urlscan.io logo urlscan.io
SecurityTrails logo

www.trustwave.com Open in urlscan Pro
52.151.96.240  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-it...
Submission: On November 23 via api from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 27 IPs in 8 countries across 27 domains to perform 94 HTTP transactions. The main IP is 52.151.96.240, located in London, United Kingdom and belongs to MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US. The main domain is www.trustwave.com.
TLS certificate: Issued by Trustwave Extended Validation SHA256 ... on November 26th 2018. Valid for: 2 years.
This is the only time www.trustwave.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
15 35 52.151.96.240 8075 (MICROSOFT...)
4 2606:2800:234... 15133 (EDGECAST)
1 4 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
12 104.18.138.190 13335 (CLOUDFLAR...)
1 151.101.12.217 54113 (FASTLY)
4 204.79.197.234 8068 (MICROSOFT...)
2 2.21.36.164 20940 (AKAMAI-ASN1)
2 23.8.10.242 20940 (AKAMAI-ASN1)
3 2606:4700:10:... 13335 (CLOUDFLAR...)
1 3 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:10c... 20940 (AKAMAI-ASN1)
1 152.199.19.160 15133 (EDGECAST)
1 2a00:1450:400... 15169 (GOOGLE)
2 159.122.87.148 36351 (SOFTLAYER)
14 52.239.152.234 8075 (MICROSOFT...)
5 2a00:1450:400... 15169 (GOOGLE)
1 2 2a05:f500:10:... 14413 (LINKEDIN)
1 1 2a05:f500:10:... 14413 (LINKEDIN)
1 72.247.226.64 16625 (AKAMAI-AS)
3 52.222.174.130 16509 (AMAZON-02)
1 192.28.144.124 15224 (OMNITURE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
2 2 52.49.153.216 16509 (AMAZON-02)
2 2603:1020:700:: 8075 (MICROSOFT...)
2 2603:1020:300:: 8075 (MICROSOFT...)
2 2603:1020:600::8 8075 (MICROSOFT...)
2 51.140.6.23 8075 (MICROSOFT...)
94 27
35    52.151.96.240 (London, United Kingdom)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
www.trustwave.com
4    2606:2800:234:660:118e:28f:1d8a:2522 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
fast.fonts.net
4    2a00:1450:4001:800::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.com
1    2a00:1450:4001:81b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
12    104.18.138.190 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
npercoco.typepad.com
1    151.101.12.217 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)
player.vimeo.com
4    204.79.197.234 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
www.atmrum.net
2    2.21.36.164 (France)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-21-36-164.deploy.static.akamaitechnologies.com
s7.addthis.com
v1.addthisedge.com
2    23.8.10.242 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-8-10-242.deploy.static.akamaitechnologies.com
munchkin.marketo.net
3    2606:4700:10::6814:b82d (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cookie-cdn.cookiepro.com
3    2a00:1450:4001:81c::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    2a02:26f0:10c:399::3adf (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
sjs.bizographics.com
1    152.199.19.160 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
az416426.vo.msecnd.net
1    2a00:1450:4001:819::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.gstatic.com
2    159.122.87.148 (Frankfurt am Main, Germany)

ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: 94.57.7a9f.ip4.static.sl-reverse.com
dev.visualwebsiteoptimizer.com
14    52.239.152.234 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
trustwave.blob.core.windows.net
5    2a00:1450:4001:81f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
2    2a05:f500:10:101::b93f:9105 (Ireland)

ASN14413 (LINKEDIN - LinkedIn Corporation, US)
px.ads.linkedin.com
1    2a05:f500:10:101::b93f:9101 (Ireland)

ASN14413 (LINKEDIN - LinkedIn Corporation, US)
www.linkedin.com
1    72.247.226.64 (United States)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a72-247-226-64.deploy.static.akamaitechnologies.com
z.moatads.com
3    52.222.174.130 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-174-130.fra54.r.cloudfront.net
vidassets.terminus.services
1    192.28.144.124 (United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
815-rfm-693.mktoresp.com
1    2a00:1450:400c:c08::9b (Brussels, Belgium)

ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net
1    2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.de
1    2606:4700:10::6814:b944 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
geolocation.onetrust.com
2    52.49.153.216 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-49-153-216.eu-west-1.compute.amazonaws.com
match.adsrvr.org
2    2603:1020:700:: (London, United Kingdom)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
cb8302cf274008cbed640a051ef93bc1.azr.footprintdns.com
2    2603:1020:300:: (Durham, United Kingdom)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
f2ee477b64bb231cba810c7fbd64ffae.azr.footprintdns.com
2    2603:1020:600::8 (Cardiff, United Kingdom)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
67d1b99e3f2a45ad2f7bd6597c38ab51.azr.footprintdns.com
2    51.140.6.23 (London, United Kingdom)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
dc.services.visualstudio.com
Domain Requested by
35 www.trustwave.com 15 redirects www.trustwave.com
az416426.vo.msecnd.net
14 trustwave.blob.core.windows.net www.trustwave.com
12 npercoco.typepad.com www.trustwave.com
5 fonts.gstatic.com www.trustwave.com
4 www.atmrum.net www.trustwave.com
www.atmrum.net
az416426.vo.msecnd.net
4 www.google.com 1 redirects www.trustwave.com
www.gstatic.com
4 fast.fonts.net www.trustwave.com
3 vidassets.terminus.services www.googletagmanager.com
www.trustwave.com
3 www.google-analytics.com 1 redirects www.googletagmanager.com
www.google-analytics.com
3 cookie-cdn.cookiepro.com www.trustwave.com
cookie-cdn.cookiepro.com
2 dc.services.visualstudio.com az416426.vo.msecnd.net
2 67d1b99e3f2a45ad2f7bd6597c38ab51.azr.footprintdns.com www.trustwave.com
2 f2ee477b64bb231cba810c7fbd64ffae.azr.footprintdns.com www.trustwave.com
2 cb8302cf274008cbed640a051ef93bc1.azr.footprintdns.com www.trustwave.com
2 match.adsrvr.org 2 redirects
2 px.ads.linkedin.com 1 redirects www.trustwave.com
2 dev.visualwebsiteoptimizer.com www.trustwave.com
2 munchkin.marketo.net www.trustwave.com
1 geolocation.onetrust.com www.trustwave.com
1 www.google.de www.trustwave.com
1 stats.g.doubleclick.net 1 redirects
1 815-rfm-693.mktoresp.com az416426.vo.msecnd.net
1 v1.addthisedge.com s7.addthis.com
1 z.moatads.com s7.addthis.com
1 www.linkedin.com 1 redirects
1 www.gstatic.com www.google.com
1 az416426.vo.msecnd.net www.trustwave.com
1 sjs.bizographics.com www.googletagmanager.com
1 s7.addthis.com www.trustwave.com
1 player.vimeo.com www.trustwave.com
1 www.googletagmanager.com www.trustwave.com
94 31
Subject Issuer Validity Valid
www.trustwave.com
Trustwave Extended Validation SHA256 CA, Level 1		 2018-11-26 -
2020-11-25		 2 years crt.sh
s9.wac.edgecastcdn.net
DigiCert SHA2 Secure Server CA		 2019-01-16 -
2021-02-03		 2 years crt.sh
www.google.com
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh
ssl919196.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-06-17 -
2019-12-24		 6 months crt.sh
*.vimeo.com
DigiCert SHA2 Secure Server CA		 2018-08-24 -
2020-04-02		 2 years crt.sh
*.atmrum.net
Microsoft IT TLS CA 5		 2019-08-26 -
2021-08-26		 2 years crt.sh
odc-prod-01.oracle.com
DigiCert SHA2 Secure Server CA		 2019-10-10 -
2020-09-04		 a year crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA		 2018-12-24 -
2020-03-24		 a year crt.sh
*.cookiepro.com
DigiCert SHA2 Secure Server CA		 2018-05-16 -
2020-05-20		 2 years crt.sh
js.bizographics.com
DigiCert SHA2 Secure Server CA		 2018-04-13 -
2020-04-17		 2 years crt.sh
*.vo.msecnd.net
Microsoft IT TLS CA 2		 2018-03-30 -
2020-03-30		 2 years crt.sh
*.google.com
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh
*.visualwebsiteoptimizer.com
Starfield Secure Certificate Authority - G2		 2017-06-30 -
2020-07-06		 3 years crt.sh
*.blob.core.windows.net
Microsoft IT TLS CA 2		 2019-05-10 -
2021-05-10		 2 years crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA		 2019-05-29 -
2021-06-29		 2 years crt.sh
moatads.com
DigiCert ECC Secure Server CA		 2018-11-10 -
2020-02-09		 a year crt.sh
*.terminus.services
Amazon		 2019-02-12 -
2020-03-12		 a year crt.sh
*.mktoresp.com
GeoTrust RSA CA 2018		 2018-02-05 -
2020-02-05		 2 years crt.sh
www.google.de
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh
*.onetrust.com
DigiCert SHA2 Secure Server CA		 2018-03-12 -
2020-06-14		 2 years crt.sh
*.footprintdns.com
Microsoft IT TLS CA 4		 2019-05-20 -
2021-05-20		 2 years crt.sh
dc.services.visualstudio.com
Microsoft IT TLS CA 5		 2019-11-18 -
2021-11-18		 2 years crt.sh

This page contains 2 frames:

Primary Page: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Frame ID: 68BCD5073650E2E1F738E39B271A5426
Requests: 93 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=75nbHAdFrusJCwoMVGTXoHoM&size=invisible&cb=gu40bfvikaw1
Frame ID: B88B483DDBB97B8074B8BDC50C280DA9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cybo... HTTP 301
    https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cybo... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • script /dev\.visualwebsiteoptimizer\.com/i
Overall confidence: 100%
Detected patterns
  • script /\/recaptcha\/api\.js/i

