.css
:scheme
https
:method
GET
Referer
https://www.rekings.com/wp-content/themes/nevia/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
x-content-type-options
nosniff
x-original-content-length
2802
server
NGUARDX
etag
W/"PSA-aj-PqeZM5gojz"
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
cache-control
max-age=1209918, public
x-proxy-cache
MISS
accept-ranges
bytes
vary
User-Agent
content-length
104
x-xss-protection
1; mode=block
expires
Tue, 11 Sep 2018 14:14:26 GMT
glyphicons_halflings-white.svg
www.rekings.com/wp-content/themes/nevia/images/ 		67 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rekings.com/wp-content/themes/nevia/images/glyphicons_halflings-white.svg
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
713e2e46cf6cadf7aa53f998a93e067d08b149f153d3a32cd45905ad37ee1e43
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/themes/nevia/images/glyphicons_halflings-white.svg
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/wp-content/themes/nevia/css/icons.css
:scheme
https
:method
GET
Referer
https://www.rekings.com/wp-content/themes/nevia/css/icons.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 04 Oct 2012 09:03:52 GMT
server
NGUARDX
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
expires
Thu, 27 Sep 2018 14:09:07 GMT
cache-control
max-age=2592000 public
accept-ranges
bytes
vary
Accept-Encoding,User-Agent
content-length
20596
x-xss-protection
1; mode=block
x-proxy-cache
BYPASS
search.png
www.rekings.com/wp-content/themes/nevia/images/ 		245 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.rekings.com/wp-content/themes/nevia/images/search.png
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
6ab737a8e8031b762a23e481df15fbe1f9c5b4541a2a3a97faf17c698f2001b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/themes/nevia/images/search.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/wp-content/themes/nevia/style.css
:scheme
https
:method
GET
Referer
https://www.rekings.com/wp-content/themes/nevia/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 22 Aug 2018 08:24:53 GMT
x-content-type-options
nosniff
last-modified
Sun, 22 Jul 2018 11:57:09 GMT
server
NGUARDX
etag
W/"PSA-1UVvVzRLhb"
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
expires
Fri, 21 Sep 2018 08:24:53 GMT
cache-control
max-age=2592000, public
accept-ranges
bytes
vary
User-Agent
content-length
245
x-xss-protection
1; mode=block
x-proxy-cache
MISS
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v15/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
50dda9aac0fcea362bdda27ae7833240485ad5a20ccc105c1cd13ea26802a8bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700
Origin
https://www.rekings.com

Response headers

date
Fri, 17 Aug 2018 17:54:15 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 21:49:48 GMT
server
sffe
age
936891
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
8916
x-xss-protection
1; mode=block
expires
Sat, 17 Aug 2019 17:54:15 GMT
fontawesome-webfont.woff
www.rekings.com/wp-content/plugins/forget-about-shortcode-buttons/public/fonts/ 		43 KB
44 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/forget-about-shortcode-buttons/public/fonts/fontawesome-webfont.woff?v=4.0.3
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/forget-about-shortcode-buttons/public/fonts/fontawesome-webfont.woff?v=4.0.3
pragma
no-cache
origin
https://www.rekings.com
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.rekings.com/njrat/
Origin
https://www.rekings.com

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
x-content-type-options
nosniff
last-modified
Wed, 04 Oct 2017 13:48:25 GMT
server
NGUARDX
x-frame-options
SAMEORIGIN
content-type
application/font-woff
status
200
expires
Thu, 27 Sep 2018 14:09:06 GMT
cache-control
max-age=2592000, public, s-maxage=10
accept-ranges
bytes
vary
User-Agent
content-length
44432
x-xss-protection
1; mode=block
x-proxy-cache
BYPASS
fa-solid-900.woff2
www.rekings.com/wp-content/plugins/wpdiscuz/assets/third-party/font-awesome-5.0.6/webfonts/ 		44 KB
44 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/wpdiscuz/assets/third-party/font-awesome-5.0.6/webfonts/fa-solid-900.woff2
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
7d349f9e08a50336b6f398554e817e6921dd390ef9d8cacf3074a24d4379bd10
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/wpdiscuz/assets/third-party/font-awesome-5.0.6/webfonts/fa-solid-900.woff2
pragma
no-cache
origin
https://www.rekings.com
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.rekings.com/njrat/
Origin
https://www.rekings.com