Page Statistics

94
Requests

100 %
HTTPS

53 %
IPv6

27
Domains

31
Subdomains

27
IPs

8
Countries

1641 kB
Transfer

2953 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder HTTP 301
    https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 39
  • https://www.trustwave.com/media/15971/mq-cover-2019.png?anchor=center&mode=crop&width=400&rnd=132016322080000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/2/4/2/8/4/2/242842b59d7a613be32f624d370f3a14a5af34a8.png
Request Chain 40
  • https://www.trustwave.com/media/15951/database-security-in-the-cloud-cover.png?anchor=center&mode=crop&width=400&rnd=132007852950000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/7/2/f/4/f/a/72f4fa87e98f4082904da04fd7c4b3135add7f78.png
Request Chain 41
  • https://www.trustwave.com/media/16254/the-underground-economy-cover.png?anchor=center&mode=crop&width=400&rnd=132094902880000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/e/a/e/4/5/f/eae45f0f73517fa27ea5b5fa0cf439363e4a4cc2.png
Request Chain 42
  • https://www.trustwave.com/media/16414/cyber-multicloud-ebook-cover-image.png?anchor=center&mode=crop&width=400&rnd=132176020710000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/5/a/6/8/3/4/5a6834a869db6f970c8f090a022f77a1c482c6a8.png
Request Chain 43
  • https://www.trustwave.com/media/15106/ierr37pw.png?anchor=center&mode=crop&width=400&rnd=131992175790000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/9/5/b/0/d/f/95b0df699cb216066e4e2043e54a3680a0fb2a3c.png
Request Chain 44
  • https://www.trustwave.com/media/7356/7145.jpg?anchor=center&mode=crop&width=400&rnd=131644845120000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/5/5/a/e/2/8/55ae28c467881ce9b68f44a5b34fafb48aaab9ba.jpg
Request Chain 45
  • https://www.trustwave.com/media/15099/anhtjsym.png?anchor=center&mode=crop&width=400&rnd=131992175790000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/f/e/1/e/a/3/fe1ea3f0cc565c74dc2af73f762c6ce35710d018.png
Request Chain 46
  • https://www.trustwave.com/media/15279/sl-blog-default-image.jpg?anchor=center&mode=crop&width=400&rnd=131897042940000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg
Request Chain 47
  • https://www.trustwave.com/media/16422/blog-header.jpg?anchor=center&mode=crop&width=400&rnd=132177216820000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/6/0/6/7/9/c/60679cee8edbe7db354898df61dbdb6e3f6173cc.jpg
Request Chain 48
  • https://www.trustwave.com/media/16450/forrester-wave-apj-2019-graphic.png?anchor=center&mode=crop&width=400&rnd=132187429190000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/8/a/b/2/3/d/8ab23d6fb589fac7dd316cb8b60eb2b0dc8c330a.png
Request Chain 49
  • https://www.trustwave.com/media/15362/appdetectivepro-softwave_cover.png?anchor=center&mode=crop&width=400&rnd=131992182340000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/5/9/1/2/3/c/59123c2680ab22c424c78d82f95d5fa2cc57149b.png
Request Chain 50
  • https://www.trustwave.com/media/15367/seg-wsqlsoftwave_cover.png?anchor=center&mode=crop&width=400&rnd=131992182340000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/6/2/0/4/7/8/62047821b2b4521ce7ac70c881234928b4c9372d.png
Request Chain 51
  • https://www.trustwave.com/media/16397/rsa2020event-header.jpg?anchor=center&mode=crop&width=400&rnd=132164399540000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/a/5/b/3/1/c/a5b31ce6efda87f6d0165a6659799c71ac0c8082.jpg
Request Chain 52
  • https://www.trustwave.com/media/15280/news-release-default-image.jpg?anchor=center&mode=crop&width=400&rnd=131897043050000000 HTTP 302
  • https://trustwave.blob.core.windows.net/cache/9/4/4/9/0/5/9449054b6e599d2c6ae326fc940e1718f740d84d.jpg
Request Chain 63
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Ffake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder%2F&time=1574531507884 HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D70652%26url%3Dhttps%253A%252F%252Fwww.trustwave.com%252Fen-us%252Fresources%252Fblogs%252Fspiderlabs-blog%252Ffake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder%252F%26time%3D1574531507884%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Ffake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder%2F&time=1574531507884&liSync=true
Request Chain 77
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=975955549&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Ffake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder%2F&ul=en-us&de=UTF-8&dt=Fake%20Windows%20Update%20Spam%20Leads%20to%20Cyborg%20Ransomware%20and%20Its%20Builder%20%7C%20Trustwave&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGDAAEADQ~&jid=396150622&gjid=868858943&cid=1718050641.1574531508&tid=UA-123880220-1&_gid=1929249977.1574531508&_r=1&gtm=2wgav954M2ZJN&z=1763524818 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-123880220-1&cid=1718050641.1574531508&jid=396150622&_gid=1929249977.1574531508&gjid=868858943&_v=j79&z=1763524818 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-123880220-1&cid=1718050641.1574531508&jid=396150622&_v=j79&z=1763524818 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-123880220-1&cid=1718050641.1574531508&jid=396150622&_v=j79&z=1763524818&slf_rd=1&random=201648768
Request Chain 80
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=af0d2044-417b-49dd-b4e9-25d4e62e0332|97bc34c1-b207-4e84-b568-5b6d2e502d78 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=af0d2044-417b-49dd-b4e9-25d4e62e0332|97bc34c1-b207-4e84-b568-5b6d2e502d78 HTTP 302
  • https://vidassets.terminus.services/s.gif?d=af0d2044-417b-49dd-b4e9-25d4e62e0332|97bc34c1-b207-4e84-b568-5b6d2e502d78&t=0d8a81d3-90f7-4914-9942-43fbefc4f548

94 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Redirect Chain
  • https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder
  • https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
114 KB
26 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
98bc0be6a4f1b066103df391d21bbf7db65f1268867c270f95b230c933f277bb
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.trustwave.com
:scheme
https
:path
/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
cookie
ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Sec-Fetch-User
?1

Response headers

status
200
cache-control
no-cache
pragma
no-cache
content-type
text/html; charset=utf-8
content-encoding
gzip
expires
-1
vary
Accept-Encoding
set-cookie
ARRAffinity=3935d26f58841e3917f2e00f0df6da5c8b0d6cb2f1f0c9e9c490026921b7ee2e;Path=/;HttpOnly;Domain=trustwave-umbraco-uk.azurewebsites.net
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
x-content-type-options
nosniff
strict-transport-security
max-age=600; includeSubDomains
x-aspnet-version
date
Sat, 23 Nov 2019 17:51:46 GMT
content-length
26897

Redirect headers

status
301
cache-control
no-cache
content-type
text/html; charset=UTF-8
location
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
set-cookie
ARRAffinity=3935d26f58841e3917f2e00f0df6da5c8b0d6cb2f1f0c9e9c490026921b7ee2e;Path=/;HttpOnly;Domain=trustwave-umbraco-uk.azurewebsites.net ApplicationGatewayAffinity=bcc70b3e9d2a132e2376fddfd28702ba57725b0d585f7a92e016c74563f04890;Path=/;Domain=www.trustwave.com
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
x-content-type-options
nosniff
strict-transport-security
max-age=600; includeSubDomains
x-aspnet-version
date
Sat, 23 Nov 2019 17:51:46 GMT
content-length
255
9c85e15b-99ed-40a4-929d-2262f9ed2706.css
fast.fonts.net/cssapi/ 		12 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fast.fonts.net/cssapi/9c85e15b-99ed-40a4-929d-2262f9ed2706.css
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:660:118e:28f:1d8a:2522 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40B6) /
Resource Hash
c7462996b5100030c14d741c4852012390a78e583e02910d99036c68fd07499e

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:47 GMT
content-encoding
gzip
last-modified
Thu, 11 Oct 2018 21:41:27 GMT
server
ECS (fcn/40B6)
access-control-allow-origin
*
etag
"3105672264+gzip"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
1285
expires
Sat, 30 Nov 2019 17:51:47 GMT
styles.min.css
www.trustwave.com/dist/css/ 		199 KB
29 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.trustwave.com/dist/css/styles.min.css?v=v29sa
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
5a4589d3f0e2f85a7acbe4ee104d80dcba518e9e0f9f1706f146de1d51efd716
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:23:12 GMT
x-aspnet-version
etag
"040ee30109bd51:0"
x-frame-options
SAMEORIGIN
content-type
text/css
status
200
date
Sat, 23 Nov 2019 17:51:46 GMT
accept-ranges
bytes
vary
Accept-Encoding
content-length
29257
x-xss-protection
1; mode=block
api.js
www.google.com/recaptcha/ 		729 B
637 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
GSE /
Resource Hash
3211cd82ce26fec042b2543617d3138a366d470fa74ed56788c3b0956c9f9ffb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
private, max-age=300
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
463
x-xss-protection
1; mode=block
expires
Sat, 23 Nov 2019 17:51:47 GMT
api.js
www.google.com/recaptcha/ 		763 B
565 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?render=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
GSE /
Resource Hash
a02b61289de24053eeef501b3de570c975a083594cf6789f2f541ed70ec95d20
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
private, max-age=300
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
495
x-xss-protection
1; mode=block
expires
Sat, 23 Nov 2019 17:51:47 GMT
logo-trustwave-white.svg
www.trustwave.com/img/logo/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trustwave.com/img/logo/logo-trustwave-white.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
b0f35cc025dc27ea345536d4eafc13e52fe2b1c237fd6c4150d4dbf85c323c27
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:25:08 GMT
x-aspnet-version
etag
"0721276109bd51:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
date
Sat, 23 Nov 2019 17:51:46 GMT
accept-ranges
bytes
content-length
2776
x-xss-protection
1; mode=block
gtm.js
www.googletagmanager.com/ 		80 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
6f74810c7b9e3e110f9c80950aa75cf88f3573c4bb2cd1b92a643e03db73c62f
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:47 GMT
content-encoding
br
last-modified
Sat, 23 Nov 2019 15:00:00 GMT
server
Google Tag Manager
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
28634
x-xss-protection
0
expires
Sat, 23 Nov 2019 17:51:47 GMT
Singtel%20Logo.svg
www.trustwave.com/img/logo/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trustwave.com/img/logo/Singtel%20Logo.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
ace78f63f590160b0748a26e60d8b453b4d4ac8bc4da20967632bf7e5bcb58e3
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:25:08 GMT
x-aspnet-version
etag
"0721276109bd51:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
date
Sat, 23 Nov 2019 17:51:46 GMT
accept-ranges
bytes
content-length
4945
x-xss-protection
1; mode=block
Optus%20Logo.svg
www.trustwave.com/img/logo/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trustwave.com/img/logo/Optus%20Logo.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
2a1c9874549a1cb94b6e0dc5822b4f5ca14386d39214a8145670fc1c50045496
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:25:08 GMT
x-aspnet-version
etag
"0721276109bd51:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
date
Sat, 23 Nov 2019 17:51:46 GMT
accept-ranges
bytes
content-length
2799
x-xss-protection
1; mode=block
twitter.svg
www.trustwave.com/img/icon/social/svg/dark/ 		778 B
860 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trustwave.com/img/icon/social/svg/dark/twitter.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
cf7008a1bb1e7dcffa096b3f0c782f3dd610f847413ae4861a5c03006f093553
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:25:06 GMT
x-aspnet-version
etag
"045e174109bd51:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
date
Sat, 23 Nov 2019 17:51:46 GMT
accept-ranges
bytes
content-length
778
x-xss-protection
1; mode=block
linkedin.svg
www.trustwave.com/img/icon/social/svg/dark/ 		636 B
718 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trustwave.com/img/icon/social/svg/dark/linkedin.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
42f2f65a52347bf6ed6c0633b5458c48ddc1b439923c92caec18c6d6f111afe3
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:25:04 GMT
x-aspnet-version
etag
"018b073109bd51:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
date
Sat, 23 Nov 2019 17:51:46 GMT
accept-ranges
bytes
content-length
636
x-xss-protection
1; mode=block
facebook.svg
www.trustwave.com/img/icon/social/svg/dark/ 		446 B
490 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trustwave.com/img/icon/social/svg/dark/facebook.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
3f18aeab9b9baa3e61c4bc2cd0372e3946f494bd03bff3cad740e5ea817fce2b
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:25:04 GMT
x-aspnet-version
etag
"018b073109bd51:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
date
Sat, 23 Nov 2019 17:51:46 GMT
accept-ranges
bytes
content-length
446
x-xss-protection
1; mode=block
6a0133f264aa62970b0240a49e08d3200c-900wi
npercoco.typepad.com/.a/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a49e08d3200c-900wi
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.138.190 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers
6a0133f264aa62970b0240a4ebf981200b-500wi
npercoco.typepad.com/.a/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a4ebf981200b-500wi
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.138.190 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers
6a0133f264aa62970b0240a49e0903200c-900wi
npercoco.typepad.com/.a/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a49e0903200c-900wi
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.138.190 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers
6a0133f264aa62970b0240a49e0e9a200c-500wi
npercoco.typepad.com/.a/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a49e0e9a200c-500wi
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.138.190 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers
6a0133f264aa62970b0240a49e0ef9200c-800wi
npercoco.typepad.com/.a/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a49e0ef9200c-800wi
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.138.190 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers
6a0133f264aa62970b0240a4ebff1b200b-640wi
npercoco.typepad.com/.a/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a4ebff1b200b-640wi
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.138.190 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers
6a0133f264aa62970b0240a4c743ba200d-900wi
npercoco.typepad.com/.a/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a4c743ba200d-900wi
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.138.190 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers
6a0133f264aa62970b0240a4c743ce200d-400wi
npercoco.typepad.com/.a/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a4c743ce200d-400wi
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.138.190 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers
6a0133f264aa62970b0240a4ebff69200b-500wi
npercoco.typepad.com/.a/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a4ebff69200b-500wi
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.138.190 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers
6a0133f264aa62970b0240a4c74452200d-900wi
npercoco.typepad.com/.a/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a4c74452200d-900wi
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.138.190 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers
6a0133f264aa62970b0240a49e100f200c-500wi
npercoco.typepad.com/.a/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a49e100f200c-500wi
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.138.190 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers
6a0133f264aa62970b0240a4c74480200d-800wi
npercoco.typepad.com/.a/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a4c74480200d-800wi
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.138.190 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers
linkedin.svg
www.trustwave.com/img/icon/social/svg/light/ 		636 B
676 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trustwave.com/img/icon/social/svg/light/linkedin.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
46647527924f0574eded74e7ef9a93d43044a47dcd1b11b9a203c0a9a8bb65e9
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:25:06 GMT
x-aspnet-version
etag
"045e174109bd51:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
date
Sat, 23 Nov 2019 17:51:46 GMT
accept-ranges
bytes
content-length
636
x-xss-protection
1; mode=block
twitter.svg
www.trustwave.com/img/icon/social/svg/light/ 		778 B
818 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trustwave.com/img/icon/social/svg/light/twitter.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
4fb02286499439e694d9a4220d6ca3ab664b2ba4bdb699b9068aa8e6fd5528c6
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:25:06 GMT
x-aspnet-version
etag
"045e174109bd51:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
date
Sat, 23 Nov 2019 17:51:46 GMT
accept-ranges
bytes
content-length
778
x-xss-protection
1; mode=block
facebook.svg
www.trustwave.com/img/icon/social/svg/light/ 		446 B
486 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trustwave.com/img/icon/social/svg/light/facebook.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
64ed842d23dcee23e4cf9257dd18ce0066a76cd75108e7fc95f13a4a9b0e892c
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:25:06 GMT
x-aspnet-version
etag
"045e174109bd51:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
date
Sat, 23 Nov 2019 17:51:46 GMT
accept-ranges
bytes
content-length
446
x-xss-protection
1; mode=block
youtube.svg
www.trustwave.com/img/icon/social/svg/light/ 		525 B
569 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trustwave.com/img/icon/social/svg/light/youtube.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
c750113ac663d3ae3adea8e042237ac1c5ea21f9ad1749efc357ea93acbc5d78
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:25:06 GMT
x-aspnet-version
etag
"045e174109bd51:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
date
Sat, 23 Nov 2019 17:51:46 GMT
accept-ranges
bytes
content-length
525
x-xss-protection
1; mode=block
player.js
player.vimeo.com/api/ 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://player.vimeo.com/api/player.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.217 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
c889f8be02dd3f558aa62eecb48553fb5a306c9fff0951bd97ff3b40a46875e0
Security Headers
Name Value
Content-Security-Policy default-src 'none'; style-src 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

X-Varnish-Cache
0
Content-Security-Policy
default-src 'none'; style-src 'unsafe-inline'
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
621
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT
P3p
CP="This is not a P3P policy! See https://vimeo.com/privacy"
X-Cache-Hits
523
Connection
keep-alive
X-VServer
infra-playproxy-a-9
Content-Length
5205
X-Xss-Protection
1; mode=block
X-Served-By
cache-fra19141-FRA
X-Vimeo-DC
ge
Server
nginx
X-Timer
S1574531507.335340,VS0,VE0
Date
Sat, 23 Nov 2019 17:51:47 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
application/javascript;charset=utf-8
Access-Control-Allow-Origin
*
Vary
Accept-Encoding
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Accept-Ranges
bytes
Expires
Sat, 23 Nov 2019 18:11:26 GMT
scripts.min.js
www.trustwave.com/dist/js/ 		435 KB
135 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.trustwave.com/dist/js/scripts.min.js?v=v26sa
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
37e63ec3246a6e7123104d262fb182293599ad45878c56476be17594b048f339
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:23:12 GMT
x-aspnet-version
etag
"040ee30109bd51:0"
x-frame-options
SAMEORIGIN
content-type
application/x-javascript
status
200
date
Sat, 23 Nov 2019 17:51:46 GMT
accept-ranges
bytes
vary
Accept-Encoding
content-length
137830
x-xss-protection
1; mode=block
rum.js
www.atmrum.net/ 		301 B
587 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.atmrum.net/rum.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
204.79.197.234 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
80afdcdab5af95e11f8edac404947668a91582b9799723a8d5272483a010f23d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:47 GMT
x-content-type-options
nosniff
last-modified
Wed, 20 Nov 2019 21:58:14 GMT
x-msedge-ref
Ref A: 079571B0C5244D948C9F9BD65ED63740 Ref B: FRAEDGE0106 Ref C: 2019-11-23T17:51:47Z
access-control-allow-origin
*
etag
0x8D4FC0223F2F653
content-type
application/javascript
status
200
access-control-expose-headers
X-MSEdge-Ref
cache-control
no-store
accept-ranges
bytes
timing-allow-origin
*
content-length
301
addthis_widget.js
s7.addthis.com/js/300/ 		349 KB
113 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.36.164 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-36-164.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
7c20e3e201e3d7c6821e907def1257deb544eb08578c7129b96d53bbf62d34e4
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Wed, 30 Oct 2019 19:35:04 GMT
server
nginx/1.15.8
etag
"5db9e5e8-57446"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
status
200
cache-control
public, max-age=600
date
Sat, 23 Nov 2019 17:51:47 GMT
x-host
s7.addthis.com
content-length
114924
munchkin.js
munchkin.marketo.net/154/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/154/munchkin.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.10.242 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-8-10-242.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9298a280eda6b54290d3c69fda3ae7da0cec1a0169d01d4e5944af63d68939d5

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Sat, 23 Nov 2019 17:51:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 18 May 2018 02:45:27 GMT
Server
Apache
ETag
"808fc844032f646c32adce24553838be:1526611527"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
3700
Expires
Mon, 02 Mar 2020 17:51:47 GMT
5142c8f1-532c-427b-a545-0bcfe1f6f4ea.js
cookie-cdn.cookiepro.com/langswitch/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cookie-cdn.cookiepro.com/langswitch/5142c8f1-532c-427b-a545-0bcfe1f6f4ea.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:b82d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9545498791418ba2847374815a974cc5bad7368ffb1df4c44c67d25027dd219e
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 23 Nov 2019 17:51:47 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
2Q95fkKCF+yYcVGygzYfBA==
age
3152
status
200
vary
Accept-Encoding
x-ms-lease-status
unlocked
last-modified
Mon, 29 Apr 2019 14:20:09 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=2592000; includeSubDomains; preload
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
30e173af-701e-009e-111a-9b2b93000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
cf-ray
53a4fe418aa7cbc0-VIE
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
4690
date
Sat, 23 Nov 2019 16:33:37 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Sat, 23 Nov 2019 18:33:37 GMT
insight.min.js
sjs.bizographics.com/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sjs.bizographics.com/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:10c:399::3adf , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Sat, 23 Nov 2019 17:51:47 GMT
Content-Encoding
gzip
Last-Modified
Mon, 07 Oct 2019 16:41:31 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=26119
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1576
1.css
fast.fonts.net/t/ 		0
102 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fast.fonts.net/t/1.css?apiType=css&projectid=9c85e15b-99ed-40a4-929d-2262f9ed2706
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:660:118e:28f:1d8a:2522 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/41AE) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:47 GMT
last-modified
Wed, 21 Feb 2018 12:55:22 GMT
server
ECS (fcn/41AE)
access-control-allow-origin
*
etag
"616070693"
x-cache
HIT
content-type
text/css
status
200
cache-control
max-age=0
accept-ranges
bytes
content-length
0
expires
Sat, 23 Nov 2019 17:51:47 GMT
ai.0.js
az416426.vo.msecnd.net/scripts/a/ 		95 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.19.160 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FA5) /
Resource Hash
013819105effb1832cbcbcfcc6317b0045170a7f671bd953a21f0847fa1a2e6e

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 23 Nov 2019 17:51:47 GMT
content-encoding
gzip
content-md5
7JhCKwvLjoUoS5N/nN9LRA==
x-cache
HIT
status
200
content-length
21636
x-ms-lease-status
unlocked
last-modified
Tue, 11 Jun 2019 21:34:18 GMT
server
ECAcc (frc/8FA5)
etag
0x8D6EEB48F61B4AC
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
3ac2c0bf-001e-0119-09e7-a18ed9000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400, immutable
x-ms-version
2009-09-19
recaptcha__en.js
www.gstatic.com/recaptcha/releases/75nbHAdFrusJCwoMVGTXoHoM/ 		254 KB
91 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/75nbHAdFrusJCwoMVGTXoHoM/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
3b6f51d30b4b20b9e7b3da75b5c14a51ce39ec203b9fa37e043f097272d5540e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Thu, 21 Nov 2019 04:26:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 11 Nov 2019 05:06:47 GMT
server
sffe
age
221112
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
92852
x-xss-protection
0
expires
Fri, 20 Nov 2020 04:26:35 GMT
j.php
dev.visualwebsiteoptimizer.com/ 		904 B
679 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dev.visualwebsiteoptimizer.com/j.php?a=423481&u=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Ffake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder%2F&r=0.6799947645924285
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.122.87.148 Frankfurt am Main, Germany, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
94.57.7a9f.ip4.static.sl-reverse.com
Software
fra1dacdn /
Resource Hash
89c6e9bfa9bbb7631c0699f5529b4f0ae35f25843bb1c776e60c30e72a05e8ad

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

status
200
date
Sat, 23 Nov 2019 17:51:47 GMT
content-encoding
gzip
server
fra1dacdn
content-type
application/javascript; charset=UTF-8
242842b59d7a613be32f624d370f3a14a5af34a8.png
trustwave.blob.core.windows.net/cache/2/4/2/8/4/2/
Redirect Chain
  • https://www.trustwave.com/media/15971/mq-cover-2019.png?anchor=center&mode=crop&width=400&rnd=132016322080000000
  • https://trustwave.blob.core.windows.net/cache/2/4/2/8/4/2/242842b59d7a613be32f624d370f3a14a5af34a8.png
29 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trustwave.blob.core.windows.net/cache/2/4/2/8/4/2/242842b59d7a613be32f624d370f3a14a5af34a8.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
508e6f3fb69e549be60a6ac9c70a2a044f28e566a7a6c39c6bf10c189e94170c

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sat, 23 Nov 2019 17:51:47 GMT
Last-Modified
Tue, 07 May 2019 02:12:57 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
fcR1zEp8VBKmz7+LZNOSdw==
ETag
0x8D6D291859BA39A
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.9.1.2
Content-Type
image/png
x-ms-request-id
59ecb0bc-501e-00e8-1526-a21015000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
29222

Redirect headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
location
https://trustwave.blob.core.windows.net/cache/2/4/2/8/4/2/242842b59d7a613be32f624d370f3a14a5af34a8.png
date
Sat, 23 Nov 2019 17:51:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
status
302
cache-control
no-cache
content-length
219
x-xss-protection
1; mode=block
72f4fa87e98f4082904da04fd7c4b3135add7f78.png
trustwave.blob.core.windows.net/cache/7/2/f/4/f/a/
Redirect Chain
  • https://www.trustwave.com/media/15951/database-security-in-the-cloud-cover.png?anchor=center&mode=crop&width=400&rnd=132007852950000000
  • https://trustwave.blob.core.windows.net/cache/7/2/f/4/f/a/72f4fa87e98f4082904da04fd7c4b3135add7f78.png
57 KB
57 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trustwave.blob.core.windows.net/cache/7/2/f/4/f/a/72f4fa87e98f4082904da04fd7c4b3135add7f78.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
64f5b163f57390ef83cfaa8e328cdbaa6baf4305cedf341549b37f8e68986d83

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sat, 23 Nov 2019 17:51:48 GMT
Last-Modified
Mon, 29 Apr 2019 12:16:04 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
87yixUc9UDs1DHGy/tsWfw==
ETag
0x8D6CC9C73A7D46F
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.9.1.2
Content-Type
image/png
x-ms-request-id
79a9a1a4-a01e-00b9-3926-a20ee0000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
57903