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
x-content-type-options
nosniff
last-modified
Tue, 07 Aug 2018 07:46:03 GMT
server
NGUARDX
x-frame-options
SAMEORIGIN
status
200
expires
Thu, 27 Sep 2018 14:09:06 GMT
cache-control
max-age=2592000, public, s-maxage=10
accept-ranges
bytes
vary
User-Agent
content-length
45132
x-xss-protection
1; mode=block
x-proxy-cache
BYPASS
mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v15/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
35a21333c81302e934ee42b7b85b2c6a731bfffb418fe52fe795cb1974186976
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Lato:100,300,regular,700,900%7COpen+Sans:300%7CIndie+Flower:regular%7COswald:300,regular,700&subset=latin%2Clatin-ext
Origin
https://www.rekings.com

Response headers

date
Fri, 17 Aug 2018 14:19:15 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 21:49:38 GMT
server
sffe
age
949791
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
8732
x-xss-protection
1; mode=block
expires
Sat, 17 Aug 2019 14:19:15 GMT
fa-regular-400.woff2
www.rekings.com/wp-content/plugins/wpdiscuz/assets/third-party/font-awesome-5.0.6/webfonts/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/wpdiscuz/assets/third-party/font-awesome-5.0.6/webfonts/fa-regular-400.woff2
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
32532bb1068f7fc433a323cc732f995b9e91116c91dffa31696623510df8254e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/wpdiscuz/assets/third-party/font-awesome-5.0.6/webfonts/fa-regular-400.woff2
pragma
no-cache
origin
https://www.rekings.com
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.rekings.com/njrat/
Origin
https://www.rekings.com

Response headers

date
Tue, 28 Aug 2018 14:09:06 GMT
x-content-type-options
nosniff
last-modified
Tue, 07 Aug 2018 07:46:03 GMT
server
NGUARDX
x-frame-options
SAMEORIGIN
status
200
expires
Thu, 27 Sep 2018 14:09:06 GMT
cache-control
max-age=2592000, public, s-maxage=10
accept-ranges
bytes
vary
User-Agent
content-length
12188
x-xss-protection
1; mode=block
x-proxy-cache
BYPASS
truncated
/ 		26 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
20fabfa803d080cde34001dc0371473d089cb619e20ea2e1d99c16832af9ed1f

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin
https://www.rekings.com

Response headers

Access-Control-Allow-Origin
*
Content-Type
application/font-woff;charset=utf-8
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v15/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
fe32c9921874b35b87acb0a3b558784ca7b9fed91ed34c1d2a68b6566c9d09be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700
Origin
https://www.rekings.com