Redirect headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
location
https://trustwave.blob.core.windows.net/cache/7/2/f/4/f/a/72f4fa87e98f4082904da04fd7c4b3135add7f78.png
date
Sat, 23 Nov 2019 17:51:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
status
302
cache-control
no-cache
content-length
219
x-xss-protection
1; mode=block
eae45f0f73517fa27ea5b5fa0cf439363e4a4cc2.png
trustwave.blob.core.windows.net/cache/e/a/e/4/5/f/
Redirect Chain
  • https://www.trustwave.com/media/16254/the-underground-economy-cover.png?anchor=center&mode=crop&width=400&rnd=132094902880000000
  • https://trustwave.blob.core.windows.net/cache/e/a/e/4/5/f/eae45f0f73517fa27ea5b5fa0cf439363e4a4cc2.png
276 KB
277 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trustwave.blob.core.windows.net/cache/e/a/e/4/5/f/eae45f0f73517fa27ea5b5fa0cf439363e4a4cc2.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
19a5abc3ee71d9689286163dd786564ab2d59a118563fc140e62fa96d0d386df

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sat, 23 Nov 2019 17:51:48 GMT
Last-Modified
Mon, 05 Aug 2019 14:54:10 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
2nJMTgekKPiIq9CgmTKqrg==
ETag
0x8D719B4C5DE07E9
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/png
x-ms-request-id
6fa0c069-501e-012b-3526-a2df03000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
282667

Redirect headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
location
https://trustwave.blob.core.windows.net/cache/e/a/e/4/5/f/eae45f0f73517fa27ea5b5fa0cf439363e4a4cc2.png
date
Sat, 23 Nov 2019 17:51:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
status
302
cache-control
no-cache
content-length
219
x-xss-protection
1; mode=block
5a6834a869db6f970c8f090a022f77a1c482c6a8.png
trustwave.blob.core.windows.net/cache/5/a/6/8/3/4/
Redirect Chain
  • https://www.trustwave.com/media/16414/cyber-multicloud-ebook-cover-image.png?anchor=center&mode=crop&width=400&rnd=132176020710000000
  • https://trustwave.blob.core.windows.net/cache/5/a/6/8/3/4/5a6834a869db6f970c8f090a022f77a1c482c6a8.png
53 KB
54 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trustwave.blob.core.windows.net/cache/5/a/6/8/3/4/5a6834a869db6f970c8f090a022f77a1c482c6a8.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
049bf83ad4e353fb4bce7d9fff2ba6b0996aa1a8bbdba76ca83a2ee78c887687

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sat, 23 Nov 2019 17:51:48 GMT
Last-Modified
Thu, 07 Nov 2019 12:23:34 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
7yCcZEg8vp+Cqn2BqP21Mw==
ETag
0x8D7637D4EF0E3A5
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/png
x-ms-request-id
c2efccf7-e01e-00d8-4126-a24a3f000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
54413

Redirect headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
location
https://trustwave.blob.core.windows.net/cache/5/a/6/8/3/4/5a6834a869db6f970c8f090a022f77a1c482c6a8.png
date
Sat, 23 Nov 2019 17:51:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
status
302
cache-control
no-cache
content-length
219
x-xss-protection
1; mode=block
95b0df699cb216066e4e2043e54a3680a0fb2a3c.png
trustwave.blob.core.windows.net/cache/9/5/b/0/d/f/
Redirect Chain
  • https://www.trustwave.com/media/15106/ierr37pw.png?anchor=center&mode=crop&width=400&rnd=131992175790000000
  • https://trustwave.blob.core.windows.net/cache/9/5/b/0/d/f/95b0df699cb216066e4e2043e54a3680a0fb2a3c.png
142 KB
143 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trustwave.blob.core.windows.net/cache/9/5/b/0/d/f/95b0df699cb216066e4e2043e54a3680a0fb2a3c.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
2e45a8996ec5c8b3fce4c3f71fc56ef806673998113d09c32f73c7a3d6efdb38

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sat, 23 Nov 2019 17:51:48 GMT
Last-Modified
Mon, 08 Apr 2019 18:44:55 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
5UtgQThYJzYHnzR2krDd3w==
ETag
0x8D6BC524B3A4226
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.9.1.2
Content-Type
image/png
x-ms-request-id
f15125ea-301e-0119-1026-a287d3000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
145855

Redirect headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
location
https://trustwave.blob.core.windows.net/cache/9/5/b/0/d/f/95b0df699cb216066e4e2043e54a3680a0fb2a3c.png
date
Sat, 23 Nov 2019 17:51:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
status
302
cache-control
no-cache
content-length
219
x-xss-protection
1; mode=block
55ae28c467881ce9b68f44a5b34fafb48aaab9ba.jpg
trustwave.blob.core.windows.net/cache/5/5/a/e/2/8/
Redirect Chain
  • https://www.trustwave.com/media/7356/7145.jpg?anchor=center&mode=crop&width=400&rnd=131644845120000000
  • https://trustwave.blob.core.windows.net/cache/5/5/a/e/2/8/55ae28c467881ce9b68f44a5b34fafb48aaab9ba.jpg
32 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trustwave.blob.core.windows.net/cache/5/5/a/e/2/8/55ae28c467881ce9b68f44a5b34fafb48aaab9ba.jpg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
442ea31252146edee6257a0d2a320511fca7b9c5b18a187662011475bd8e06e9

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sat, 23 Nov 2019 17:51:47 GMT
Last-Modified
Tue, 29 Jan 2019 22:23:18 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
JzOkUpHvhJej7jkrJ7YD4g==
ETag
0x8D686385EAC1484
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.9.1.2
Content-Type
image/jpeg
x-ms-request-id
e72c6e0e-801e-0069-6f26-a2b242000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
32317

Redirect headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
location
https://trustwave.blob.core.windows.net/cache/5/5/a/e/2/8/55ae28c467881ce9b68f44a5b34fafb48aaab9ba.jpg
date
Sat, 23 Nov 2019 17:51:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
status
302
cache-control
no-cache
content-length
219
x-xss-protection
1; mode=block
fe1ea3f0cc565c74dc2af73f762c6ce35710d018.png
trustwave.blob.core.windows.net/cache/f/e/1/e/a/3/
Redirect Chain
  • https://www.trustwave.com/media/15099/anhtjsym.png?anchor=center&mode=crop&width=400&rnd=131992175790000000
  • https://trustwave.blob.core.windows.net/cache/f/e/1/e/a/3/fe1ea3f0cc565c74dc2af73f762c6ce35710d018.png
191 KB
192 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trustwave.blob.core.windows.net/cache/f/e/1/e/a/3/fe1ea3f0cc565c74dc2af73f762c6ce35710d018.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
afdb51ca4091dab446883adfecd01177ccff53d591802db6f50955f990bd0e11

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sat, 23 Nov 2019 17:51:48 GMT
Last-Modified
Mon, 08 Apr 2019 17:32:23 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
+qABAenLP1eipNeJue5kbQ==
ETag
0x8D6BC48292CD71C
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.9.1.2
Content-Type
image/png
x-ms-request-id
e72c6ef2-801e-0069-3a26-a2b242000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
196049

Redirect headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
location
https://trustwave.blob.core.windows.net/cache/f/e/1/e/a/3/fe1ea3f0cc565c74dc2af73f762c6ce35710d018.png
date
Sat, 23 Nov 2019 17:51:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
status
302
cache-control
no-cache
content-length
219
x-xss-protection
1; mode=block
a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg
trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/
Redirect Chain
  • https://www.trustwave.com/media/15279/sl-blog-default-image.jpg?anchor=center&mode=crop&width=400&rnd=131897042940000000
  • https://trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg
9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
0c9ea8d5d78894047d11c4f301a3c05fcbef0aad9530a4af4cffc7ec5f46b9fa

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sat, 23 Nov 2019 17:51:47 GMT
Last-Modified
Tue, 29 Jan 2019 22:23:19 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
L7nZWGNKgpLgr0LXI1uaRw==
ETag
0x8D686385F25C77F
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.9.1.2
Content-Type
image/jpeg
x-ms-request-id
59ecb217-501e-00e8-5526-a21015000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
9577

Redirect headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
location
https://trustwave.blob.core.windows.net/cache/a/8/c/4/4/3/a8c4434c70c4e1e6102f99b8fa9d52122c530944.jpg
date
Sat, 23 Nov 2019 17:51:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
status
302
cache-control
no-cache
content-length
219
x-xss-protection
1; mode=block
60679cee8edbe7db354898df61dbdb6e3f6173cc.jpg
trustwave.blob.core.windows.net/cache/6/0/6/7/9/c/
Redirect Chain
  • https://www.trustwave.com/media/16422/blog-header.jpg?anchor=center&mode=crop&width=400&rnd=132177216820000000
  • https://trustwave.blob.core.windows.net/cache/6/0/6/7/9/c/60679cee8edbe7db354898df61dbdb6e3f6173cc.jpg
14 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trustwave.blob.core.windows.net/cache/6/0/6/7/9/c/60679cee8edbe7db354898df61dbdb6e3f6173cc.jpg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
58da1e483d01174d84d8ec20bd621eb17dc12dadf9ff7b2a6cd3218670ae6621

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sat, 23 Nov 2019 17:51:48 GMT
Last-Modified
Thu, 14 Nov 2019 19:42:06 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
ZtX8mtlmvHfQ1l+jLi+VxQ==
ETag
0x8D7693ABB674F7D
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/jpeg
x-ms-request-id
6fa0c17f-501e-012b-3326-a2df03000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
14435

Redirect headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
location
https://trustwave.blob.core.windows.net/cache/6/0/6/7/9/c/60679cee8edbe7db354898df61dbdb6e3f6173cc.jpg
date
Sat, 23 Nov 2019 17:51:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
status
302
cache-control
no-cache
content-length
219
x-xss-protection
1; mode=block
8ab23d6fb589fac7dd316cb8b60eb2b0dc8c330a.png
trustwave.blob.core.windows.net/cache/8/a/b/2/3/d/
Redirect Chain
  • https://www.trustwave.com/media/16450/forrester-wave-apj-2019-graphic.png?anchor=center&mode=crop&width=400&rnd=132187429190000000
  • https://trustwave.blob.core.windows.net/cache/8/a/b/2/3/d/8ab23d6fb589fac7dd316cb8b60eb2b0dc8c330a.png
41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trustwave.blob.core.windows.net/cache/8/a/b/2/3/d/8ab23d6fb589fac7dd316cb8b60eb2b0dc8c330a.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
2f2c9772b87f349fb9b5292ffac8eb44a25968e253c22b61628011aa57ad6a37

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sat, 23 Nov 2019 17:51:48 GMT
Last-Modified
Wed, 20 Nov 2019 18:33:32 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
SR0iNczhuXnEdA98rDkBGQ==
ETag
0x8D76DE825A3E8B6
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/png
x-ms-request-id
f1512733-301e-0119-3a26-a287d3000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
41598

Redirect headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
location
https://trustwave.blob.core.windows.net/cache/8/a/b/2/3/d/8ab23d6fb589fac7dd316cb8b60eb2b0dc8c330a.png
date
Sat, 23 Nov 2019 17:51:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
status
302
cache-control
no-cache
content-length
219
x-xss-protection
1; mode=block
59123c2680ab22c424c78d82f95d5fa2cc57149b.png
trustwave.blob.core.windows.net/cache/5/9/1/2/3/c/
Redirect Chain
  • https://www.trustwave.com/media/15362/appdetectivepro-softwave_cover.png?anchor=center&mode=crop&width=400&rnd=131992182340000000
  • https://trustwave.blob.core.windows.net/cache/5/9/1/2/3/c/59123c2680ab22c424c78d82f95d5fa2cc57149b.png
16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trustwave.blob.core.windows.net/cache/5/9/1/2/3/c/59123c2680ab22c424c78d82f95d5fa2cc57149b.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
5ec923aa6be3895f83ced26f99254fd46d4b1158df9c6a7efc580fa3a21fd4d9

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sat, 23 Nov 2019 17:51:48 GMT
Last-Modified
Mon, 08 Apr 2019 19:42:37 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
JMAPuVtd54lEXsvO78tn9w==
ETag
0x8D6BC5A5A7A29E5
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.9.1.2
Content-Type
image/png
x-ms-request-id
79a9a207-a01e-00b9-0b26-a20ee0000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
15961

Redirect headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
location
https://trustwave.blob.core.windows.net/cache/5/9/1/2/3/c/59123c2680ab22c424c78d82f95d5fa2cc57149b.png
date
Sat, 23 Nov 2019 17:51:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
status
302
cache-control
no-cache
content-length
219
x-xss-protection
1; mode=block
62047821b2b4521ce7ac70c881234928b4c9372d.png
trustwave.blob.core.windows.net/cache/6/2/0/4/7/8/
Redirect Chain
  • https://www.trustwave.com/media/15367/seg-wsqlsoftwave_cover.png?anchor=center&mode=crop&width=400&rnd=131992182340000000
  • https://trustwave.blob.core.windows.net/cache/6/2/0/4/7/8/62047821b2b4521ce7ac70c881234928b4c9372d.png
16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trustwave.blob.core.windows.net/cache/6/2/0/4/7/8/62047821b2b4521ce7ac70c881234928b4c9372d.png
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
25f4029ca7cae1a317757b015488d4a24a174ad968c213d9c3ec8b5cdc92c6fe

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sat, 23 Nov 2019 17:51:48 GMT
Last-Modified
Mon, 08 Apr 2019 20:31:03 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
8jbSLM967bp9S6MNULmX1Q==
ETag
0x8D6BC611EAF8623
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.9.1.2
Content-Type
image/png
x-ms-request-id
c2efcd7a-e01e-00d8-2f26-a24a3f000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
16232

Redirect headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
location
https://trustwave.blob.core.windows.net/cache/6/2/0/4/7/8/62047821b2b4521ce7ac70c881234928b4c9372d.png
date
Sat, 23 Nov 2019 17:51:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
status
302
cache-control
no-cache
content-length
219
x-xss-protection
1; mode=block
a5b31ce6efda87f6d0165a6659799c71ac0c8082.jpg
trustwave.blob.core.windows.net/cache/a/5/b/3/1/c/
Redirect Chain
  • https://www.trustwave.com/media/16397/rsa2020event-header.jpg?anchor=center&mode=crop&width=400&rnd=132164399540000000
  • https://trustwave.blob.core.windows.net/cache/a/5/b/3/1/c/a5b31ce6efda87f6d0165a6659799c71ac0c8082.jpg
11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trustwave.blob.core.windows.net/cache/a/5/b/3/1/c/a5b31ce6efda87f6d0165a6659799c71ac0c8082.jpg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
739b04d51205b32bbc9eebee051946d76dab1552fe4ca57c2787e1d8f6b55b51

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sat, 23 Nov 2019 17:51:47 GMT
Last-Modified
Fri, 25 Oct 2019 01:29:28 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
DX1x4OQHqAM0qFHYVHa2jQ==
ETag
0x8D758EAC725E724
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.10.0.100
Content-Type
image/jpeg
x-ms-request-id
59ecb197-501e-00e8-5d26-a21015000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
11286

Redirect headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
location
https://trustwave.blob.core.windows.net/cache/a/5/b/3/1/c/a5b31ce6efda87f6d0165a6659799c71ac0c8082.jpg
date
Sat, 23 Nov 2019 17:51:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
status
302
cache-control
no-cache
content-length
219
x-xss-protection
1; mode=block
9449054b6e599d2c6ae326fc940e1718f740d84d.jpg
trustwave.blob.core.windows.net/cache/9/4/4/9/0/5/
Redirect Chain
  • https://www.trustwave.com/media/15280/news-release-default-image.jpg?anchor=center&mode=crop&width=400&rnd=131897043050000000
  • https://trustwave.blob.core.windows.net/cache/9/4/4/9/0/5/9449054b6e599d2c6ae326fc940e1718f740d84d.jpg
8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trustwave.blob.core.windows.net/cache/9/4/4/9/0/5/9449054b6e599d2c6ae326fc940e1718f740d84d.jpg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.152.234 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
89bdf549d76d6869d69a09923a7ed7774059693e6c44e468d62b3455b43ed80b

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sat, 23 Nov 2019 17:51:48 GMT
Last-Modified
Tue, 29 Jan 2019 22:23:19 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
V1Hydp5+I3t8O2JZYt7a1Q==
ETag
0x8D686385F28AE3A
x-ms-meta-ImageProcessedBy
ImageProcessor.Web/4.9.1.2
Content-Type
image/jpeg
x-ms-request-id
79a9a21d-a01e-00b9-1e26-a20ee0000000
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
Content-Length
8319

Redirect headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
x-aspnet-version
location
https://trustwave.blob.core.windows.net/cache/9/4/4/9/0/5/9449054b6e599d2c6ae326fc940e1718f740d84d.jpg
date
Sat, 23 Nov 2019 17:51:46 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
status
302
cache-control
no-cache
content-length
219
x-xss-protection
1; mode=block
loading-white.svg
www.trustwave.com/img/utility/ 		687 B
731 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.trustwave.com/img/utility/loading-white.svg
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
4d84802c2cc3550892199289d28a046c4e1d011964c7c7f9d43bdeebecf107de
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.trustwave.com/dist/css/styles.min.css?v=v29sa
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:25:08 GMT
x-aspnet-version
etag
"0721276109bd51:0"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
status
200
date
Sat, 23 Nov 2019 17:51:46 GMT
accept-ranges
bytes
content-length
687
x-xss-protection
1; mode=block
MaterialIcons-Regular.woff2
www.trustwave.com/fonts/material-icons/ 		43 KB
43 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.trustwave.com/fonts/material-icons/MaterialIcons-Regular.woff2
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.trustwave.com/dist/css/styles.min.css?v=v29sa
Origin
https://www.trustwave.com

Response headers

strict-transport-security
max-age=600; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:23:14 GMT
x-aspnet-version
etag
"06d1f32109bd51:0"
x-frame-options
SAMEORIGIN
content-type
application/x-font-woff2
status
200
date
Sat, 23 Nov 2019 17:51:46 GMT
accept-ranges
bytes
content-length
44300
x-xss-protection
1; mode=block
KFOmCnqEu92Fr1Mu4mxP.ttf
fonts.gstatic.com/s/roboto/v20/ 		35 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxP.ttf
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
0b1d7f87f3ca4c8b4bd749b02b6ad71c930b7e306c752a2e2293d7b250b02e27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.trustwave.com/dist/css/styles.min.css?v=v29sa
Origin
https://www.trustwave.com

Response headers

date
Thu, 21 Nov 2019 11:27:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
195852
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
20742
x-xss-protection
0
last-modified
Wed, 24 Jul 2019 01:18:36 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 20 Nov 2020 11:27:35 GMT
KFOlCnqEu92Fr1MmWUlfBBc9.ttf
fonts.gstatic.com/s/roboto/v20/ 		35 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc9.ttf
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a637d3ff767789f9b113bbfa208bdb6a76efed7c4c111da2a130f6a38a51d353
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.trustwave.com/dist/css/styles.min.css?v=v29sa
Origin
https://www.trustwave.com

Response headers

date
Thu, 21 Nov 2019 23:32:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
152378
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
20796
x-xss-protection
0
last-modified
Wed, 24 Jul 2019 01:18:59 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 20 Nov 2020 23:32:09 GMT
KFOlCnqEu92Fr1MmEU9fBBc9.ttf
fonts.gstatic.com/s/roboto/v20/ 		36 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc9.ttf
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
719df7954428f52779f3fa18641c19fc854b39394193d87eea5a61795dec8dbe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.trustwave.com/dist/css/styles.min.css?v=v29sa
Origin
https://www.trustwave.com

Response headers

date
Thu, 21 Nov 2019 11:42:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
194974
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
20908
x-xss-protection
0
last-modified
Wed, 24 Jul 2019 01:18:36 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 20 Nov 2020 11:42:13 GMT
71e645d2-276d-4568-b9e4-e215b8e5b24f.woff2
fast.fonts.net/dv2/14/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fast.fonts.net/dv2/14/71e645d2-276d-4568-b9e4-e215b8e5b24f.woff2?d44f19a684109620e484147fa790e81859e92aaaea3d337f84586d5df8888fe5455f55e0f83ed0be044ddfaa95e824a4b1318d5b552aaa24a44025e9&projectId=9c85e15b-99ed-40a4-929d-2262f9ed2706
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:660:118e:28f:1d8a:2522 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/40E7) /
Resource Hash
bd1f1f47a863ac3be54dab002af884683776e666b68d50ec7641ca732991d54f

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://fast.fonts.net/cssapi/9c85e15b-99ed-40a4-929d-2262f9ed2706.css
Origin
https://www.trustwave.com

Response headers

date
Sat, 23 Nov 2019 17:51:47 GMT
last-modified
Fri, 05 Dec 2014 01:42:38 GMT
server
ECS (fcn/40E7)
access-control-allow-origin
*
etag
"2674825278"
x-cache
HIT
content-type
application/octet-stream
status
200
cache-control
max-age=7776000
accept-ranges
bytes
content-length
20080
expires
Fri, 21 Feb 2020 17:51:47 GMT
KFOlCnqEu92Fr1MmSU5fBBc9.ttf
fonts.gstatic.com/s/roboto/v20/ 		35 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc9.ttf
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b4c96f55c265e0a80be4243a16f7e88b9a67c85b71b4e2aa8cea4e1aa989b0d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.trustwave.com/dist/css/styles.min.css?v=v29sa
Origin
https://www.trustwave.com

Response headers

date
Wed, 20 Nov 2019 11:27:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
282282
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
20827
x-xss-protection
0
last-modified
Wed, 24 Jul 2019 01:18:53 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 19 Nov 2020 11:27:05 GMT
KFOkCnqEu92Fr1Mu51xIIzc.ttf
fonts.gstatic.com/s/roboto/v20/ 		37 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzc.ttf
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
0dfa4684ad9c52a1a97d91764ef1d404c15dd95ed20f00a2f9f3f4d11df2abf9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.trustwave.com/dist/css/styles.min.css?v=v29sa
Origin
https://www.trustwave.com

Response headers

date
Wed, 20 Nov 2019 11:21:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
282640
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
22299
x-xss-protection
0
last-modified
Wed, 24 Jul 2019 01:19:00 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 19 Nov 2020 11:21:07 GMT
d9dabe05-624c-4f28-8eee-b3b6f1841abf.woff2
fast.fonts.net/dv2/14/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fast.fonts.net/dv2/14/d9dabe05-624c-4f28-8eee-b3b6f1841abf.woff2?d44f19a684109620e484147fa790e81859e92aaaea3d337f84586d5df8888fe5455f55e0f83ed0be044ddfaa95e824a4b1318d5b552aaa24a44025e9&projectId=9c85e15b-99ed-40a4-929d-2262f9ed2706
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:660:118e:28f:1d8a:2522 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECS (fcn/4193) /
Resource Hash
f422b8961953524e333d562521c3b4e0a2ed33da87079bd92c08ec4389372358

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://fast.fonts.net/cssapi/9c85e15b-99ed-40a4-929d-2262f9ed2706.css
Origin
https://www.trustwave.com

Response headers

date
Sat, 23 Nov 2019 17:51:47 GMT
last-modified
Fri, 05 Dec 2014 01:40:36 GMT
server
ECS (fcn/4193)
access-control-allow-origin
*
etag
"2369653874"
x-cache
HIT
content-type
application/octet-stream
status
200
cache-control
max-age=7776000
accept-ranges
bytes
content-length
20472
expires
Fri, 21 Feb 2020 17:51:47 GMT
js
www.google-analytics.com/gtm/ 		62 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/gtm/js?id=GTM-5B38B7F&t=gtm1&cid=1718050641.1574531508
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a6e6828f3d8b1a0cdb62c0f09ef6fc911866e0e41e3b167c889775521a32ec64
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:47 GMT
content-encoding
br
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
server
Google Tag Manager
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
23406
x-xss-protection
0
expires
Sat, 23 Nov 2019 17:51:47 GMT
collect
px.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Ffake-windows-update-spam-leads-to-cyborg-ransomware-and-...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D70652%26url%3Dhttps%253A%252F%252Fwww.trustwave.com%252Fen-us%252Fresources%252Fb...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Ffake-windows-update-spam-leads-to-cyborg-ransomware-and-...
0
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Ffake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder%2F&time=1574531507884&liSync=true
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:48 GMT
content-encoding
gzip
server
Play
vary
Accept-Encoding
x-li-fabric
prod-lva1
status
200
x-li-proto
http/2
x-li-pop
prod-efr5
content-type
application/javascript
content-length
20
x-li-uuid
L26agxDc2RWwVHREaSsAAA==