Response headers

date
Fri, 17 Aug 2018 14:51:26 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 21:49:39 GMT
server
sffe
age
947860
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
8800
x-xss-protection
1; mode=block
expires
Sat, 17 Aug 2019 14:51:26 GMT
/
www.rekings.com/ 		275 B
574 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/?wc-ajax=get_refreshed_fragments
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/wp-includes/js/jquery/jquery.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX / PHP/7.2.9
Resource Hash
456df06aebf1f7d2f706d41db178bc3a43185d9ce905a612129dcc58985d3386
Security Headers
Name Value
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/?wc-ajax=get_refreshed_fragments
pragma
no-cache
origin
https://www.rekings.com
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
x-requested-with
XMLHttpRequest
:scheme
https
referer
https://www.rekings.com/njrat/
content-length
0
:method
POST
Accept
*/*
Referer
https://www.rekings.com/njrat/
Origin
https://www.rekings.com
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
content-encoding
gzip
x-content-type-options
nosniff nosniff
server
NGUARDX
status
200
x-powered-by
PHP/7.2.9
x-frame-options
SAMEORIGIN
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.rekings.com
cache-control
no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
x-robots-tag
noindex
vary
Accept-Encoding User-Agent
x-xss-protection
1; mode=block
expires
Wed, 11 Jan 1984 05:00:00 GMT
layerslider.css
www.rekings.com/wp-content/plugins/LayerSlider/static/layerslider/css/ 		16 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/LayerSlider/static/layerslider/css/layerslider.css
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
83dcc0e9c0f407cc67e4a4f26831362f89d6d5c26861aa98dd7c23f30c90fc59
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/LayerSlider/static/layerslider/css/layerslider.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
21153
status
200
content-length
3082
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-0VSzOvQdCM"
vary
Accept-Encoding User-Agent,Save-Data
content-type
text/css
expires
Sat, 08 Sep 2018 21:12:43 GMT
cache-control
max-age=975815, public
accept-ranges
bytes
x-proxy-cache
BYPASS
usp.css
www.rekings.com/wp-content/plugins/user-submitted-posts/resources/ 		2 KB
930 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/user-submitted-posts/resources/usp.css
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
36f93326c5d032bfbf162f2ee997b3bac642bc5e36f72f9668229ea0d14b7bc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/user-submitted-posts/resources/usp.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
2644
status
200
content-length
575
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-nttFZLuIb-"
vary
Accept-Encoding User-Agent,Save-Data
content-type
text/css
expires
Fri, 21 Sep 2018 11:46:33 GMT
cache-control
max-age=2065045, public
accept-ranges
bytes
x-proxy-cache
MISS
fontawesome-all.min.css
www.rekings.com/wp-content/plugins/wpdiscuz/assets/third-party/font-awesome-5.0.6/css/ 		38 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/wpdiscuz/assets/third-party/font-awesome-5.0.6/css/fontawesome-all.min.css
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
61e4b0a5d4e1841fb7bb1cd5c903438ca6d88311186455e7c98e5e013d910dd9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/wpdiscuz/assets/third-party/font-awesome-5.0.6/css/fontawesome-all.min.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
39067
status
200
content-length
8352
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj--FfJuCqQn3"
vary
Accept-Encoding User-Agent,Save-Data
content-type
text/css
expires
Thu, 06 Sep 2018 08:59:10 GMT
cache-control
max-age=759002, public
accept-ranges
bytes
x-proxy-cache
HIT
wpdiscuz.css
www.rekings.com/wp-content/plugins/wpdiscuz/assets/css/ 		59 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/wpdiscuz/assets/css/wpdiscuz.css
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
0f8bf64e309d039bce73ee9c231766212875a2da7bc9cd0864c55942f5da2681
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/wpdiscuz/assets/css/wpdiscuz.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
66143
status
200
content-length
10896
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-qyNFS8Sbyz"
vary
Accept-Encoding User-Agent,Save-Data
content-type
text/css
expires
Thu, 06 Sep 2018 08:59:10 GMT
cache-control
max-age=759002, public
accept-ranges
bytes
x-proxy-cache
HIT
mediaqueries.css
www.rekings.com/wp-content/themes/nevia/css/ 		11 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/themes/nevia/css/mediaqueries.css
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
45498f05349bc655e75a5d9ba184fcc90716154295a1095ddac62b6f61131d4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/themes/nevia/css/mediaqueries.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
18644
status
200
content-length
2192
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-q_s6MDsp_u"
vary
Accept-Encoding User-Agent,Save-Data
content-type
text/css
expires
Fri, 21 Sep 2018 11:46:33 GMT
cache-control
max-age=2065045, public
accept-ranges
bytes
x-proxy-cache
MISS
generic-no-float.css
www.rekings.com/wp-content/plugins/wp-members/css/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/wp-members/css/generic-no-float.css
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
de05a17c5a7a719887be35592078dd6f982e7537453898be700beaf069a33907
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/wp-members/css/generic-no-float.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
5847
status
200
content-length
984
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-a8ppxEqR7v"
vary
Accept-Encoding User-Agent,Save-Data
content-type
text/css
expires
Thu, 06 Sep 2018 15:45:46 GMT
cache-control
max-age=783398, public
accept-ranges
bytes
x-proxy-cache
HIT
button-styles.css
www.rekings.com/wp-content/plugins/forget-about-shortcode-buttons/public/css/ 		139 KB
41 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/plugins/forget-about-shortcode-buttons/public/css/button-styles.css
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
f677e91207149f446bf620613070fe689db0613879ae3bb56a0e606de8cd07bf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/forget-about-shortcode-buttons/public/css/button-styles.css
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/njrat/
:scheme
https
:method
GET
Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 28 Aug 2018 14:09:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-original-content-length
8851
status
200
content-length
41891
x-xss-protection
1; mode=block
server
NGUARDX
x-frame-options
SAMEORIGIN
etag
W/"PSA-aj-umPtFZAPeD"
vary
Accept-Encoding User-Agent,Save-Data
content-type
text/css
expires
Sat, 08 Sep 2018 21:12:43 GMT
cache-control
max-age=975815, public
accept-ranges
bytes
x-proxy-cache
HIT
fontawesome-webfont.woff
www.rekings.com/wp-content/themes/nevia/fonts/ 		41 KB
41 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.rekings.com/wp-content/themes/nevia/fonts/fontawesome-webfont.woff
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
185.186.52.36 London, United Kingdom, ASN206397 (GENIUS-SECURITY-LTD, NL),
Reverse DNS
Software
NGUARDX /
Resource Hash
d45f5fb1fb4e1a101a8ad8722af443272f6c3d409d912e8175e6268d48e0b091
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/themes/nevia/fonts/fontawesome-webfont.woff
pragma
no-cache
origin
https://www.rekings.com
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.rekings.com
referer
https://www.rekings.com/wp-content/themes/nevia/css/icons.css
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.rekings.com/wp-content/themes/nevia/css/icons.css
Origin
https://www.rekings.com