Redirect headers

date
Sat, 23 Nov 2019 17:51:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
302
x-li-pop
prod-efr5
content-length
20
x-li-uuid
WhuHexDc2RXQHLFYyCoAAA==
pragma
no-cache
server
Play
x-frame-options
sameorigin
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
vary
Accept-Encoding
strict-transport-security
max-age=2592000
x-li-fabric
prod-lva1
location
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=70652&url=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Ffake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder%2F&time=1574531507884&liSync=true
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT
v.gif
dev.visualwebsiteoptimizer.com/ 		35 B
238 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dev.visualwebsiteoptimizer.com/v.gif?a=423481&d=trustwave.com&u=D5834560AE35E2FBA1CDB29325F2F9A27&h=f0501013bceea5cdd5c05c5b52d83c21&t=false&r=0.8419396107400667
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.122.87.148 Frankfurt am Main, Germany, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
94.57.7a9f.ip4.static.sl-reverse.com
Software
fra1dacdn /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Nov 2019 17:51:47 GMT
x-content-type-options
nosniff
server
fra1dacdn
content-type
image/gif
status
200
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length
35
expires
Mon, 10 Jan 2005 00:00:01 GMT
munchkin.js
munchkin.marketo.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/js/scripts.min.js?v=v26sa
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.10.242 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-8-10-242.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f97341de4415531cb15d7472b1a00e875c1ad9b5541fd7e9f8ef5905f2a02092

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Sat, 23 Nov 2019 17:51:48 GMT
Content-Encoding
gzip
Last-Modified
Fri, 25 Oct 2019 16:30:39 GMT
Server
Apache
ETag
"521a36d038605fd35c0785cc62e39b0e:1572021039"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
766
fpv2.min.js
www.atmrum.net/client/v1/atm/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.atmrum.net/client/v1/atm/fpv2.min.js
Requested by
Host: www.atmrum.net
URL: https://www.atmrum.net/rum.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
204.79.197.234 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
32ea28e4cc9fb2662d406bc5e859f774b58f927861c31864c33cb81aa8263aac
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:47 GMT
x-content-type-options
nosniff
last-modified
Wed, 20 Nov 2019 21:58:14 GMT
x-msedge-ref
Ref A: 377333F0C7ED4C16B0007EE7CCB69EE4 Ref B: FRAEDGE0106 Ref C: 2019-11-23T17:51:48Z
access-control-allow-origin
*
etag
0x8D501F7AFB7338D
content-type
application/javascript
status
200
access-control-expose-headers
X-MSEdge-Ref
cache-control
no-store
accept-ranges
bytes
timing-allow-origin
*
content-length
2983
moatframe.js
z.moatads.com/addthismoatframe568911941483/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
72.247.226.64 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-226-64.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Sat, 23 Nov 2019 17:51:48 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 Nov 2019 20:13:52 GMT
Server
AmazonS3
x-amz-request-id
C0B7E130097BC605
ETag
"f14b4e1f799b14f798a195f43cf58376"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=46820
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
948
x-amz-id-2
WMRpIO186SrpMgXAdDxxqtwuB/nVpPpDrif5aSQ8+ORAAGwczaqMUoDLYLjYQOU+EHP09vSgz8E=
d22d5d9f-dee9-4eea-bf38-6b6ef609199b.js
cookie-cdn.cookiepro.com/consent/ 		69 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cookie-cdn.cookiepro.com/consent/d22d5d9f-dee9-4eea-bf38-6b6ef609199b.js
Requested by
Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/langswitch/5142c8f1-532c-427b-a545-0bcfe1f6f4ea.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:b82d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c3bfab00f5e70133e4daafbd95aea46f572bbcf33335ee75b9f2240742c7982
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 23 Nov 2019 17:51:48 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
tokLCuVTsBOR85IgoPx1iA==
age
3151
status
200
vary
Accept-Encoding
x-ms-lease-status
unlocked
last-modified
Mon, 29 Apr 2019 14:20:11 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=2592000; includeSubDomains; preload
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
0fac2aa9-a01e-008d-49e9-9b0f9f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
cf-ray
53a4fe454851cbc0-VIE
_ate.track.config_resp
v1.addthisedge.com/live/boost/ra-5286e9523a723348/ 		166 B
387 B 		Script
General
Check archive.org
Download Go to
Full URL
https://v1.addthisedge.com/live/boost/ra-5286e9523a723348/_ate.track.config_resp
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.36.164 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-21-36-164.deploy.static.akamaitechnologies.com
Software
Jetty(9.4.8.v20180619) /
Resource Hash
4cf8b4da854cac70fb514c2d255e93904353bda1fcc7229de2f59d5971d83028

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:48 GMT
surrogate-key
ra-5286e9523a723348
server
Jetty(9.4.8.v20180619)
etag
659743217
cache-tag
ra-5286e9523a723348
status
200
cache-control
public, max-age=56, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-type
application/javascript;charset=utf-8
content-length
166
anchor
www.google.com/recaptcha/api2/ Frame B88B 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=75nbHAdFrusJCwoMVGTXoHoM&size=invisible&cb=gu40bfvikaw1
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/75nbHAdFrusJCwoMVGTXoHoM/recaptcha__en.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-jN7+GD9KkVY9IMEFpXb1Uw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/anchor?ar=1&k=6LdMtIkUAAAAAP7FCbfNuAv_bvJRl7vsAjPIyOWc&co=aHR0cHM6Ly93d3cudHJ1c3R3YXZlLmNvbTo0NDM.&hl=en&v=75nbHAdFrusJCwoMVGTXoHoM&size=invisible&cb=gu40bfvikaw1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
nested-navigate
referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/

Response headers

status
200
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Sat, 23 Nov 2019 17:51:48 GMT
content-security-policy
script-src 'report-sample' 'nonce-jN7+GD9KkVY9IMEFpXb1Uw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
9036
server
GSE
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
t.js
vidassets.terminus.services/af0d2044-417b-49dd-b4e9-25d4e62e0332/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vidassets.terminus.services/af0d2044-417b-49dd-b4e9-25d4e62e0332/t.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-54M2ZJN
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.222.174.130 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-174-130.fra54.r.cloudfront.net
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
9081c649d724d2d9653447b9f454460d90682897c5ec090383947ce924e8a92f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 10:43:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-amz-cf-pop
FRA54
x-cache
Hit from cloudfront
status
200
via
1.1 b454a0b154ae18408006bc2a9abd88ec.cloudfront.net (CloudFront)
last-modified
Thu, 14 Nov 2019 15:09:02 GMT
server
nginx/1.10.3 (Ubuntu)
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control
public, s-maxage=2700
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id
f4DzDGZjEllAA5Zi4reM7rmyP3DkbmiHSxLM7PNRB-xDTjc5qZ9p5g==
en-us.json
www.trustwave.com/locale/en-us/LC_MESSAGES/ 		1 KB
680 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.trustwave.com/locale/en-us/LC_MESSAGES/en-us.json
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
86d78a37f9eed924112a2d4b927366b5a0fa97d78c2f338e86d9681a7c82fb9f
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
X-Requested-With
XMLHttpRequest
Request-Id
|g8X29.AeuWw
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:25:08 GMT
x-aspnet-version
x-frame-options
SAMEORIGIN
etag
"0721276109bd51:0"
vary
Accept-Encoding
content-type
application/json
status
200
date
Sat, 23 Nov 2019 17:51:47 GMT
accept-ranges
bytes
content-length
578
x-xss-protection
1; mode=block
ja-jp.json
www.trustwave.com/locale/ja-jp/LC_MESSAGES/ 		1 KB
949 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.trustwave.com/locale/ja-jp/LC_MESSAGES/ja-jp.json
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
b039f2982db54f667f7d7274fca4ff8fcf4ae6dacb09fdde0b21089927104cfa
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
X-Requested-With
XMLHttpRequest
Request-Id
|g8X29.VngUb
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:25:10 GMT
x-aspnet-version
x-frame-options
SAMEORIGIN
etag
"09f4377109bd51:0"
vary
Accept-Encoding
content-type
application/json
status
200
date
Sat, 23 Nov 2019 17:51:47 GMT
accept-ranges
bytes
content-length
865
x-xss-protection
1; mode=block
de-de.json
www.trustwave.com/locale/de-de/LC_MESSAGES/ 		1 KB
634 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.trustwave.com/locale/de-de/LC_MESSAGES/de-de.json
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
ef17abba195ddfd0ad62db48e71eebe2e7dd1b5a52e8ed8d81c368ef63835a4c
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
X-Requested-With
XMLHttpRequest
Request-Id
|g8X29.AxdAL
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 14 Nov 2019 17:25:08 GMT
x-aspnet-version
x-frame-options
SAMEORIGIN
etag
"0721276109bd51:0"
vary
Accept-Encoding
content-type
application/json
status
200
date
Sat, 23 Nov 2019 17:51:47 GMT
accept-ranges
bytes
content-length
550
x-xss-protection
1; mode=block
fpconfig.min.json
www.atmrum.net/conf/v1/atm/ 		191 B
473 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.atmrum.net/conf/v1/atm/fpconfig.min.json
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
204.79.197.234 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
72766f736186eb5c7c6d08502f3bf28da0092e8ea85cf3b5413c9daf8dc2d94a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Origin
https://www.trustwave.com

Response headers

date
Sat, 23 Nov 2019 17:51:47 GMT
x-content-type-options
nosniff
last-modified
Wed, 20 Nov 2019 21:58:14 GMT
x-msedge-ref
Ref A: 67120848FC9B4909BF45D40978839F24 Ref B: FRAEDGE0206 Ref C: 2019-11-23T17:51:48Z
etag
0x8D501F7AFB7338D
status
200
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
X-MSEdge-Ref
cache-control
no-store
accept-ranges
bytes
timing-allow-origin
*
content-length
191
visitWebPage
815-rfm-693.mktoresp.com/webevents/ 		2 B
303 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://815-rfm-693.mktoresp.com/webevents/visitWebPage?_mchNc=1574531508115&_mchCn=&_mchId=815-RFM-693&_mchTk=_mch-trustwave.com-1574531508114-12307&_mchHo=www.trustwave.com&_mchPo=&_mchRu=%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Ffake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder%2F&_mchPc=https%3A&_mchVr=154&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
akka-http/10.1.7 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Origin
https://www.trustwave.com

Response headers

Access-Control-Allow-Origin
*
Date
Sat, 23 Nov 2019 17:51:48 GMT
Content-Encoding
gzip
Server
akka-http/10.1.7
Transfer-Encoding
chunked
X-Request-Id
1729dc01-9d62-4323-9fa2-b7eefe9fb247
Content-Type
text/plain; charset=UTF-8
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=975955549&t=pageview&_s=1&dl=https%3A%2F%2Fwww.trustwave.com%2Fen-us%2Fresources%2Fblogs%2Fspiderlabs-blog%2Ffake-windows-update-spam-leads-t...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-123880220-1&cid=1718050641.1574531508&jid=396150622&_gid=1929249977.1574531508&gjid=868858943&_v=j79&z=1763524818
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-123880220-1&cid=1718050641.1574531508&jid=396150622&_v=j79&z=1763524818
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-123880220-1&cid=1718050641.1574531508&jid=396150622&_v=j79&z=1763524818&slf_rd=1&random=201648768
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-123880220-1&cid=1718050641.1574531508&jid=396150622&_v=j79&z=1763524818&slf_rd=1&random=201648768
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Nov 2019 17:51:48 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sat, 23 Nov 2019 17:51:48 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-123880220-1&cid=1718050641.1574531508&jid=396150622&_v=j79&z=1763524818&slf_rd=1&random=201648768
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
optanon.css
cookie-cdn.cookiepro.com/skins/4.8.0/default_flat_bottom_two_button_black/v2/css/ 		23 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cookie-cdn.cookiepro.com/skins/4.8.0/default_flat_bottom_two_button_black/v2/css/optanon.css
Requested by
Host: cookie-cdn.cookiepro.com
URL: https://cookie-cdn.cookiepro.com/consent/d22d5d9f-dee9-4eea-bf38-6b6ef609199b.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:b82d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0bd0bc4edd5e4b256b9c40ce082680ad16a78ac5faf4d3337d39cf9605518bfe
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 23 Nov 2019 17:51:48 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
jzLE25vmrDR3ZmMxTSa8+w==
age
6631
status
200
vary
Accept-Encoding
x-ms-lease-status
unlocked
last-modified
Thu, 19 Sep 2019 18:59:46 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=2592000; includeSubDomains; preload
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
3c27e72a-201e-002a-0538-6fe75d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
cf-ray
53a4fe45fa55cbc0-VIE
EU
geolocation.onetrust.com/cookieconsentpub/v1/geo/countries/ 		32 B
325 B 		Script
General
Check archive.org
Download Go to
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/countries/EU?callback=jQuery33107846787972619818_1574531507979&_=1574531507980
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/dist/js/scripts.min.js?v=v26sa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:b944 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b0817a0d6a87f2d42532035e42b20ea55cfaa5ca1092c761f5fc5e734790bdbf

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:48 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
status
200
cf-ray
53a4fe463db3598e-VIE
content-length
32
s.gif
vidassets.terminus.services/
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=af0d2044-417b-49dd-b4e9-25d4e62e0332|97bc34c1-b207-4e84-b568-5b6d2e502d78
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=af0d2044-417b-49dd-b4e9-25d4e62e0332|97bc34c1-b207-4e84-b568-5b6d2e502d78
  • https://vidassets.terminus.services/s.gif?d=af0d2044-417b-49dd-b4e9-25d4e62e0332|97bc34c1-b207-4e84-b568-5b6d2e502d78&t=0d8a81d3-90f7-4914-9942-43fbefc4f548
42 B
678 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vidassets.terminus.services/s.gif?d=af0d2044-417b-49dd-b4e9-25d4e62e0332|97bc34c1-b207-4e84-b568-5b6d2e502d78&t=0d8a81d3-90f7-4914-9942-43fbefc4f548
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.222.174.130 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-174-130.fra54.r.cloudfront.net
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:19:10 GMT
via
1.1 b454a0b154ae18408006bc2a9abd88ec.cloudfront.net (CloudFront)
x-content-type-options
nosniff
age
1956
x-cache
Hit from cloudfront
status
200
content-length
42
last-modified
Thu, 14 Nov 2019 15:02:51 GMT
server
nginx/1.10.3 (Ubuntu)
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control
public, s-maxage=2700
x-amz-cf-pop
FRA54
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id
5wyQ9XDtLffNPR06OnIsYs_AoklghpBd8fCrA7ll0aADl3dPFxJW-A==

Redirect headers

pragma
no-cache
date
Sat, 23 Nov 2019 17:51:48 GMT
x-aspnet-version
4.0.30319
location
https://vidassets.terminus.services/s.gif?d=af0d2044-417b-49dd-b4e9-25d4e62e0332|97bc34c1-b207-4e84-b568-5b6d2e502d78&t=0d8a81d3-90f7-4914-9942-43fbefc4f548
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
status
302
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
343
t.gif
vidassets.terminus.services/af0d2044-417b-49dd-b4e9-25d4e62e0332/ 		42 B
680 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vidassets.terminus.services/af0d2044-417b-49dd-b4e9-25d4e62e0332/t.gif?d=97bc34c1-b207-4e84-b568-5b6d2e502d78&s=6cfc72e6-5dba-4d26-a6e2-e43a4bcd60f5&cb=1574531508166
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.222.174.130 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-174-130.fra54.r.cloudfront.net
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 10:30:08 GMT
via
1.1 b454a0b154ae18408006bc2a9abd88ec.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA54
x-cache
Hit from cloudfront
status
200
content-length
42
last-modified
Thu, 14 Nov 2019 15:02:51 GMT
server
nginx/1.10.3 (Ubuntu)
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control
public, s-maxage=2700
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id
7vRJRlPjjc1W_o_OU4S8Vc5VBmUx6vhTfWHLfkssscDNsK5kT5-0Aw==
trans.gif
cb8302cf274008cbed640a051ef93bc1.azr.footprintdns.com/apc/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cb8302cf274008cbed640a051ef93bc1.azr.footprintdns.com/apc/trans.gif?4ac6bb4deec1ea4b2a14519aceea6c8f
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1020:700:: London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:48 GMT
x-content-type-options
nosniff
last-modified
Thu, 19 Sep 2019 16:11:00 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
content-type
image/gif
status
200
accept-ranges
bytes
content-length
43
etag
"db56bed346fd51:0"
IsUserAusi
www.trustwave.com/umbraco/surface/AJAX/ 		5 B
191 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.trustwave.com/umbraco/surface/AJAX/IsUserAusi
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
X-Requested-With
XMLHttpRequest
Request-Id
|g8X29.Khr3e
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
x-aspnet-version
date
Sat, 23 Nov 2019 17:51:47 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
status
200
cache-control
private
vary
Accept-Encoding
content-length
123
x-xss-protection
1; mode=block
IsUserAPAC
www.trustwave.com/umbraco/surface/AJAX/ 		5 B
163 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.trustwave.com/umbraco/surface/AJAX/IsUserAPAC
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.151.96.240 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
Security Headers
Name Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
X-Requested-With
XMLHttpRequest
Request-Id
|g8X29.A4iqO
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

strict-transport-security
max-age=600; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
x-aspnet-version
date
Sat, 23 Nov 2019 17:51:47 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
status
200
cache-control
private
vary
Accept-Encoding
content-length
123
x-xss-protection
1; mode=block
trans.gif
cb8302cf274008cbed640a051ef93bc1.azr.footprintdns.com/apc/ 		43 B
80 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cb8302cf274008cbed640a051ef93bc1.azr.footprintdns.com/apc/trans.gif?efa8c4874f83ce8863f7e321fbaf4e07
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1020:700:: London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:48 GMT
x-content-type-options
nosniff
last-modified
Thu, 19 Sep 2019 16:11:00 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
content-type
image/gif
status
200
accept-ranges
bytes
content-length
43
etag
"db56bed346fd51:0"
trans.gif
f2ee477b64bb231cba810c7fbd64ffae.azr.footprintdns.com/apc/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://f2ee477b64bb231cba810c7fbd64ffae.azr.footprintdns.com/apc/trans.gif?ee9502502ace4acdc7041a52087a830f
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1020:300:: Durham, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:47 GMT
x-content-type-options
nosniff
last-modified
Thu, 19 Sep 2019 16:11:00 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
content-type
image/gif
status
200
accept-ranges
bytes
content-length
43
etag
"db56bed346fd51:0"
trans.gif
f2ee477b64bb231cba810c7fbd64ffae.azr.footprintdns.com/apc/ 		43 B
80 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://f2ee477b64bb231cba810c7fbd64ffae.azr.footprintdns.com/apc/trans.gif?7f076959d8d02d6d10315dc61c749d69
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1020:300:: Durham, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:47 GMT
x-content-type-options
nosniff
last-modified
Thu, 19 Sep 2019 16:11:00 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
content-type
image/gif
status
200
accept-ranges
bytes
content-length
43
etag
"db56bed346fd51:0"
trans.gif
67d1b99e3f2a45ad2f7bd6597c38ab51.azr.footprintdns.com/apc/ 		43 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://67d1b99e3f2a45ad2f7bd6597c38ab51.azr.footprintdns.com/apc/trans.gif?46b4ddfc8335e8d0b1c0fc3ae99ca47a
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1020:600::8 Cardiff, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:47 GMT
x-content-type-options
nosniff
last-modified
Thu, 19 Sep 2019 16:11:00 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
content-type
image/gif
status
200
accept-ranges
bytes
content-length
43
etag
"db56bed346fd51:0"
trans.gif
67d1b99e3f2a45ad2f7bd6597c38ab51.azr.footprintdns.com/apc/ 		43 B
103 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://67d1b99e3f2a45ad2f7bd6597c38ab51.azr.footprintdns.com/apc/trans.gif?5cb7b20d0a85368fdd623da813c38edc
Requested by
Host: www.trustwave.com
URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1020:600::8 Cardiff, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

date
Sat, 23 Nov 2019 17:51:48 GMT
x-content-type-options
nosniff
last-modified
Thu, 19 Sep 2019 16:11:00 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
content-type
image/gif
status
200
accept-ranges
bytes
content-length
43
etag
"db56bed346fd51:0"
r.gif
www.atmrum.net/report/v1/atm/ 		42 B
194 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.atmrum.net/report/v1/atm/r.gif?MonitorID=atm&rid=6288338f2c0d566db3779a8ba12526dd&w3c=true&prot=https:&v=2017061301&tag=602cc9bb0a513db2b327299487211347&DATA=[{%22RequestID%22:%22cb8302cf274008cbed640a051ef93bc1%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:123},{%22RequestID%22:%22cb8302cf274008cbed640a051ef93bc1%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:29},{%22RequestID%22:%22f2ee477b64bb231cba810c7fbd64ffae%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:173},{%22RequestID%22:%22f2ee477b64bb231cba810c7fbd64ffae%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:35},{%22RequestID%22:%2267d1b99e3f2a45ad2f7bd6597c38ab51%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:126},{%22RequestID%22:%2267d1b99e3f2a45ad2f7bd6597c38ab51%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:38}]
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
204.79.197.234 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Origin
https://www.trustwave.com

Response headers

status
200
date
Sat, 23 Nov 2019 17:51:48 GMT
cache-control
no-store
x-msedge-ref
Ref A: 769F676D27CE49698EB69000E0A079C1 Ref B: FRAEDGE0206 Ref C: 2019-11-23T17:51:48Z
access-control-allow-origin
https://www.trustwave.com
content-type
image/gif
track
dc.services.visualstudio.com/v2/ 		0
311 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dc.services.visualstudio.com/v2/track
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
51.140.6.23 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Access-Control-Request-Method
POST
Origin
https://www.trustwave.com
Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Access-Control-Request-Headers
content-type,sdk-context

Response headers

Access-Control-Allow-Origin
*
Date
Sat, 23 Nov 2019 17:51:48 GMT
X-Content-Type-Options
nosniff
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
Content-Length
0
Access-Control-Max-Age
3600
Access-Control-Allow-Methods
POST
track
dc.services.visualstudio.com/v2/ 		98 B
521 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dc.services.visualstudio.com/v2/track
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
51.140.6.23 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
1d82df0bfd24b62e856a6d322dc0983a0d74fbd0995272d30fd34ce49d3f5540
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/
Origin
https://www.trustwave.com
Sdk-Context
appId
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Content-type
application/json

Response headers

x-ms-session-id
229FAE66-EAD2-4C82-A156-0BAA87000032
Strict-Transport-Security
max-age=31536000
X-Content-Type-Options
nosniff
Date
Sat, 23 Nov 2019 17:51:48 GMT
Access-Control-Max-Age
3600
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
Content-Length
98