Response headers

date
Tue, 28 Aug 2018 14:09:08 GMT
x-content-type-options
nosniff
last-modified
Sat, 16 Jun 2012 01:37:02 GMT
server
NGUARDX
x-frame-options
SAMEORIGIN
content-type
application/font-woff
status
200
expires
Thu, 27 Sep 2018 14:09:08 GMT
cache-control
max-age=2592000, public, s-maxage=10
accept-ranges
bytes
vary
User-Agent
content-length
41752
x-xss-protection
1; mode=block
x-proxy-cache
BYPASS
v7q7nQZC3U
code.jivosite.com/script/widget/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jivosite.com/script/widget/v7q7nQZC3U
Requested by
Host: www.rekings.com
URL: https://www.rekings.com/njrat/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.216.227.150 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-216-227-150.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
f982148422da7c61a3b345e3b4e9c85e4ed0c1d60272cd458e69f9095bfa1300

Request headers

Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 28 Aug 2018 14:09:07 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Aug 2018 11:42:05 GMT
Server
nginx
ETag
"5b76b48d-1451"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=7200
Connection
keep-alive
Content-Length
5201
Expires
Tue, 28 Aug 2018 16:09:07 GMT
v7q7nQZC3U
code.jivosite.com/script/widget/config/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://code.jivosite.com/script/widget/config/v7q7nQZC3U?rnd=0.6912889565251152
Requested by
Host: code.jivosite.com
URL: https://code.jivosite.com/script/widget/v7q7nQZC3U
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
176.34.84.103 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-176-34-84-103.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
c703b44828933cb1cffd0ac4731c088361d9dc7e9b5ebfe7d859475d1755f1be

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.rekings.com/njrat/
Origin
https://www.rekings.com

Response headers

Date
Tue, 28 Aug 2018 14:09:07 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Tue, 28 Aug 2018 14:09:06 GMT
ping
cdn-fr.jivosite.com/ 		0
200 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn-fr.jivosite.com/ping?rand=1535465347994
Requested by
Host: code.jivosite.com
URL: https://code.jivosite.com/script/widget/v7q7nQZC3U
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.59.26.52 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3061991.ip-37-59-26.eu
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.rekings.com/njrat/
Origin
https://www.rekings.com

Response headers

Access-Control-Allow-Origin
*
Date
Tue, 28 Aug 2018 14:09:08 GMT
Cache-Control
no-cache
Server
nginx
Connection
keep-alive
Expires
Tue, 28 Aug 2018 14:09:07 GMT
bundle_en_US.js
cdn-fr.jivosite.com/js/ 		953 KB
243 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-fr.jivosite.com/js/bundle_en_US.js?rand=1534506060
Requested by
Host: code.jivosite.com
URL: https://code.jivosite.com/script/widget/v7q7nQZC3U
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.59.26.52 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3061991.ip-37-59-26.eu
Software
nginx /
Resource Hash
20a7cbe2c968e93283f86300a5958fe9215f64c3c45a95da0123e26ad3b684cf

Request headers

Referer
https://www.rekings.com/njrat/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 28 Aug 2018 14:09:08 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Aug 2018 11:45:55 GMT
Server
nginx
ETag
"5b76b573-3cad5"
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-control
max-age=86400
Connection
keep-alive
Content-Length
248533
truncated
/ 		466 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a5a5a44c9a26d26fe682e7372d4fb4dcd5608c4f075486880fcf4e58425d4a6d

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/svg+xml;charset=utf-8
agent_message.mp3
cdn-fr.jivosite.com/sounds/ 		4 KB
4 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn-fr.jivosite.com/sounds/agent_message.mp3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.59.26.52 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3061991.ip-37-59-26.eu
Software
nginx /
Resource Hash
ff81aad05612f90cf97c238f219765884e5cbf49351d8dc96a4a063c598c3f43

Request headers

Referer
https://www.rekings.com/njrat/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Range
bytes=0-
chrome-proxy
frfr

Response headers

Date
Tue, 28 Aug 2018 14:09:08 GMT
Last-Modified
Mon, 09 Jul 2018 12:57:11 GMT
Server
nginx
ETag
"5b435ba7-eb0"
Content-Type
audio/mpeg
Cache-Control
max-age=864000
Connection
keep-alive
Content-Length
3760
Expires
Fri, 07 Sep 2018 14:09:08 GMT
notification.mp3
cdn-fr.jivosite.com/sounds/ 		6 KB
6 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn-fr.jivosite.com/sounds/notification.mp3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.59.26.52 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3061991.ip-37-59-26.eu
Software
nginx /
Resource Hash
1112436abea08c851302bba4d4e37a27e25e5ec26b20474667a3369d41154bab

Request headers

Referer
https://www.rekings.com/njrat/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Range
bytes=0-
chrome-proxy
frfr

Response headers

Date
Tue, 28 Aug 2018 14:09:08 GMT
Last-Modified
Mon, 09 Jul 2018 12:57:11 GMT
Server
nginx
ETag
"5b435ba7-16b0"
Content-Type
audio/mpeg
Cache-Control
max-age=864000
Connection
keep-alive
Content-Length
5808
Expires
Fri, 07 Sep 2018 14:09:08 GMT
outgoing_message.mp3
cdn-fr.jivosite.com/sounds/ 		5 KB
5 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn-fr.jivosite.com/sounds/outgoing_message.mp3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.59.26.52 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3061991.ip-37-59-26.eu
Software
nginx /
Resource Hash
d44244617bf21df7a137694fa762d5cab3b82cb9fae8f33de5917977b02b2a11

Request headers

Referer
https://www.rekings.com/njrat/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Range
bytes=0-
chrome-proxy
frfr

Response headers

Date
Tue, 28 Aug 2018 14:09:08 GMT
Last-Modified
Mon, 09 Jul 2018 12:57:11 GMT
Server
nginx
ETag
"5b435ba7-1396"
Content-Type
audio/mpeg
Cache-Control
max-age=864000
Connection
keep-alive
Content-Length
5014
Expires
Fri, 07 Sep 2018 14:09:08 GMT
truncated
/ Frame 840D 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9b4913ee5ad0e6af0d3781e68497fc1d89ce14026681815cd769df77d901af0d