Verdicts & Comments Add Verdict or Comment

157 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| dataLayer object| google_tag_manager function| postscribe string| GoogleAnalyticsObject function| ga string| _bizo_data_partner_id undefined| _bizo_data_partner_title undefined| _bizo_data_partner_domain undefined| _bizo_data_partner_company undefined| _bizo_data_partner_location undefined| _bizo_data_partner_employee_range undefined| _bizo_data_partner_sics undefined| _bizo_data_partner_email object| appInsights object| ___grecaptcha_cfg object| grecaptcha boolean| __google_recaptcha_client number| SThreshold number| globalmktoid boolean| globalpartnerform boolean| globalfooterform object| _vwo_code number| settings_timer number| _vwo_settings_timer object| Vimeo boolean| VimeoPlayerResizeEmbeds_ object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| lintrk boolean| _already_called_lintrk undefined| b object| vwo_iehack_queue function| __extends object| Microsoft object| AI object| recaptcha object| FormAbandonmentTracker string| ajaxReq function| autoSuggest string| navAjaxReq function| navAutoSuggest object| loadmorexrh function| objectifyForm function| trim function| rgb2hex function| rgbaToHex function| UpdateResults function| ShowHideLoadMore function| LoadingOn function| LoadingOff function| LoadMore function| GetCurrentLang function| MediaReleases function| CloneTabs function| FixScrollOnLoad function| MainMenu function| CardListCheckForZero function| OutputFooterGlobalForm function| FixButtonColorsinSections function| AddAusiLogo function| AddAPACLogo function| AddTaglineToLogo function| LoadDefaultMKTOForms function| FixConsoleErrors function| FixFooterSectionColorAngle function| ScrollToScript function| SpecialEventMenu function| PressReleases function| ToggleFilterOptions function| ResourceLibrary function| SearchResults function| SLBlog function| CardHeroSliders function| CardLists function| CardListOurHistory function| SWUpdates function| TWBlog function| getParameterByName function| jsonToUrl function| SetupImgClickToVideo object| videoLabels object| lastP object| _playerTitle object| _playerAuthor object| _playerAuthorURL object| _playerUploadDate function| Vimeoinit function| updateUrl function| onMessageReceived function| post function| getLabel function| getVimeoInfo function| vimeoCallback function| onReady function| onPlay function| onPause function| onPlayProgress object| Modernizr function| $ function| jQuery function| Cookies function| pluralRuleParser function| TWFilters object| MktoForms2 function| TWLang object| mktoprefilldata function| TWMkto function| TWStepsForm function| supportInfo object| rum function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto object| OneTrust string| containerName string| languageSwitcherFileName string| useDocumentLanguage string| languageSwitcherFilePathPart string| languageSwitcherURL function| getLanguageSwitcherScriptPath function| isLanguageSwitcherFile function| OptanonWrapper object| addthis_share object| addthis_config object| closure_lm_134146 object| Munchkin object| MunchkinTracker function| mktoMunchkin function| mktoMunchkinFunction object| Footprint object| google_optimize boolean| __@@##MUH object| oattr undefined| a undefined| c function| jsonFeed object| Optanon string| OnetrustActiveGroups string| OptanonActiveGroups object| fpconfig function| filterHandler

1 Cookies

Domain/Path Name / Value
.trustwave.com/ Name: OptanonConsent
Value: groups=1%3A1%2C2%3A0%2C3%3A0%2C0_32924%3A1%2C4%3A0%2C0_32898%3A0%2C0_32899%3A0%2C0_32900%3A0%2C0_32901%3A0%2C0_32902%3A0%2C0_32903%3A0%2C0_32904%3A0%2C0_32905%3A0%2C0_32893%3A0%2C0_32894%3A0%2C0_32895%3A0%2C0_32896%3A0%2C0_32897%3A0&datestamp=Sat+Nov+23+2019+18%3A51%3A48+GMT%2B0100+(Central+European+Standard+Time)&version=4.8.0

2 Console Messages

Source Level URL
Text
console-api warning URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js(Line 1)
Message:
AI: CannotSerializeObjectNonSerializable message:"Attempting to serialize an object which does not implement ISerializable" props:"{name:baseData}"
console-api warning URL: https://www.trustwave.com/dist/js/scripts.min.js?v=v26sa(Line 1)
Message:
jQuery.Deferred exception: pageid is not defined ReferenceError: pageid is not defined at HTMLDocument.<anonymous> (https://www.trustwave.com/dist/js/scripts.min.js?v=v26sa:1:441397) at e (https://www.trustwave.com/dist/js/scripts.min.js?v=v26sa:1:36973) at t (https://www.trustwave.com/dist/js/scripts.min.js?v=v26sa:1:37275) undefined

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=600; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

67d1b99e3f2a45ad2f7bd6597c38ab51.azr.footprintdns.com
815-rfm-693.mktoresp.com
az416426.vo.msecnd.net
cb8302cf274008cbed640a051ef93bc1.azr.footprintdns.com
cookie-cdn.cookiepro.com
dc.services.visualstudio.com
dev.visualwebsiteoptimizer.com
f2ee477b64bb231cba810c7fbd64ffae.azr.footprintdns.com
fast.fonts.net
fonts.gstatic.com
geolocation.onetrust.com
match.adsrvr.org
munchkin.marketo.net
npercoco.typepad.com
player.vimeo.com
px.ads.linkedin.com
s7.addthis.com
sjs.bizographics.com
stats.g.doubleclick.net
trustwave.blob.core.windows.net
v1.addthisedge.com
vidassets.terminus.services
www.atmrum.net
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
www.trustwave.com
z.moatads.com
104.18.138.190
151.101.12.217
152.199.19.160
159.122.87.148
192.28.144.124
2.21.36.164
204.79.197.234
23.8.10.242
2603:1020:300::
2603:1020:600::8
2603:1020:700::
2606:2800:234:660:118e:28f:1d8a:2522
2606:4700:10::6814:b82d
2606:4700:10::6814:b944
2a00:1450:4001:800::2003
2a00:1450:4001:800::2004
2a00:1450:4001:819::2003
2a00:1450:4001:81b::2008
2a00:1450:4001:81c::200e
2a00:1450:4001:81f::2003
2a00:1450:400c:c08::9b
2a02:26f0:10c:399::3adf
2a05:f500:10:101::b93f:9101
2a05:f500:10:101::b93f:9105
51.140.6.23
52.151.96.240
52.222.174.130
52.239.152.234
52.49.153.216
72.247.226.64
013819105effb1832cbcbcfcc6317b0045170a7f671bd953a21f0847fa1a2e6e
049bf83ad4e353fb4bce7d9fff2ba6b0996aa1a8bbdba76ca83a2ee78c887687
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
0b1d7f87f3ca4c8b4bd749b02b6ad71c930b7e306c752a2e2293d7b250b02e27
0bd0bc4edd5e4b256b9c40ce082680ad16a78ac5faf4d3337d39cf9605518bfe
0c9ea8d5d78894047d11c4f301a3c05fcbef0aad9530a4af4cffc7ec5f46b9fa
0dfa4684ad9c52a1a97d91764ef1d404c15dd95ed20f00a2f9f3f4d11df2abf9
19a5abc3ee71d9689286163dd786564ab2d59a118563fc140e62fa96d0d386df
1c3bfab00f5e70133e4daafbd95aea46f572bbcf33335ee75b9f2240742c7982
1d82df0bfd24b62e856a6d322dc0983a0d74fbd0995272d30fd34ce49d3f5540
25f4029ca7cae1a317757b015488d4a24a174ad968c213d9c3ec8b5cdc92c6fe
2a1c9874549a1cb94b6e0dc5822b4f5ca14386d39214a8145670fc1c50045496
2e45a8996ec5c8b3fce4c3f71fc56ef806673998113d09c32f73c7a3d6efdb38
2f2c9772b87f349fb9b5292ffac8eb44a25968e253c22b61628011aa57ad6a37
3211cd82ce26fec042b2543617d3138a366d470fa74ed56788c3b0956c9f9ffb
32ea28e4cc9fb2662d406bc5e859f774b58f927861c31864c33cb81aa8263aac
37e63ec3246a6e7123104d262fb182293599ad45878c56476be17594b048f339
3b6f51d30b4b20b9e7b3da75b5c14a51ce39ec203b9fa37e043f097272d5540e
3f18aeab9b9baa3e61c4bc2cd0372e3946f494bd03bff3cad740e5ea817fce2b
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
42f2f65a52347bf6ed6c0633b5458c48ddc1b439923c92caec18c6d6f111afe3
442ea31252146edee6257a0d2a320511fca7b9c5b18a187662011475bd8e06e9
46647527924f0574eded74e7ef9a93d43044a47dcd1b11b9a203c0a9a8bb65e9
4cf8b4da854cac70fb514c2d255e93904353bda1fcc7229de2f59d5971d83028
4d84802c2cc3550892199289d28a046c4e1d011964c7c7f9d43bdeebecf107de
4fb02286499439e694d9a4220d6ca3ab664b2ba4bdb699b9068aa8e6fd5528c6
508e6f3fb69e549be60a6ac9c70a2a044f28e566a7a6c39c6bf10c189e94170c
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
58da1e483d01174d84d8ec20bd621eb17dc12dadf9ff7b2a6cd3218670ae6621
5a4589d3f0e2f85a7acbe4ee104d80dcba518e9e0f9f1706f146de1d51efd716
5ec923aa6be3895f83ced26f99254fd46d4b1158df9c6a7efc580fa3a21fd4d9
60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
64ed842d23dcee23e4cf9257dd18ce0066a76cd75108e7fc95f13a4a9b0e892c
64f5b163f57390ef83cfaa8e328cdbaa6baf4305cedf341549b37f8e68986d83
6f74810c7b9e3e110f9c80950aa75cf88f3573c4bb2cd1b92a643e03db73c62f
719df7954428f52779f3fa18641c19fc854b39394193d87eea5a61795dec8dbe
72766f736186eb5c7c6d08502f3bf28da0092e8ea85cf3b5413c9daf8dc2d94a
739b04d51205b32bbc9eebee051946d76dab1552fe4ca57c2787e1d8f6b55b51
7c20e3e201e3d7c6821e907def1257deb544eb08578c7129b96d53bbf62d34e4
80afdcdab5af95e11f8edac404947668a91582b9799723a8d5272483a010f23d
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
86d78a37f9eed924112a2d4b927366b5a0fa97d78c2f338e86d9681a7c82fb9f
89bdf549d76d6869d69a09923a7ed7774059693e6c44e468d62b3455b43ed80b
89c6e9bfa9bbb7631c0699f5529b4f0ae35f25843bb1c776e60c30e72a05e8ad
9081c649d724d2d9653447b9f454460d90682897c5ec090383947ce924e8a92f
9298a280eda6b54290d3c69fda3ae7da0cec1a0169d01d4e5944af63d68939d5
9545498791418ba2847374815a974cc5bad7368ffb1df4c44c67d25027dd219e
98bc0be6a4f1b066103df391d21bbf7db65f1268867c270f95b230c933f277bb
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
a02b61289de24053eeef501b3de570c975a083594cf6789f2f541ed70ec95d20
a637d3ff767789f9b113bbfa208bdb6a76efed7c4c111da2a130f6a38a51d353
a6e6828f3d8b1a0cdb62c0f09ef6fc911866e0e41e3b167c889775521a32ec64
a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726
ace78f63f590160b0748a26e60d8b453b4d4ac8bc4da20967632bf7e5bcb58e3
afdb51ca4091dab446883adfecd01177ccff53d591802db6f50955f990bd0e11
b039f2982db54f667f7d7274fca4ff8fcf4ae6dacb09fdde0b21089927104cfa
b0817a0d6a87f2d42532035e42b20ea55cfaa5ca1092c761f5fc5e734790bdbf
b0f35cc025dc27ea345536d4eafc13e52fe2b1c237fd6c4150d4dbf85c323c27
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b4c96f55c265e0a80be4243a16f7e88b9a67c85b71b4e2aa8cea4e1aa989b0d1
bd1f1f47a863ac3be54dab002af884683776e666b68d50ec7641ca732991d54f
c7462996b5100030c14d741c4852012390a78e583e02910d99036c68fd07499e
c750113ac663d3ae3adea8e042237ac1c5ea21f9ad1749efc357ea93acbc5d78
c889f8be02dd3f558aa62eecb48553fb5a306c9fff0951bd97ff3b40a46875e0
cf7008a1bb1e7dcffa096b3f0c782f3dd610f847413ae4861a5c03006f093553
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef17abba195ddfd0ad62db48e71eebe2e7dd1b5a52e8ed8d81c368ef63835a4c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f422b8961953524e333d562521c3b4e0a2ed33da87079bd92c08ec4389372358
f97341de4415531cb15d7472b1a00e875c1ad9b5541fd7e9f8ef5905f2a02092