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

105 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _wpemojiSettings undefined| $ function| jQuery object| LS_Meta undefined| LS_oldGS undefined| LS_oldGSQueue undefined| LS_oldGSDefine undefined| LS_GSAP object| _gsScope object| _gsQueue object| GreenSockGlobals object| com function| _gsDefine function| Ease function| Power4 function| Strong function| Quint function| Power3 function| Quart function| Power2 function| Cubic function| Power1 function| Quad function| Power0 function| Linear function| TweenLite function| TweenPlugin function| TweenMax function| TimelineLite function| TimelineMax function| BezierPlugin function| CSSPlugin function| BackOut function| BackIn function| BackInOut object| Back function| SlowMo function| SteppedEase function| RoughEase function| BounceOut function| BounceIn function| BounceInOut object| Bounce function| CircOut function| CircIn function| CircInOut object| Circ function| ElasticOut function| ElasticIn function| ElasticInOut object| Elastic function| ExpoOut function| ExpoIn function| ExpoInOut object| Expo function| SineOut function| SineIn function| SineInOut object| Sine object| EaseLookup function| SplitType object| _layerSlider object| _layerSliders object| layerSliderTransitions string| mod_pagespeed_4oLPWm64IE string| mod_pagespeed_78EQL6Z9mO function| Cookies object| wpdiscuzAjaxObj object| html5 object| Modernizr string| c string| mod_pagespeed_FR1S$lOHZs string| mod_pagespeed_sxNdT0lPnx string| mod_pagespeed_FxBQY7ATnq object| woocommerce_params object| wc_cart_fragments_params string| mod_pagespeed_5v5F2$5zAQ string| mod_pagespeed_tAvu2AopG3 string| mod_pagespeed_qAFDwBinmc object| jQuery1124043078629593165485 function| tz_format_twitter function| relative_time string| mod_pagespeed_Jw$nygU3N3 string| mod_pagespeed_6NyV$7sKlv string| mod_pagespeed_dwTbSG1XwS object| nevia string| mod_pagespeed_2hf6iN38UD string| mod_pagespeed_aR3dA613tt string| mod_pagespeed_iVr1iGGpTv object| addComment object| wp object| pagespeed function| resizesidebar object| twemoji function| __jivoOnError boolean| __hasStorage boolean| jivo_magic_var function| __jivoBundleOnLoad function| __jivoBundleInit function| __jivoConfigOnLoad function| __jivoCacheDeletedWidget object| jivo_config function| jivo_init string| jivo_version object| jivo_api

0 Cookies

1 Console Messages

Source Level URL
Text
console-api log URL: https://www.rekings.com/njrat/(Line 43)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn-fr.jivosite.com
code.jivosite.com
fonts.googleapis.com
fonts.gstatic.com
www.rekings.com
176.34.84.103
185.186.52.36
2a00:1450:4001:81e::200a
2a00:1450:4001:821::2003
37.59.26.52
54.216.227.150
0ea08c3d9ce73c7fb8d602fc898d87aa937aaf4aa6912f4601716f11acddb5a9
0f8bf64e309d039bce73ee9c231766212875a2da7bc9cd0864c55942f5da2681
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
1112436abea08c851302bba4d4e37a27e25e5ec26b20474667a3369d41154bab
185e0d72fdba4ec241289b779eabd494831f8d9bae49b94fe7dfd6c0ebdba7d2
1b3a1db34e8d98d4e74654e21841ff7e057660d4481bbe7aff8d16da765d85d9
1f7ef6d676d72341c5a67f48ed51eed08fd989f8cddc7f05a75d7947746d3067
20a7cbe2c968e93283f86300a5958fe9215f64c3c45a95da0123e26ad3b684cf
20fabfa803d080cde34001dc0371473d089cb619e20ea2e1d99c16832af9ed1f
32532bb1068f7fc433a323cc732f995b9e91116c91dffa31696623510df8254e
35a21333c81302e934ee42b7b85b2c6a731bfffb418fe52fe795cb1974186976
36f93326c5d032bfbf162f2ee997b3bac642bc5e36f72f9668229ea0d14b7bc5
39168f75e12852929b883c3e65ae2cff76347d0e21f1f00c2addee8bd485c7e2
3ffe72ec886b260bd3fbfb3047fe92e3a78d874d18d46269490dc63536a9188e
401eafaf8ea103ec8fa4c66f9b594951fa04bc29eda5024bb39f7d01ce1be695
421e91e3eca4aef605d48e9dc6b04242f5d1645b7ce5458e4c6ebc5ae9fa9eef
45498f05349bc655e75a5d9ba184fcc90716154295a1095ddac62b6f61131d4f
456df06aebf1f7d2f706d41db178bc3a43185d9ce905a612129dcc58985d3386
50dda9aac0fcea362bdda27ae7833240485ad5a20ccc105c1cd13ea26802a8bd
529bda78540c766f0f30396a6239e335895ea61ec757f5d4ac217a4d90d8a7ab
562afad850b3a16739146f53adc5455a312ab3733f4aeab4f3a9526e13435050
59ed3629f0231b42f350a86dc312919a967bdab5a4ad673912fcec7003432a2f
5bcacc51356dcb482c298a58cd31d0462b8b4f746b04f0714d4f47141b9c555a
5dc9d8251c819a31f03fd4f8525ca64fc10f834227a702315d720f652c5e4ef6
5f648fea00f2e61023d676ed351d57e6b25740f4c5cd1456c484448602201f34
61e4b0a5d4e1841fb7bb1cd5c903438ca6d88311186455e7c98e5e013d910dd9
6ab737a8e8031b762a23e481df15fbe1f9c5b4541a2a3a97faf17c698f2001b7
6d7fe7c23d430676228f1fc2d54dc00699c3e36d9d264f327e80d84408a41dbc
713e2e46cf6cadf7aa53f998a93e067d08b149f153d3a32cd45905ad37ee1e43
7163808e74b5f9998a0b1eb87c8ab3916f5dc576b0a5ae8126b091253c067449
7656af89ef181eb283465c838125e58b7126781854ba70472710d1b275cf20a8
79d597aef034a0fa19f5c8abe8bbcfaf218c3729bf22adab65e9de60d9c6556a
7b78aa7793348400240ee901df802dccd7f3f508694ffc79f3556f04dfea6670
7d349f9e08a50336b6f398554e817e6921dd390ef9d8cacf3074a24d4379bd10
7fbcdaf59a07c42b9557b3f852ff4e33f7aabba6e18e3f60b089fa1ed14927f8
83dcc0e9c0f407cc67e4a4f26831362f89d6d5c26861aa98dd7c23f30c90fc59
8868d2a2f803ea6802d54a11564b5b96c7d8be56117a328c8f605539d6dee167
9b4913ee5ad0e6af0d3781e68497fc1d89ce14026681815cd769df77d901af0d
9d4b6be9b5aa8175a0c27e05670785dcb1b9a499c3b29d03512713f618a34dec
a15d561e431135230c01a52200a7f61b884179e98a8997de64fee19348c230e3
a5a5a44c9a26d26fe682e7372d4fb4dcd5608c4f075486880fcf4e58425d4a6d
aa25917905dd4e96e4ef5d707f3c194dd0d8d6b79790fe460ad39cb5d55fdbec
be2928ed6980ab35ebce0f3e9edbad1bd8a51af21c8b7c5fea73fd7ad42b3f56
c5e4ca72bae51e4f9d92854fc100003908a8774fa9723baa6fdb71252f18551e
c703b44828933cb1cffd0ac4731c088361d9dc7e9b5ebfe7d859475d1755f1be
c8bb383be22629a655e70cc1330ebc067ce527088ac8e1c391e638bb75172169
cb9a9ca1569053c14c268da8907f00c0cd26117ae746cede836cff299a0a0b8e
cd5e1399e437b01c47c4a4c29b1568abafdf06db5d2bc145704a42dae756d37e
cdfe845b25091a21147fe4a683515b000208ae4f67810f243d7bf96bc3484115
cff154f0d7dc23949bc6b2c081c1f24cffbb98ac04f8e41e67d81fcf02c392b4
d44244617bf21df7a137694fa762d5cab3b82cb9fae8f33de5917977b02b2a11
d45f5fb1fb4e1a101a8ad8722af443272f6c3d409d912e8175e6268d48e0b091
de05a17c5a7a719887be35592078dd6f982e7537453898be700beaf069a33907
deaa65e1185931a65cca1ee1a4b9919b014b74cd146bd7d242fd1648f7780b50
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eeadedd2bb8a1c6695cdfd592021afcfb1eb520a5f19549beb59014a86565c85
f677e91207149f446bf620613070fe689db0613879ae3bb56a0e606de8cd07bf
f6fd58a2249524e368bd3d7b62d917e2c7188959751d4293c07ff4c5015f6d3e
f982148422da7c61a3b345e3b4e9c85e4ed0c1d60272cd458e69f9095bfa1300
fb37b651a49507abc28084e7bcb570efe22b2d5200ce1479d4dacd2328c9469f
fbc8da798cfc766041669f73e588b27e93dbdbfbb540785bcd59e819c5087b97
fe32c9921874b35b87acb0a3b558784ca7b9fed91ed34c1d2a68b6566c9d09be
ff81aad05612f90cf97c238f219765884e5cbf49351d8dc96a4a063c598c3f43